Function at 0x4de590
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x69d341
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
xor ebp, ebp
cmp eax, ebp
jne 0x4de5c8
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push edi
mov edi, dword [0x84716c]
cmp edi, ebp
jne 0x4de5e9
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
cmp dword [0x21e754c], ebp
je 0x4de60a
pop edi
pop esi
mov eax, 2
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
cmp dword [0x21e7554], ebp
push ebx
mov ebx, 1
je 0x4de633
push ebp
lea ecx, [esi + 0x100]
mov dword [esi + 0x28], ebx
call fcn.00516a50
push ebx
lea ecx, [esi + 0x5d4]
call fcn.00516a50
cmp dword [0x21e7558], ebp
je 0x4de656
push ebx
lea ecx, [esi + 0x100]
mov dword [esi + 0x28], ebp
call fcn.00516a50
push ebp
lea ecx, [esi + 0x5d4]
call fcn.00516a50
mov ecx, dword [esi + 0xe4]
cmp ecx, ebp
je 0x4de682
call fcn.005184b0
cmp eax, ebp
je 0x4de822
mov ecx, dword [esi + 0xe4]
cmp ecx, ebp
je 0x4de682
mov eax, dword [ecx]
push ebx
call dword [eax]
mov dword [esi + 0xe4], ebp
mov ecx, dword [esi + 0xec]
cmp ecx, ebp
je 0x4de75e
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], ebp
call fcn.00502160
mov ebx, eax
cmp ebx, ebp
je 0x4de744
mov edi, dword [esi + 0xec]
cmp edi, ebp
je 0x4de6c8
mov ecx, edi
call fcn.00503650
push edi
call fcn.005b806d
add esp, 4
mov dword [esi + 0xec], ebp
cmp ebx, 2
jne 0x4de744
mov bl, byte [esi + 0x30]
mov cl, byte [esi + 0x31]
mov edi, dword [esp + 0x24]
mov byte [esp + 0x10], cl
movzx eax, bl
lea eax, [eax + eax*2]
movzx ecx, cl
lea edx, [ecx + eax*8]
imul edx, edx, 0x22
movzx eax, byte [edx + 0x8507fb]
push ebp
cdq
push edi
push edx
push eax
call fcn.005ba3b0
cmp edx, ebp
jl 0x4de72f
jg 0x4de706
cmp eax, 0xffffffff
jbe 0x4de72f
push 0x1d4
push 0x11
call fcn.0041d9a0
add esp, 8
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov ecx, dword [esp + 0x10]
xor eax, eax
mov al, byte [esi + 0x2f]
push edi
push eax
push ecx
push ebx
call fcn.0058aec0
add esp, 0x10
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push edx
lea ecx, [esi + 0x5d4]
push eax
call fcn.00516c20
test eax, eax
je 0x4de77a
call fcn.0058ae90
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push edx
lea ecx, [esi + 0xaa8]
push eax
call fcn.00516c20
test eax, eax
je 0x4de7a1
call fcn.0058ae90
call fcn.0058adf0
mov dword [esi + 0xf7c], ebx
cmp dword [esi + 0x28], ebp
jne 0x4dee2a
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
push edx
lea ecx, [esi + 0x100]
call fcn.00516c20
test eax, eax
je 0x4de8cb
add edi, 0x2f4
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4de7d0
sub eax, edx
mov dword [esp + 0x24], eax
jne 0x4de839
cmp dword [esi + 0xe4], ebp
jne 0x4de839
push 0x154
call fcn.005b8072
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebp
mov dword [esp + 0x1c], ebp
je 0x4de809
mov ecx, eax
call fcn.00518a30
jmp 0x4de80b
xor eax, eax
push 0x10
mov ecx, eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esi + 0xe4], eax
call fcn.00518e20
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov eax, 0x21e72d8
mov edi, edi
cmp dword [eax], ebp
jne 0x4de8a8
add eax, 0xc
cmp eax, 0x21e7368
jl 0x4de840
cmp dword [esi + 0xe4], ebp
jne 0x4de8a8
push 0x154
call fcn.005b8072
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebp
mov dword [esp + 0x1c], ebx
je 0x4de878
mov ecx, eax
call fcn.00518a30
jmp 0x4de87a
xor eax, eax
push 0x11
mov ecx, eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esi + 0xe4], eax
call fcn.00518e20
