Function at 0x500101
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x20a
jne 0x50008d
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x74]
call fcn.00509d00
test eax, eax
je 0x50008d
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.00437ba0
test eax, eax
je 0x50008d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.00435930
mov eax, 1
jmp 0x500357
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0x100
jne case.0x500201.1
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl case.0x5000fa.1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jl case.0x5000fa.1
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x74]
call fcn.00509d00
test eax, eax
je case.0x5000fa.1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 0xd
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x1b
ja case.0x5000fa.1
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x50036c]
jmp dword [eax*4 + 0x500360]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.00437ba0
test eax, eax
jne case.0x5000fa.0
jmp case.0x5000fa.1
mov ecx, dword [ebp - 4]
call fcn.004390b0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.00437ba0
test eax, eax
je 0x500163
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.00435930
jmp 0x5001d1
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.004358b0
test eax, eax
je 0x5001d1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x74]
add eax, 0xb8
push eax
mov ecx, dword [ebp - 4]
call fcn.00428130
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.00435880
push eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x74]
mov ecx, dword [eax + 0x20]
and ecx, 0xffff
movzx edx, cx
push edx
push 0x111
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.004358b0
mov ecx, eax
call fcn.00435980
mov eax, 1
jmp 0x500357
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, 9
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1f
ja case.0x500201.1
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 0x500398]
jmp dword [edx*4 + 0x500388]
mov ecx, dword [ebp - 4]
call fcn.00436850
test eax, eax
je 0x500252
push 0x5ba
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_afxtoolbarcomboboxbutton.cpp
mov ecx, dword [ebp - 4]
call fcn.00436850
push eax
call fcn.0044e820
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
call fcn.00436850
mov ecx, eax
call fcn.00436610
mov ecx, eax
call fcn.004390b0
mov eax, 1
jmp 0x500357
jmp case.0x500201.1
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x74]
call fcn.00509d00
test eax, eax
je 0x50027a
push 0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.004379c0
mov ecx, dword [ebp - 4]
call fcn.0042b190
test eax, eax
je 0x50029f
mov ecx, dword [ebp - 4]
call fcn.0042b190
mov ecx, eax
call fcn.004390b0
mov eax, 1
jmp 0x500357
jmp case.0x500201.1
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jl case.0x500201.1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl case.0x500201.1
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x74]
call fcn.00509d00
test eax, eax
je case.0x500201.1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.00437ba0
test eax, eax
jne 0x500344
push 1
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.004379c0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.00436850
test eax, eax
je 0x500344
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x74]
add ecx, 0x90
call fcn.00434360
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x74]
call fcn.00509d00
mov ecx, eax
call fcn.00436850
mov ecx, eax
call fcn.004360e0
mov eax, 1
jmp 0x500357
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00427fb0
mov esp, ebp
pop ebp
ret 4