Function at 0x4b3538
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b3bc2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x11
call sub.user32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
sete al
cmp word [esi + 4], 0xd
jne 0x4b358e
mov edx, dword [ebx + 0x2e0]
cmp byte [edx + 0x57], 0
je 0x4b358e
mov eax, ebx
call fcn.004b6fa8
jmp 0x4b3ba7
mov dx, word [esi + 4]
sub dx, 9
je 0x4b35a2
sub dx, 4
je 0x4b35a2
xor edx, edx
jmp 0x4b35a4
mov dl, 1
test dl, al
je 0x4b35b6
mov edx, esi
mov eax, ebx
call fcn.0046be0c
jmp 0x4b3ba7
cmp word [esi + 4], 0x24
jne 0x4b35e5
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4b35e5
xor edx, edx
mov eax, dword [ebx + 0x2e4]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4b3ba7
cmp word [esi + 4], 0x23
jne 0x4b3622
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4b3622
mov edi, dword [ebx + 0x2e4]
mov eax, dword [edi + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4b3ba7
cmp word [esi + 4], 0x22
jne 0x4b36b8
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4b36b8
mov eax, dword [ebx + 0x2e4]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edi, eax
mov eax, dword [ebx + 0x2e8]
add edi, dword [eax + 0xc]
mov eax, dword [ebx + 0x2e4]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp edi, eax
jge 0x4b368e
mov edi, dword [ebx + 0x2e4]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
mov eax, dword [ebx + 0x2e8]
add edx, dword [eax + 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
jmp 0x4b36ac
mov edi, dword [ebx + 0x2e4]
mov eax, dword [edi + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4b3ba7
cmp word [esi + 4], 0x21
jne 0x4b3727
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4b3727
mov eax, dword [ebx + 0x2e4]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, dword [ebx + 0x2e8]
cmp eax, dword [edx + 0xc]
jle 0x4b370b
mov edi, dword [ebx + 0x2e4]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
mov eax, dword [ebx + 0x2e8]
sub edx, dword [eax + 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
jmp 0x4b371b
xor edx, edx
mov eax, dword [ebx + 0x2e4]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4b3ba7
cmp word [esi + 4], 0xd
jne 0x4b3764
cmp byte [ebx + 0x264], 0
je 0x4b3764
mov word [esi + 4], 9
mov eax, ebx
call fcn.0046cf88
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b3764
push 0
push 9
push pe_nt_image_headers32
mov eax, ebx
call fcn.0046cf88
push eax
call sub.user32.dll_PostMessageA
cmp word [esi + 4], 0x27
jne 0x4b37b8
cmp dword [ebx + 0x27c], 0
je 0x4b37b8
push 0
push 0
push 0xb0
mov eax, ebx
call fcn.0046cf88
push eax
call sub.user32.dll_SendMessageA
call fcn.00408258
movzx edi, ax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004b4efc
mov eax, dword [ebp - 8]
call fcn.00405310
cmp edi, eax
jl 0x4b37b8
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b3ba7
cmp word [esi + 4], 0x2e
jne 0x4b3823
cmp dword [ebx + 0x27c], 0
je 0x4b3823
push 0
push 0
push 0xb0
mov eax, ebx
call fcn.0046cf88
push eax
call sub.user32.dll_SendMessageA
call fcn.00408258
movzx edi, ax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004b4efc
mov eax, dword [ebp - 0xc]
call fcn.00405310
cmp edi, eax
jl 0x4b381a
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
jne 0x4b381a
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b3ba7
mov dl, 1
mov eax, ebx
call fcn.004b5fb0
cmp word [esi + 4], 0x25
jne 0x4b3870
cmp dword [ebx + 0x278], 0
je 0x4b3870
push 0
push 0
push 0xb0
mov eax, ebx
call fcn.0046cf88
push eax
call sub.user32.dll_SendMessageA
call fcn.00408258
movzx edi, ax
mov eax, dword [ebx + 0x278]
call fcn.00405310
cmp edi, eax
jg 0x4b3870
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b3ba7
cmp word [esi + 4], 0x23
jne 0x4b38f5
cmp dword [ebx + 0x27c], 0
je 0x4b38f5
push 0x10
call sub.user32.dll_GetKeyState
movsx eax, ax
test ah, 0x80
jne 0x4b38bb