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push edi
call fcn.0058ae20
add esp, 4
pop ebx
pop edi
pop esi
mov eax, 3
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
cmp dword [0x21ebf00], ebx
jne 0x4de9d7
cmp dword [0x21ebf04], ebp
jne 0x4de9d7
mov eax, dword [esi + 4]
mov ecx, dword [0x706454]
lea edx, [eax + 0x10]
cmp ecx, edx
jl 0x4de952
add eax, 0xac
cmp ecx, eax
jg 0x4de952
mov eax, dword [esi + 8]
mov ecx, dword [0x706458]
lea edx, [eax + 0x3f]
cmp ecx, edx
jl 0x4de952
add eax, 0x75
cmp ecx, eax
jg 0x4de952
push ebx
mov ecx, 0x21ec34c
mov dword [0x84efa8], ebp
mov dword [0x703c18], ebx
mov byte [0x21eaa9c], 1
call fcn.00521a50
mov ecx, 0x21ec34c
call fcn.00523c40
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov al, byte [0x21eaa9c]
test al, al
je 0x4deab2
mov ecx, 0x21ec34c
call fcn.00520ff0
cmp ax, 0x12
mov ecx, 0x21ec34c
jne 0x4de99b
call fcn.00522310
push eax
mov ecx, 0x21ec34c
call fcn.00522220
push eax
lea eax, [edi + 0x2f4]
push 0x6a81c8
push eax
call fcn.005b8b8d
add esp, 0x10
jmp 0x4de9b5
call fcn.00522220
push eax
lea ecx, [edi + 0x2f4]
push 0x6a9d2c
push ecx
call fcn.005b8b8d
add esp, 0xc
push ebp
mov ecx, 0x21ec34c
mov dword [0x703c18], ebp
mov byte [0x21eaa9c], 0
call fcn.00521a50
mov ecx, 0x21ec34c
call fcn.00523c40
mov al, byte [0x21eaa9c]
test al, al
je 0x4deab2
mov ecx, dword [0x21ebef8]
push 0x1c
call fcn.004256f0
test al, al
je 0x4deab2
mov ecx, 0x21ec34c
call fcn.00520ff0
cmp ax, 0x12
je 0x4dea1b
mov ecx, 0x21ec34c
call fcn.00521ef0
test al, al
jne 0x4deab2
push 0xd
call dword [sym.imp.user32.dll_GetAsyncKeyState]
mov ecx, 0x21ec34c
call fcn.00520ff0
cmp ax, 0x12
mov ecx, 0x21ec34c
jne 0x4dea5f
call fcn.00522310
push eax
mov ecx, 0x21ec34c
call fcn.00522220
push eax
push 0x6a81c8
add edi, 0x2f4
push edi
call fcn.005b8b8d
add esp, 0x10
jmp 0x4dea79
call fcn.00522220
push eax
push 0x6a9d2c
add edi, 0x2f4
push edi
call fcn.005b8b8d
add esp, 0xc
push ebp
mov ecx, 0x21ec34c
mov dword [0x703c18], ebp
mov byte [0x21eaa9c], 0
call fcn.00521a50
mov ecx, 0x21ec34c
call fcn.00523c40
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov ecx, dword [esp + 0x24]
xor ebp, ebp
test ecx, ecx
mov byte [esi + 0x2d], 0xff
je 0x4deae3
mov eax, dword [ecx + 0xd8]
test eax, eax
mov ebp, ecx
je 0x4dead0
xor eax, eax
jmp 0x4dead7
movzx eax, byte [ecx + 0xdd]
mov byte [esi + 0x2c], al
mov dl, byte [ecx + 0xdc]
mov byte [esi + 0x2d], dl
mov eax, dword [0x21ebf00]
cmp eax, 1
jne 0x4deb8d
mov eax, dword [0x21ebf04]
test eax, eax
jne 0x4dee2a
mov ebp, dword [esi + 4]
mov edi, dword [0x706458]
mov ebx, dword [0x706454]
xor ecx, ecx
nop
mov eax, ecx
and eax, 0x80000003
jns 0x4deb1e
dec eax
or eax, 0xfffffffc
inc eax
imul eax, eax, 0x27
add eax, ebp
lea edx, [eax + 0x15]
cmp ebx, edx
jl 0x4deb57
add eax, 0x35
cmp ebx, eax
jg 0x4deb57
mov eax, ecx
cdq
and edx, 3
add eax, edx
mov edx, dword [esi + 8]
sar eax, 2
imul eax, eax, 0x27
add eax, edx
lea edx, [eax + 0x93]
cmp edi, edx
jl 0x4deb57
add eax, 0xb3
cmp edi, eax
jle 0x4deb62
inc ecx
cmp ecx, 0xc
jl 0x4deb10
jmp 0x4dee2a
lea eax, [ecx + ecx*2]
mov edx, dword [eax*4 + 0x21e72d8]
test edx, edx
je 0x4deb73
mov byte [esi + 0x2e], cl
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
cmp eax, 2
jne 0x4dee2a
cmp byte [esi + 0x2d], 0xff
je 0x4dee14
mov eax, dword [esi + 4]
mov ebx, dword [0x706454]
cmp ebx, eax
jl 0x4dee2a
mov ecx, dword [esi + 0xc]
add ecx, eax
cmp ebx, ecx
jg 0x4dee2a
mov eax, dword [esi + 8]
mov edi, dword [0x706458]
