Function at 0x4cecfb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
mov dword [ebp - 0x94], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x24]
and eax, 1
test eax, eax
je 0x4cf239
cmp dword [ebp - 4], 0x200
je 0x4ced5b
cmp dword [ebp - 4], 0xa0
je 0x4ced5b
cmp dword [ebp - 4], 0x202
je 0x4ced5b
cmp dword [ebp - 4], 0x205
je 0x4ced5b
cmp dword [ebp - 4], 0x208
jne 0x4cf239
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x4cf239
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl 0x4cf239
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x4cf239
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.00501368
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x4cedcd
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x94]
je 0x4cedcd
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x24]
and edx, 1
test edx, edx
jne 0x4cedcd
mov ecx, dword [ebp - 0x38]
call fcn.00544de5
mov dword [ebp - 0x38], eax
jmp 0x4ceda2
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x94]
je 0x4ceddd
jmp 0x4cf239
mov ecx, 0x60f180
call fcn.004c4900
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0xcc]
mov dword [ebp - 0x40], edx
mov ecx, dword [ebp - 0x94]
call fcn.00504733
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x40], 0
je 0x4cee6d
mov ecx, dword [ebp - 0x40]
call fcn.00543854
cmp eax, dword [ebp - 0x7c]
je 0x4cee6d
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x40]
call dword [edx + 0x60]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x80], ecx
cmp dword [ebp - 0x80], 0
je 0x4cee4f
push 1
mov edx, dword [ebp - 0x80]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x80]
call dword [eax + 4]
mov dword [ebp - 0x98], eax
jmp 0x4cee59
mov dword [ebp - 0x98], 0
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 0xcc], 0
mov dword [ebp - 0x40], 0
cmp dword [ebp - 0x40], 0
jne 0x4cef34
push 0x166
push str.tooltip.cpp
push 0x58
call fcn.00509509
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4ceeaa
mov ecx, dword [ebp - 0x88]
call fcn.004ce1a0
mov dword [ebp - 0x9c], eax
jmp 0x4ceeb4
mov dword [ebp - 0x9c], 0
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x40], edx
push 1
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.004ce1f9
test eax, eax
jne 0x4cef17
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x8c], edx
cmp dword [ebp - 0x8c], 0
je 0x4cef08
push 1
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x8c]
call dword [edx + 4]
mov dword [ebp - 0xa0], eax
jmp 0x4cef12
mov dword [ebp - 0xa0], 0
jmp 0x4cf239
push 0
push 0
push 0x401
mov ecx, dword [ebp - 0x40]
call fcn.005438b9
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x40]
mov dword [eax + 0xcc], ecx
push 0x170
push str.tooltip.cpp
mov edx, dword [ebp - 0x40]
push edx
call fcn.0050b1e0
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4cef6c
push 0x171
push str.tooltip.cpp
call fcn.00542d30
test eax, eax
je 0x4cef6c
int3
xor edx, edx
test edx, edx
jne 0x4cef47
push 0x2c
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.004d13f0
add esp, 0xc
mov dword [ebp - 0x30], 0x2c
mov dword [ebp - 0x2c], 1
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x24], ecx
lea edx, [ebp - 0x30]
push edx
push 0
push 0x408
mov ecx, dword [ebp - 0x40]
call fcn.005438b9
test eax, eax
jne 0x4cf084
cmp dword [ebp - 0x30], 0x2c
je 0x4cefdd
push 0x17b
push str.tooltip.cpp
call fcn.00542d30
test eax, eax
je 0x4cefdd
int3
xor eax, eax
test eax, eax
jne 0x4cefc3
cmp dword [ebp - 0x2c], 1
je 0x4ceffd
push 0x17c
push str.tooltip.cpp
call fcn.00542d30
test eax, eax
je 0x4ceffd
int3
xor ecx, ecx
test ecx, ecx
jne 0x4cefe3
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x28]
cmp eax, dword [edx + 0x1c]
je 0x4cf025
push 0x17d
push str.tooltip.cpp
call fcn.00542d30
test eax, eax
je 0x4cf025
int3
xor ecx, ecx
test ecx, ecx
jne 0x4cf003
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x1c]
je 0x4cf04d
push 0x17e
push str.tooltip.cpp
call fcn.00542d30
test eax, eax
je 0x4cf04d
int3
xor ecx, ecx
test ecx, ecx
jne 0x4cf02b
lea edx, [ebp - 0x30]
push edx
push 0
push 0x404
mov ecx, dword [ebp - 0x40]
call fcn.005438b9
test eax, eax
jne 0x4cf07e
push 0x17f
push str.tooltip.cpp
call fcn.00542d30
test eax, eax
je 0x4cf07e
int3
xor eax, eax
test eax, eax
jne 0x4cf053
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ecx + 0x14]
push eax
lea ecx, [ebp - 0x74]
call fcn.0054a170
lea ecx, [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x2c
push 0
lea ecx, [ebp - 0x6c]
push ecx
call fcn.004d13f0
add esp, 0xc
mov dword [ebp - 0x6c], 0x2c
lea edx, [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x94]
call dword [eax + 0x6c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0xffffffff
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x94]
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0xd4]
cmp eax, dword [ebp - 0x3c]
jne 0x4cf115
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0xd0]
cmp edx, dword [ebp - 0x78]
je 0x4cf20e
cmp dword [ebp - 0x3c], 0xffffffff
je 0x4cf1b0
mov ecx, 0xb
lea esi, [ebp - 0x6c]
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x2c]
and eax, 0x3fffffff
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x30]
push ecx
push 0
push 0x404
mov ecx, dword [ebp - 0x40]
call fcn.005438b9
test eax, eax
jne 0x4cf162
push 0x192
push str.tooltip.cpp
call fcn.00542d30
test eax, eax
je 0x4cf162
int3
xor edx, edx
test edx, edx
jne 0x4cf137
mov eax, dword [ebp - 0x68]
and eax, 0x40000000
test eax, eax
jne 0x4cf183
mov ecx, dword [ebp - 0x94]
call fcn.005047a5
test eax, eax
je 0x4cf1b0
push 0
push 1
push 0x401
mov ecx, dword [ebp - 0x40]
call fcn.005438b9
push 0x213
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.004cf242
mov edx, dword [ebp - 0x34]
cmp dword [edx + 0xd8], 0x2c
jne 0x4cf1e1
mov eax, dword [ebp - 0x34]
add eax, 0xd8
push eax
push 0
push 0x405
mov ecx, dword [ebp - 0x40]
call fcn.005438b9
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x78]
mov dword [ecx + 0xd0], edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 0xd4], ecx
mov edi, dword [ebp - 0x34]
add edi, 0xd8
mov ecx, 0xb
lea esi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
jmp 0x4cf221
cmp dword [ebp - 0x3c], 0xffffffff
je 0x4cf221
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x40]
push eax
call fcn.004cf242
cmp dword [ebp - 0x48], 0xffffffff
je 0x4cf239
cmp dword [ebp - 0x4c], 0
jne 0x4cf239
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.004d38a0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4