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004b4efc
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xdc]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xd8]
jmp 0x4b38e5
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004b4efc
mov eax, dword [ebp - 0x14]
call fcn.00405310
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
pop edx
sub edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xd8]
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b3ba7
cmp word [esi + 4], 0x24
jne 0x4b3991
cmp dword [ebx + 0x278], 0
je 0x4b3991
push 0x10
call sub.user32.dll_GetKeyState
movsx eax, ax
test ah, 0x80
jne 0x4b3941
mov eax, dword [ebx + 0x278]
call fcn.00405310
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xdc]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xd8]
jmp 0x4b3981
mov eax, dword [ebx + 0x278]
call fcn.00405310
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004b4efc
mov eax, dword [ebp - 0x18]
call fcn.00405310
mov edi, eax
mov eax, dword [ebx + 0x278]
call fcn.00405310
add edi, eax
push edi
push 0xb1
mov eax, ebx
call fcn.0046cf88
push eax
call sub.user32.dll_SendMessageA
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b3ba7
cmp word [esi + 4], 8
jne 0x4b39d6
cmp dword [ebx + 0x278], 0
je 0x4b39d6
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edi, eax
mov eax, dword [ebx + 0x278]
call fcn.00405310
inc eax
cmp edi, eax
jg 0x4b39cd
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b3ba7
mov dl, 1
mov eax, ebx
call fcn.004b5fb0
cmp word [esi + 4], 0x2e
jne 0x4b3aa8
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edi, eax
mov eax, dword [ebx + 0x278]
call fcn.00405310
cmp edi, eax
jl 0x4b3aa8
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004b4efc
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
jne 0x4b3a41
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
push eax
mov eax, dword [ebx + 0x278]
call fcn.00405310
pop edx
sub edx, eax
inc edx
lea eax, [ebp - 4]
mov ecx, 1
call fcn.004055b0
jmp 0x4b3a6f
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
push eax
mov eax, dword [ebx + 0x278]
call fcn.00405310
pop edx
sub edx, eax
inc edx
lea eax, [ebp - 4]
pop ecx
call fcn.004055b0
cmp word [ebx + 0x272], 0
jle 0x4b3a9f
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004b4e6c
dec eax
movsx edx, word [ebx + 0x272]
cmp eax, edx
jle 0x4b3a9f
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b3ba7
mov dl, 1
mov eax, ebx
call fcn.004b5fb0
cmp word [esi + 4], 0x26
jne 0x4b3af0
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4b3af0
mov eax, dword [ebx + 0x2e4]
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
jle 0x4b3aea
mov edi, dword [ebx + 0x2e4]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
dec edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov word [esi + 4], 0
cmp word [esi + 4], 0x28
jne 0x4b3b4c
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4b3b4c
mov eax, dword [ebx + 0x2e4]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edi, eax
inc edi
mov eax, dword [ebx + 0x2e4]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp edi, eax
jge 0x4b3b46
mov edi, dword [ebx + 0x2e4]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
inc edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov word [esi + 4], 0
mov edx, esi
mov eax, ebx
call fcn.0046be0c
cmp word [esi + 4], 0x2e
jne 0x4b3b6c
cmp byte [ebx + 0x237], 7
jne 0x4b3b6c
mov eax, ebx
call fcn.004b5320
cmp dword [ebx + 0x278], 0
je 0x4b3ba7
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
mov esi, eax
mov eax, dword [ebx + 0x278]
call fcn.00405310
cmp esi, eax
jge 0x4b3ba7
mov eax, dword [ebx + 0x278]
call fcn.00405310
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xdc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3bc9
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00405074
ret