Function at 0x4a81dd
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp word [ebp + 0xc], 0x8059
mov dword [ebp - 4], eax
jne 0x4a823e
cmp dword [esi + 0x1020], 0
je 0x4a823e
mov edx, dword [esi + 0x600]
cmp eax, dword [edx + 4]
jne 0x4a8402
lea ecx, [esi + 0x34]
mov eax, ecx
neg eax
lea esi, [ecx - 0x34]
sbb eax, eax
and eax, esi
mov esi, dword [eax + 0x227ec]
cmp edx, esi
jne 0x4a8231
mov eax, dword [eax + 0x227f0]
jmp 0x4a8233
mov eax, esi
push eax
call fcn.0049e750
jmp 0x4a8433
mov edi, dword [esi + 0x22cf0]
push dword [esi + 0x94]
mov dword [ebp - 0x10], edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
xor ebx, ebx
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x4a8274
cmp eax, ebx
jne 0x4a8274
cmp dword [esi + 0x1028], ebx
jne 0x4a8274
cmp dword [esi + 0x22cf4], ebx
je 0x4a8433
mov eax, dword [esi + 0x600]
cmp eax, ebx
je 0x4a8283
add eax, 4
jmp 0x4a8285
xor eax, eax
test byte [esi + 0x2245f], 2
je 0x4a82a1
push dword [eax]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
xor ebx, ebx
cmp eax, 0xe900
setne bl
inc ebx
push dword [ebp - 4]
lea edi, [esi + 0x22468]
neg edi
push dword [esi + 0x2246c]
lea eax, [esi + 0x2246c]
sbb edi, edi
and edi, eax
mov ecx, dword [edi]
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_IsChild]
mov edx, dword [ebp - 4]
test eax, eax
je 0x4a82d1
mov dword [ebp - 8], edx
mov ax, word [ebp + 0xc]
cmp ax, 0x8059
jne 0x4a82eb
mov eax, dword [esi + 0x600]
cmp edx, dword [eax + 4]
je 0x4a834b
jmp 0x4a8402
cmp ax, 0x805b
jne 0x4a82ff
cmp dword [ebp - 0xc], 0
je 0x4a834b
mov edi, dword [esi + 0x98]
jmp 0x4a8343
cmp ax, 0x805c
jne 0x4a831a
cmp dword [esi + 0x1028], 0
je 0x4a834b
cmp edx, dword [ebp - 8]
je 0x4a834b
mov edi, dword [edi]
jmp 0x4a83fe
cmp ax, 0x805a
jne 0x4a834b
cmp dword [ebp - 0x10], 0
je 0x4a8364
mov eax, ebx
imul eax, eax, 0x118
add eax, esi
lea ecx, [eax + 0x227f4]
add eax, 0x227f8
neg ecx
sbb ecx, ecx
and ecx, eax
mov edi, dword [ecx]
cmp edx, edi
jne 0x4a83fe
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x4a8364
imul ebx, ebx, 0x118
mov ecx, dword [ebx + esi + 0x227f8]
mov dword [ebp - 0x24], ecx
jmp 0x4a8369
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0xc], eax
mov dword [ebp - 0x20], eax
je 0x4a8379
lea eax, [esi + 0x98]
jmp 0x4a837f
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [esi + 0x1028]
mov dword [ebp - 0x1c], eax
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x600]
mov eax, dword [eax + 4]
cmp edx, eax
mov dword [ebp - 0x14], eax
je 0x4a83bd
mov eax, dword [esi + 0x22cf4]
add eax, ecx
add eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
cmp eax, 1
jle 0x4a83bd
and dword [ebp - 0x14], 0
xor edi, edi
lea eax, [ebp - 0x24]
cmp edx, dword [eax]
je 0x4a83cf
inc edi
add eax, 4
cmp edi, 5
jb 0x4a83c2
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x4a83eb
dec edi
jns 0x4a83e2
push 4
pop edi
cmp dword [ebp + edi*4 - 0x24], 0
je 0x4a83dc
jmp 0x4a83fa
inc edi
cmp edi, 5
jne 0x4a83f3
xor edi, edi
cmp dword [ebp + edi*4 - 0x24], 0
je 0x4a83eb
mov edi, dword [ebp + edi*4 - 0x24]
test edi, edi
jne 0x4a840b
mov eax, dword [esi + 0x600]
mov edi, dword [eax + 4]
cmp edi, dword [ebp - 4]
je 0x4a8433
add esi, 0x604
push edi
mov ecx, esi
call fcn.0049c7c9
test eax, eax
je 0x4a842c
push 0
push edi
mov ecx, esi
call fcn.0049c9d6
push edi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10