Function at 0x4eae60
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push esi
mov esi, ecx
push edi
push 0x10
mov dword [esi], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], bl
mov byte [esi + 0xb], bl
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xd], 1
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call ebp
test ax, ax
setl al
push 0x11
mov byte [esi + 9], al
call ebp
test ax, ax
jge 0x4eaeb7
push 0x12
call ebp
test ax, ax
jl 0x4eaeb7
mov eax, 1
jmp 0x4eaeb9
xor eax, eax
push 0x90
mov byte [esi + 0xa], al
mov byte [esi + 8], bl
mov byte [esi + 0xb], bl
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], 1
mov dword [esi + 0x10], ebx
call ebp
and eax, 1
mov dword [esp + 0x10], eax
cmp byte [esp + 0x1c], bl
je 0x4eb1b9
mov edi, dword [esp + 0x18]
push edi
call ebp
test ax, ax
setl cl
cmp edi, 0x10
mov byte [esi + 0xc], cl
jne 0x4eaf20
push 0xa1
mov byte [esi + 8], 1
mov dword [esi], 0x65
call ebp
xor edx, edx
test ax, ax
setl dl
pop edi
mov eax, esi
inc edx
mov dword [esi + 0x10], edx
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, 0x11
jne 0x4eaf4c
push 0xa3
mov byte [esi + 8], 1
mov dword [esi], 0x66
call ebp
xor ecx, ecx
test ax, ax
setl cl
pop edi
mov eax, esi
inc ecx
mov dword [esi + 0x10], ecx
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp dword [esp + 0x10], ebx
je 0x4eaf76
cmp edi, 0x5f
jle 0x4eaf76
cmp edi, 0x6a
jge 0x4eaf76
add edi, 0xffffffd0
mov dword [esi], edi
pop edi
mov byte [esi + 0xb], 1
mov dword [esi + 0x10], 3
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, 0x69
jle 0x4eaf9a
cmp edi, 0x70
jge 0x4eaf9a
add edi, 0xffffffc0
mov dword [esi], edi
pop edi
mov byte [esi + 0xb], 1
mov dword [esi + 0x10], 3
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, 0x6f
jle 0x4eafb7
cmp edi, 0x7f
jge 0x4eafb7
add edi, 0xffffffb9
mov dword [esi], edi
pop edi
mov byte [esi + 8], 1
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
lea eax, [edi - 8]
cmp eax, 0x89
ja case.0x4eafcc.10
movzx edx, byte [eax + 0x4eb22c]
jmp dword [edx*4 + 0x4eb1cc]
pop edi
mov byte [esi + 8], 1
mov dword [esi], 1
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 2
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 3
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 4
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 5
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 6
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 7
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 8
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x12
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0xd
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0xe
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0xf
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x10
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x11
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x16
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x17
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x18
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x19
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x13
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x20
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x38
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x39
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x3a
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push edi
mov ecx, esi
call fcn.004eade0
movzx eax, al
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x18]
pop edi
mov dword [esi], ecx
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8