Function at 0x4b44b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x32]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4b4bf7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x4cc7b8]
mov eax, dword [eax]
xor edx, edx
call fcn.0045dc9c
push eax
call sub.user32.dll_SetCursor
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004b1d44
test eax, eax
jle 0x4b45b6
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004b1d44
mov edx, eax
dec edx
mov eax, ebx
call fcn.004b1d4c
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x4b45a2
mov eax, esi
call fcn.004b1d44
cmp ebx, eax
jge 0x4b45a2
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.004b1d4c
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x4b458e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004b1d44
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x4b458e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.004b1d4c
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4b45a2
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004b3a84
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x4b45cc
mov eax, ebx
call fcn.00441b48
call fcn.004be3bc
mov byte [ebp - 6], 1
jmp 0x4b4bbf
cmp byte [ebp - 6], 0
jne 0x4b45e0
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4b4b9e
mov eax, dword [edi + 4]
sub eax, 0x12
je 0x4b46e6
sub eax, 0x34
je 0x4b4612
add eax, 0xffffffa5
sub eax, 9
jb 0x4b46e6
sub eax, 0x157
je 0x4b4623
jmp 0x4b46f2
push ebp
call fcn.004b4460
pop ecx
call fcn.00403a40
jmp 0x4b4bfe
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.0040706c
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00438df0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4b469b
lea edx, [ebp - 0xe]
lea eax, [ebx + 0x95]
call fcn.004060e4
test al, al
je 0x4b469b
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00441b48
push eax
call sub.user32.dll_PostMessageA
jmp 0x4b46f2
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4b46c9
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00438df0
lea edx, [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
call fcn.004060e4
test al, al
je 0x4b46c6
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x4b46d1
test bl, bl
je 0x4b46a2
test bl, bl
jne 0x4b46f2
push ebp
call fcn.004b4460
pop ecx
call fcn.00403a40
jmp 0x4b4bfe
push ebp
call fcn.004b4460
pop ecx
jmp 0x4b4b9e
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4b4b9e
mov eax, dword [edi + 4]
mov edx, eax
sub edx, 0x7b
je 0x4b4b9e
add edx, 0xffffff7b
sub edx, 9
jb 0x4b4749
add edx, 0xffffff09
sub edx, 0xb
jb 0x4b4a0a
sub edx, 0x264
jne 0x4b4b98
mov eax, dword [ebp - 4]
call fcn.004b4118
jmp 0x4b4b9e
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4b4b9e
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4b477f
sub eax, 2
je 0x4b49b1
sub eax, 2
je 0x4b477f
sub eax, 2
je 0x4b49b1
jmp 0x4b4b9e
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4b47c2
je 0x4b4874
cmp eax, 0x12
jg 0x4b47ab
je 0x4b499a
sub eax, 9
je 0x4b4b9e
sub eax, 4
je 0x4b47e7
jmp 0x4b49a6
sub eax, 0x1b
je 0x4b484c
sub eax, 5
je 0x4b4b9e
jmp 0x4b49a6
sub eax, 0x26
je 0x4b495d
dec eax
je 0x4b48de
dec eax
je 0x4b4977
sub eax, 0x51
je 0x4b499a
jmp 0x4b49a6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4b47fa
mov si, 0xffef
call fcn.00403404
mov eax, dword [ebp - 4]
call fcn.004b4118
test al, al
jne 0x4b4b9e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4b4b9e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4b4c0c
call fcn.00404920
je 0x4b4b9e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x4b4b9e
push ebp
call fcn.004b4460
pop ecx
jmp 0x4b4b9e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x4b485a
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.00403a40
jmp 0x4b4bfe
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4b488a
mov eax, dword [ebp - 4]
call fcn.004b4320
jmp 0x4b4b9e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x4b4b9e
cmp byte [ebx + 0x34], 0
je 0x4b48bf
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00441b48
push eax
call sub.user32.dll_PostMessageA
call fcn.00403a40
jmp 0x4b4bfe
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00441b48
push eax
call sub.user32.dll_PostMessageA
jmp 0x4b4b9e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4b48f4
mov eax, dword [ebp - 4]
call fcn.004b41f0
jmp 0x4b4b9e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x4b4b9e
mov eax, dword [ebp - 4]
call fcn.004b4118
test al, al
jne 0x4b4b9e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
cmp byte [ebx + 0x34], 0
je 0x4b493e
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00441b48
push eax
call sub.user32.dll_PostMessageA
call fcn.00403a40
jmp 0x4b4bfe
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00441b48
push eax
call sub.user32.dll_PostMessageA
jmp 0x4b4b9e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4b4b9e
mov eax, dword [ebp - 4]
call fcn.004b4320
jmp 0x4b4b9e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4b498d
mov eax, dword [ebp - 4]
call fcn.004b41f0
jmp 0x4b4b9e
mov eax, dword [ebp - 4]
call fcn.004b4118
jmp 0x4b4b9e
push ebp
call fcn.004b4460
pop ecx
jmp 0x4b4b9e
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4b4b9e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004b3004
test eax, eax
je 0x4b4b9e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004b3004
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], ebx
test ebx, ebx
je 0x4b49eb
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00441b48
push eax
call sub.user32.dll_PostMessageA
jmp 0x4b4b9e
sub eax, 0x200
je 0x4b4a1f
sub eax, 2
je 0x4b4add
jmp 0x4b4b9e
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.0040706c
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x4cf23c]
jne 0x4b4a50
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x4cf240]
je 0x4b4b9e
mov esi, dword [ebp - 4]
jmp 0x4b4a57
mov esi, eax
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x4b4a55
test esi, esi
je 0x4b4ac6
mov ebx, dword [esi + 0x40]
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004b3a84
cmp ebx, dword [esi + 0x40]
je 0x4b4abf
cmp esi, dword [ebp - 4]
je 0x4b4abf
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x4b4a9e
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00441b48
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x48]
cmp esi, ebx
jne 0x4b4a80
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.00441b48
push eax
call sub.user32.dll_PostMessageA
call fcn.00403a40
jmp 0x4b4bfe
mov esi, dword [esi + 0x4c]
test esi, esi
jne 0x4b4a62
mov eax, dword [ebp - 0xe]
mov dword [0x4cf23c], eax
mov eax, dword [ebp - 0xa]
mov dword [0x4cf240], eax
jmp 0x4b4b9e
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.0040706c
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00438df0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4b4b55
lea edx, [ebp - 0xe]
lea eax, [ebx + 0x95]
call fcn.004060e4
test al, al
je 0x4b4b55
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00441b48
push eax
call sub.user32.dll_PostMessageA
jmp 0x4b4b9e
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4b4b83
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00438df0
lea edx, [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
call fcn.004060e4
test al, al
je 0x4b4b80
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x4b4b8b
test bl, bl
je 0x4b4b5c
test bl, bl
jne 0x4b4b9e
push ebp
call fcn.004b4460
pop ecx
jmp 0x4b4b9e
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004b448c
pop ecx
test al, al
je 0x4b4bbf
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4b45e9
push ebp
call fcn.004b448c
pop ecx
test al, al
jne 0x4b45d5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4bfe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x4b4bea
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.004be3dc
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret