Function at 0x4bcab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
cmp edi, 0x10
mov dword [ebp - 4], eax
je 0x4bd246
cmp edi, 0x11
je 0x4bd246
push esi
lea ecx, [ebp - 0x18]
call fcn.004b7162
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp edi, 9
je 0x4bcb02
cmp edi, 0x2d
je 0x4bcb02
push 0x11
call ebx
test ax, ax
jl 0x4bcb02
push dword [esi + 0x60]
mov ecx, esi
call fcn.004bb1f1
mov ecx, esi
call fcn.004b65bb
mov ecx, esi
mov dword [0x58ccb4], eax
call fcn.004b65cf
push 0x2e
mov dword [0x58ccb0], eax
call ebx
test ax, ax
jl 0x4bcb74
push 9
call ebx
test ax, ax
jl 0x4bcb74
push 0x2d
call ebx
test ax, ax
jl 0x4bcb74
push 8
call ebx
test ax, ax
jl 0x4bcb74
push 0x10
call ebx
test ax, ax
jl 0x4bcb74
push dword [esi + 0x68]
mov ecx, esi
push dword [esi + 0x64]
push dword [esi]
call fcn.004ba04d
mov eax, dword [esi + 0x60]
mov ecx, esi
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], eax
call fcn.004b9f1d
push 0xfffffbff
push dword [esi]
call fcn.004bb900
jmp 0x4bcb85
mov eax, dword [esi + 0x68]
cmp eax, dword [esi + 0x64]
jne 0x4bcb85
mov eax, dword [esi + 0x60]
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
push dword [esi]
mov dword [ebp - 8], 1
call dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi + 0x68]
cmp eax, dword [esi + 0x64]
je 0x4bcba7
cmp edi, 8
jne 0x4bcba7
push 0x2e
pop edi
mov dword [ebp + 8], edi
cmp edi, 0x24
ja 0x4bcfa5
je 0x4bcf3d
mov eax, edi
sub eax, 8
je 0x4bce18
dec eax
je 0x4bce08
sub eax, 4
je 0x4bcdf8
sub eax, 0x14
je 0x4bcd61
dec eax
je 0x4bcca5
dec eax
jne 0x4bd23e
push 0x11
call ebx
test ax, ax
jge 0x4bcc83
mov ecx, dword [esi + 0x90]
mov edi, dword [esi + 0xd0]
mov eax, ecx
xor edx, edx
div edi
mov dword [esi + 0x60], ecx
test edx, edx
jne 0x4bcc1b
mov eax, ecx
mov dword [esi + 0x6c], edi
div edi
sub eax, dword [esi + 0x74]
dec eax
jmp 0x4bcc27
mov dword [esi + 0x6c], edx
mov eax, ecx
xor edx, edx
div edi
sub eax, dword [esi + 0x74]
push 0x10
mov dword [esi + 0x70], eax
call ebx
test ax, ax
jge 0x4bcc47
mov eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x68]
jne 0x4bcc41
mov eax, dword [ebp - 4]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
xor edi, edi
push edi
push 7
push 0x115
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 4]
cmp dword [esi + 0x60], eax
je 0x4bcc72
push edi
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, esi
call fcn.004b9f1d
push 0xfffffc00
push dword [esi]
call fcn.004bb900
jmp 0x4bd23e
mov ecx, dword [esi + 0xd0]
cmp dword [esi + 0x6c], ecx
jne 0x4bcc91
dec dword [esi + 0x60]
mov edi, dword [esi + 0x60]
xor edx, edx
mov eax, edi
div ecx
sub ecx, edx
lea eax, [ecx + edi - 1]
jmp 0x4bd125
push 0x11
call ebx
test ax, ax
jl 0x4bd23e
mov edi, dword [esi + 0xd0]
mov ecx, dword [esi + 0x90]
mov eax, edi
imul eax, dword [esi + 0x84]
add dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
cmp eax, ecx
ja 0x4bccd6
cmp eax, dword [ebp - 4]
jae 0x4bccfb
mov eax, ecx
xor edx, edx
div edi
mov eax, ecx
mov dword [esi + 0x60], ecx
mov ebx, edx
xor edx, edx
div edi
mov dword [esi + 0x6c], ebx
sub eax, dword [esi + 0x74]
test ebx, ebx
mov dword [esi + 0x70], eax
jne 0x4bccfb
dec eax
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4bcd1c
mov eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x68]
jne 0x4bcd16
mov eax, dword [ebp - 4]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
xor edi, edi
push edi
push 3
push 0x115
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x84]
push 1
pop ecx
cmp eax, ecx
jb 0x4bcd3d
mov ecx, eax
mov edx, dword [esi + 0x7c]
sub edx, eax
mov eax, dword [esi + 0x74]
inc edx
add eax, ecx
cmp eax, edx
jbe 0x4bcc6b
mov eax, dword [ebp - 4]
cmp dword [esi + 0x60], eax
je 0x4bcc6b
jmp 0x4bcc61
push 0x11
call ebx
test ax, ax
jl 0x4bd23e
mov eax, dword [esi + 0xd0]
xor edi, edi
imul eax, dword [esi + 0x84]
sub dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
cmp eax, dword [ebp - 4]
jae 0x4bcd8c
cmp eax, edi
jne 0x4bcd95
mov dword [esi + 0x60], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
push 0x10
call ebx
test ax, ax
jge 0x4bcdb2
mov eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x68]
jne 0x4bcdac
mov eax, dword [ebp - 4]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
push edi
push 2
push 0x115
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x84]
cmp eax, 1
jae 0x4bcdd0
push 1
pop eax
cmp dword [esi + 0x74], eax
jae 0x4bcde7
mov eax, dword [ebp - 4]
cmp dword [esi + 0x60], eax
je 0x4bcde7
push edi
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, esi
call fcn.004b9f1d
push 0xfffffbfb
jmp 0x4bcc77
lea ecx, [esi + 0xf8]
call fcn.004b8f97
jmp 0x4bd23e
and dword [esi + 0x48], 0
mov ecx, esi
call fcn.004b64ea
jmp 0x4bd237
mov eax, dword [esi + 0x60]
test eax, eax
jbe 0x4bce23
dec eax
mov dword [esi + 0x60], eax
mov ecx, dword [esi + 0x60]
mov edi, dword [esi + 0xd0]
mov eax, ecx
xor edx, edx
div edi
mov eax, ecx
mov dword [esi + 0x6c], edx
xor edx, edx
div edi
sub eax, dword [esi + 0x74]
mov dword [esi + 0x70], eax
jns 0x4bce54
push 0
push 0
push 0x115
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [esi + 0x30], 0
jne 0x4bd128
cmp dword [esi + 0x34], 0
jne 0x4bd128
cmp dword [esi + 0x40], 1
jne 0x4bd128
mov ecx, dword [esi + 0x60]
cmp ecx, dword [ebp - 4]
je 0x4bd128
mov eax, dword [esi + 0x74]
push 1
mov dword [ebp - 0xc], eax
pop eax
lea edi, [esi + 0xf8]
push eax
push ecx
mov ecx, edi
mov dword [esi + 0x38], eax
call fcn.004b79e3
mov eax, dword [esi + 0x5c]
push dword [esi + 0x54]
imul eax, dword [esi + 0x70]
push dword [esi + 0x50]
push eax
mov eax, dword [esi + 0xe0]
imul eax, dword [esi + 0x58]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov ecx, edi
call fcn.004b8e2d
push eax
mov ecx, esi
mov dword [esi + 0x90], eax
call fcn.004b682d
mov ecx, esi
mov dword [esi + 0x8c], eax
call fcn.004babe3
mov edi, dword [esi + 0x60]
mov ebx, dword [esi + 0xd0]
mov eax, edi
xor edx, edx
div ebx
mov eax, edi
mov ecx, dword [esi + 0x74]
mov dword [esi + 0x6c], edx
xor edx, edx
div ebx
sub eax, ecx
cmp ecx, dword [ebp - 0xc]
mov dword [esi + 0x70], eax
je 0x4bcf17
mov eax, dword [esi + 0x7c]
sub eax, dword [esi + 0x84]
inc eax
cmp ecx, eax
jne 0x4bcf17
push 0
push 0
jmp 0x4bcf1d
lea eax, [ebp - 0x28]
push 1
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, esi
call fcn.004b9f1d
push 0xfffffbfb
push dword [esi]
call fcn.004bb900
jmp 0x4bd128
push 0x11
call ebx
test ax, ax
jge 0x4bcf76
xor edi, edi
push 0x10
mov dword [esi + 0x60], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
call ebx
test ax, ax
jge 0x4bcf6e
mov eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x68]
jne 0x4bcf68
mov eax, dword [ebp - 4]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
push edi
push 6
jmp 0x4bcc4c
mov edi, dword [esi + 0xd0]
cmp dword [esi + 0x6c], edi
jne 0x4bcf8c
mov eax, dword [esi + 0x60]
test eax, eax
jbe 0x4bcf8c
dec eax
mov dword [esi + 0x60], eax
mov ecx, dword [esi + 0x60]
xor edx, edx
mov eax, ecx
div edi
cmp ecx, edx
jae 0x4bcf9b
mov edx, ecx
sub ecx, edx
mov dword [esi + 0x60], ecx
jmp 0x4bd128
mov eax, edi
sub eax, 0x25
je 0x4bd0fe
dec eax
je 0x4bd0d4
dec eax
je 0x4bd0ba
dec eax
je 0x4bd033
sub eax, 5
je 0x4bd00f
dec eax
jne 0x4bd23e
cmp dword [esi + 0x30], 0
jne 0x4bd23e
mov ecx, esi
call fcn.004b6f18
test eax, eax
jne 0x4bd23e
mov ecx, esi
call fcn.004b69bd
cmp eax, 1
jne 0x4bd23e
push 0x30
push str.HexView32
push str.Not_enough_memory_to_complete_this_operation
push dword [esi]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4bd23e
cmp dword [esi + 0x30], 0
jne 0x4bd23e
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x40], eax
sete al
push eax
call fcn.004b64f3
push 0xfffffbfa
jmp 0x4bcc77
push 0x11
call ebx
test ax, ax
jge 0x4bd04a
push 0
push 1
push 0x115
jmp 0x4bd110
mov ecx, dword [esi + 0xd0]
mov eax, dword [ebp - 4]
add dword [esi + 0x60], ecx
cmp dword [esi + 0x60], eax
jae 0x4bd05e
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x90]
cmp eax, edi
jb 0x4bd07c
mov ebx, dword [esi + 0x6c]
cmp ebx, ecx
je 0x4bd07c
mov eax, edi
xor edx, edx
div ecx
cmp ebx, edx
jl 0x4bd0b5
mov ebx, dword [esi + 0x60]
cmp ebx, edi
jb 0x4bd128
mov eax, edi
xor edx, edx
div ecx
mov eax, dword [esi + 0x6c]
cmp eax, edx
jl 0x4bd0ac
test eax, eax
je 0x4bd0ac
test edx, edx
je 0x4bd0ac
cmp eax, ecx
mov dword [esi + 0x60], edi
jne 0x4bd128
mov dword [esi + 0x6c], edx
jmp 0x4bd128
cmp ebx, edi
jb 0x4bd128
cmp dword [esi + 0x6c], ecx
je 0x4bd128
mov eax, dword [ebp - 4]
jmp 0x4bd125
push 0x11
call ebx
test ax, ax
jge 0x4bd0c9
push 0
push 1
jmp 0x4bd10b
inc dword [esi + 0x60]
jne 0x4bd128
or dword [esi + 0x60], 0xffffffff
jmp 0x4bd128
push 0x11
call ebx
test ax, ax
jge 0x4bd0e6
push 0
push 0
jmp 0x4bd040
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0xd0]
cmp eax, ecx
ja 0x4bd0fa
jne 0x4bd128
cmp dword [esi + 0x6c], ecx
je 0x4bd128
sub eax, ecx
jmp 0x4bd125
push 0x11
call ebx
test ax, ax
jge 0x4bd11d
push 0
push 0
push 0x114
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4bd23e
mov eax, dword [esi + 0x60]
test eax, eax
jbe 0x4bd128
dec eax
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x90]
cmp dword [esi + 0x60], eax
jbe 0x4bd136
mov dword [esi + 0x60], eax
mov ebx, dword [ebp + 8]
cmp ebx, 0x26
jne 0x4bd14e
mov eax, dword [esi + 0x6c]
cmp eax, dword [esi + 0xd0]
jne 0x4bd163
dec dword [esi + 0x70]
jmp 0x4bd18b
cmp ebx, 0x28
jne 0x4bd163
mov eax, dword [esi + 0x6c]
cmp eax, dword [esi + 0xd0]
jne 0x4bd163
inc dword [esi + 0x70]
jmp 0x4bd18b
mov ecx, dword [esi + 0x60]
mov edi, dword [esi + 0xd0]
mov eax, ecx
xor edx, edx
div edi
mov eax, ecx
mov dword [esi + 0x6c], edx
xor edx, edx
div edi
sub eax, dword [esi + 0x74]
cmp ebx, 0x26
mov dword [esi + 0x70], eax
je 0x4bd18b
cmp ebx, 0x28
jne 0x4bd1cb
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x4bd1cb
mov eax, dword [esi + 0x70]
xor ebx, ebx
cmp eax, ebx
jge 0x4bd1ad
mov ecx, esi
call fcn.004baf77
mov dword [esi + 0x70], ebx
jmp 0x4bd1c8
cmp eax, dword [esi + 0x84]
lea edi, [esi + 0x84]
jl 0x4bd1cb
mov ecx, esi
call fcn.004bb012
mov eax, dword [edi]
dec eax
mov dword [esi + 0x70], eax
mov dword [ebp - 8], ebx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4bd1ff
mov eax, dword [esi + 0x68]
cmp dword [esi + 0x64], eax
jne 0x4bd1e6
mov ecx, dword [ebp - 4]
mov dword [esi + 0x64], ecx
cmp dword [ebp - 8], 0
je 0x4bd1f9
push dword [esi + 0x60]
mov ecx, esi
push eax
push dword [esi]
call fcn.004ba04d
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x70]
cmp eax, dword [esi + 0x84]
jl 0x4bd21b
push 0
push 1
push 0x115
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0xfffffc00
push dword [esi]
call fcn.004bb900
push 0xfffffbff
push dword [esi]
call fcn.004bb900
and dword [esi + 0x48], 0
mov ecx, esi
call fcn.004b9f1d
lea ecx, [ebp - 0x18]
call fcn.004b718e
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8