cmp edi, eax
jl 0x4dee2a
mov edx, dword [esi + 0x10]
add edx, eax
cmp edi, edx
jg 0x4dee2a
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov eax, ecx
and eax, 0x80000003
jns 0x4debf0
dec eax
or eax, 0xfffffffc
inc eax
mov edx, dword [esi + 4]
imul eax, eax, 0x27
add eax, edx
lea edx, [eax + 0x15]
cmp ebx, edx
jl 0x4ded28
add eax, 0x35
cmp ebx, eax
jg 0x4ded28
mov eax, ecx
cdq
and edx, 3
add eax, edx
mov edx, dword [esi + 8]
sar eax, 2
imul eax, eax, 0x27
add eax, edx
lea edx, [eax + 0x93]
cmp edi, edx
jl 0x4ded28
add eax, 0xb3
cmp edi, eax
jg 0x4ded28
movzx eax, byte [ebp + 0xdd]
movzx ecx, byte [ebp + 0xdc]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
imul eax, eax, 0x22
xor edx, edx
mov dl, byte [eax + 0x8507fa]
movzx eax, byte [eax + 0x8507f9]
mov ecx, 0x856fcc
push edx
push eax
call fcn.0045f2c0
test eax, eax
je 0x4dec7d
mov cl, byte [eax + 0x24]
test cl, cl
jne 0x4ded57
xor eax, eax
mov al, byte [esi + 0x2c]
test al, al
je 0x4ded9b
mov ecx, dword [esp + 0x24]
xor ebx, ebx
mov bl, byte [esi + 0x2d]
push ebx
push eax
push ecx
mov ecx, esi
call fcn.004de530
mov edi, eax
test edi, edi
jne 0x4dede6
mov al, byte [esi + 0x2c]
mov dl, byte [esp + 0x24]
mov byte [esi + 0x2f], dl
mov byte [esi + 0x30], al
mov byte [esi + 0x31], bl
mov byte [ebp + 0xdc], 0xff
mov edi, dword [esi + 0xec]
test edi, edi
je 0x4dece2
mov ecx, edi
call fcn.00503650
push edi
call fcn.005b806d
add esp, 4
mov dword [esi + 0xec], 0
push 0xefc
call fcn.005b8072
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x1c], 2
je 0x4ded08
mov ecx, eax
call fcn.005033b0
jmp 0x4ded0a
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword [esi + 0xec], eax
mov edi, dword [0x706458]
mov ebx, dword [0x706454]
mov dword [esp + 0x1c], 0xffffffff
inc ecx
cmp ecx, 0xc
mov dword [esp + 0x24], ecx
jl 0x4debe2
pop ebx
pop edi
pop esi
mov byte [ebp + 0xdc], 0xff
mov eax, 1
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push 0
push 0x447a0000
push 0x21f1d38
push 0x6aa4c0
mov ecx, 0x21efa50
call fcn.00529cb0
push 0x1bb
push 0x11
call fcn.0041d9a0
add esp, 8
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push 0
push 0x447a0000
push 0x21f1d38
push 0x6aa4c0
mov ecx, 0x21efa50
call fcn.00529cb0
push 0x1bc
push 0x11
call fcn.0041d9a0
add esp, 8
mov byte [ebp + 0xdc], 0xff
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push 0
push 0x447a0000
push 0x21f1d38
push 0x6aa4c0
mov ecx, 0x21efa50
call fcn.00529cb0
cmp edi, 1
jne 0x4dee0d
push 0x1bd
jmp 0x4dedbb
push 0x1be
jmp 0x4dedbb
xor eax, eax
mov al, byte [esi + 0x2e]
cmp al, 0xff
je 0x4dee2a
push eax
call fcn.0058af10
add esp, 4
mov byte [esi + 0x2e], 0xff
push 1
lea ecx, [esi + 0xaa8]
call fcn.005169b0
test eax, eax
jne 0x4de744
push 1
lea ecx, [esi + 0x100]
call fcn.005169b0
test eax, eax
jne 0x4de744
push 1
lea ecx, [esi + 0x5d4]
call fcn.005169b0
test eax, eax
jne 0x4de744
cmp dword [0x21ebf00], 2
jne 0x4deebf
mov eax, dword [esp + 0x24]
xor edx, edx
test eax, eax
je 0x4dee7e
mov edx, eax
cmp byte [edx + 0xdc], 0xff
je 0x4deebf
mov eax, dword [esi + 4]
mov ecx, dword [0x706454]
cmp ecx, eax
jl 0x4deebf
mov edi, dword [esi + 0xc]
add edi, eax
cmp ecx, edi
jg 0x4deebf
mov eax, dword [esi + 8]
mov ecx, dword [0x706458]
cmp ecx, eax
jl 0x4deebf
mov edi, dword [esi + 0x10]
add edi, eax
cmp ecx, edi
jg 0x4deebf
mov byte [edx + 0xdc], 0xff
jmp 0x4dedcc
mov ecx, esi
call fcn.005166e0
mov ecx, dword [esp + 0x14]
pop ebx
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 4