Function at 0x4c9b70
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x20]
cmp dword [esi + 0x14], 0
je 0x4c9e48
cmp dword [esi + 0x39a4], 0
jl 0x4c9ba6
cmp dword [esi + 0x39b0], 0
jne 0x4c9ba6
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, 1
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0x4bc]
sub ecx, dword [esi + 0x418]
push ebx
movsx ebx, ax
shr eax, 0x10
movsx edx, ax
sub edx, dword [esi + 0x41c]
add ecx, ebx
add edx, dword [esi + 0x4c0]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], edx
push ecx
lea edx, [esp + 0x20]
push edx
push esi
call fcn.004f4f20
mov eax, dword [esp + 0x1c]
add esp, 0x10
test eax, eax
jl 0x4c9ca9
mov ecx, dword [esi + 0x585c]
imul eax, eax, 0xf0
cmp dword [ecx + eax + 8], 9
jne 0x4c9ca9
mov eax, dword [esi + 0x3890]
test eax, eax
jne 0x4c9c3a
push eax
push esi
mov dword [esi + 0x3890], 2
call fcn.0050d630
add esp, 8
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret
cmp eax, 2
jne 0x4c9c5f
push 0
push esi
mov dword [esi + 0x3890], 1
call fcn.0050d630
add esp, 8
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret
cmp eax, 1
jne 0x4c9c84
push 0
push esi
mov dword [esi + 0x3890], 3
call fcn.0050d630
add esp, 8
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret
cmp eax, 3
jne 0x4c9c93
mov dword [esi + 0x3890], 0
push 0
push esi
call fcn.0050d630
add esp, 8
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret
mov edx, dword [esi + 0x5d8]
push ebp
push edi
mov edi, dword [esi + 0x4bc]
sub edi, dword [esi + 0x418]
push edx
push esi
add edi, ebx
call fcn.004f5d80
mov ecx, dword [esi + 0x5d8]
mov edx, dword [esi + 0x138]
mov ecx, dword [edx + ecx*4]
add esp, 8
test byte [ecx + 0x3c], 0x20
je 0x4c9cf7
mov edx, dword [esi + 0x708]
push 0
push edx
push 0
push edi
push esi
call fcn.004fcd30
add esp, 0x14
mov edi, eax
jmp 0x4c9d0f
mov ecx, dword [esi + 0x704]
imul eax, eax, 0xb4
mov edx, dword [eax + ecx + 0x7c]
add edx, dword [eax + ecx + 0x14]
add eax, ecx
sub edi, edx
test edi, edi
jge 0x4c9d15
xor edi, edi
mov eax, dword [esi + 0x500]
push eax
push 0x5a0
push edi
call dword [sym.imp.KERNEL32.dll_MulDiv]
cmp dword [esi + 0xa114], 0
mov ebp, eax
mov dword [esp + 0x2c], ebp
je 0x4c9d55
test byte [esi + 0xa15c], 2
je 0x4c9d44
push 0x47
jmp 0x4c9d46
push 0x5a
push ebp
call fcn.004e08e0
mov dword [esp + 0x34], eax
mov ebp, eax
add esp, 8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4c9d78
xor ecx, ecx
cmp dword [esp + 0x30], 0x201
setne cl
add ecx, 2
mov dword [esp + 0x10], ecx
jmp 0x4c9d96
cmp dword [esp + 0x30], 0x201
jne 0x4c9d8e
mov edx, dword [esi + 0x3890]
mov dword [esp + 0x10], edx
jmp 0x4c9d96
mov dword [esp + 0x10], 1
mov eax, dword [esi + 0x5d8]
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 0x14]
mov ecx, dword [esi + 0x2b38]
imul eax, eax, 0x58
mov ebx, dword [eax + ecx + 0x1c]
mov eax, dword [esi + 0x387c]
mov ecx, ebx
imul ecx, ecx, 0xb8
mov edx, dword [eax + ecx]
xor edi, edi
test edx, edx
mov dword [esp + 0x18], edx
jle 0x4c9dfe
lea ebp, [eax + ecx + 4]
mov eax, dword [ebp]
sub eax, dword [esp + 0x2c]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x2d
jl 0x4c9df6
mov edx, dword [esi + 0x387c]
add edi, 1
add ebp, 4
cmp edi, dword [ecx + edx]
jl 0x4c9dd4
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x2c]
cmp edi, edx
jl 0x4c9e27
test ebp, ebp
jle 0x4c9e27
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x39c]
push 1
push ebp
push eax
push ecx
call fcn.004c81c0
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret
mov eax, dword [esi + 0x387c]
imul ebx, ebx, 0x2e
add ebx, edi
mov edx, dword [eax + ebx*4 + 4]
mov eax, dword [esi + 0x39c]
push 1
push edx
push eax
call fcn.004c6ed0
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret