Function at 0x4e3514
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x4c]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4e3d74
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x50bfa0]
mov eax, dword [eax]
xor edx, edx
call fcn.00464c3c
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x30]
xor edx, edx
xor eax, eax
call fcn.0041cfa0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
push 0
push 0x32
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004dfd70
test eax, eax
jle 0x4e3647
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004dfd70
mov edx, eax
dec edx
mov eax, ebx
call fcn.004dfd78
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x4e3633
mov eax, esi
call fcn.004dfd70
cmp ebx, eax
jge 0x4e3633
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.004dfd78
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x4e361f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004dfd70
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x4e361f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.004dfd78
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4e3633
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004e2aac
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x4e365d
mov eax, ebx
call fcn.0044c828
call fcn.0049f0b0
mov byte [ebp - 6], 1
jmp 0x4e3d31
cmp byte [ebp - 6], 0
jne 0x4e3671
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4e3d10
mov eax, dword [edi + 4]
cmp eax, 0x113
jg 0x4e36a9
je 0x4e37a9
sub eax, 0x12
je 0x4e379d
sub eax, 0x34
je 0x4e36ba
add eax, 0xffffffa5
sub eax, 9
jb 0x4e379d
jmp 0x4e382a
sub eax, 0x201
je 0x4e36cb
sub eax, 3
je 0x4e36cb
jmp 0x4e382a
push ebp
call fcn.004e34c0
pop ecx
call fcn.00404188
jmp 0x4e3d7b
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407ca4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00445b94
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4e374a
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4e374a
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c828
push eax
call sub.user32.dll_PostMessageA
jmp 0x4e382a
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4e377c
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00445b94
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4e3779
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x4e3784
test bl, bl
je 0x4e3751
test bl, bl
jne 0x4e382a
push ebp
call fcn.004e34c0
pop ecx
call fcn.00404188
jmp 0x4e3d7b
push ebp
call fcn.004e34c0
pop ecx
jmp 0x4e3d10
cmp dword [edi], 0
jne 0x4e382a
add dword [ebp - 0x1c], 0x32
lea edx, [ebp - 0x28]
mov eax, dword [0x50bf44]
mov eax, dword [eax]
call fcn.00450fc4
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jne 0x4e3819
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jne 0x4e3819
cmp dword [ebp - 0x1c], 0x1f4
jl 0x4e381e
mov esi, dword [ebp - 4]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea edx, [ebp - 0x64]
mov eax, dword [esi + 0x3c]
call fcn.004459f0
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4e3812
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.0044c828
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4e381e
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4e3d10
mov eax, dword [edi + 4]
mov edx, eax
sub edx, 0x7b
je 0x4e3d10
add edx, 0xffffff7b
sub edx, 9
jb 0x4e3881
add edx, 0xffffff09
sub edx, 0xb
jb 0x4e3b42
sub edx, 0x264
jne 0x4e3d0a
mov eax, dword [ebp - 4]
call fcn.004e3170
jmp 0x4e3d10
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4e3d10
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4e38b7
sub eax, 2
je 0x4e3ae9
sub eax, 2
je 0x4e38b7
sub eax, 2
je 0x4e3ae9
jmp 0x4e3d10
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4e38fa
je 0x4e39ac
cmp eax, 0x12
jg 0x4e38e3
je 0x4e3ad2
sub eax, 9
je 0x4e3d10
sub eax, 4
je 0x4e391f
jmp 0x4e3ade
sub eax, 0x1b
je 0x4e3984
sub eax, 5
je 0x4e3d10
jmp 0x4e3ade
sub eax, 0x26
je 0x4e3a95
dec eax
je 0x4e3a16
dec eax
je 0x4e3aaf
sub eax, 0x51
je 0x4e3ad2
jmp 0x4e3ade
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4e3932
mov si, 0xffef
call fcn.00403b0c
mov eax, dword [ebp - 4]
call fcn.004e3170
test al, al
jne 0x4e3d10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4e3d10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4e3d8c
call fcn.00405094
je 0x4e3d10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x4e3d10
push ebp
call fcn.004e34c0
pop ecx
jmp 0x4e3d10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x4e3992
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.00404188
jmp 0x4e3d7b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4e39c2
mov eax, dword [ebp - 4]
call fcn.004e3380
jmp 0x4e3d10
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x4e3d10
cmp byte [ebx + 0x34], 0
je 0x4e39f7
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044c828
push eax
call sub.user32.dll_PostMessageA
call fcn.00404188
jmp 0x4e3d7b
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c828
push eax
call sub.user32.dll_PostMessageA
jmp 0x4e3d10
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4e3a2c
mov eax, dword [ebp - 4]
call fcn.004e3250
jmp 0x4e3d10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x4e3d10
mov eax, dword [ebp - 4]
call fcn.004e3170
test al, al
jne 0x4e3d10
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
cmp byte [ebx + 0x34], 0
je 0x4e3a76
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044c828
push eax
call sub.user32.dll_PostMessageA
call fcn.00404188
jmp 0x4e3d7b
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c828
push eax
call sub.user32.dll_PostMessageA
jmp 0x4e3d10
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4e3d10
mov eax, dword [ebp - 4]
call fcn.004e3380
jmp 0x4e3d10
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4e3ac5
mov eax, dword [ebp - 4]
call fcn.004e3250
jmp 0x4e3d10
mov eax, dword [ebp - 4]
call fcn.004e3170
jmp 0x4e3d10
push ebp
call fcn.004e34c0
pop ecx
jmp 0x4e3d10
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4e3d10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004e202c
test eax, eax
je 0x4e3d10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004e202c
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], ebx
test ebx, ebx
je 0x4e3b23
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c828
push eax
call sub.user32.dll_PostMessageA
jmp 0x4e3d10
sub eax, 0x200
je 0x4e3b57
sub eax, 2
je 0x4e3c47
jmp 0x4e3d10
xor eax, eax
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407ca4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x5105a8]
jne 0x4e3b8d
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x5105ac]
je 0x4e3d10
mov esi, dword [ebp - 4]
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea edx, [ebp - 0x64]
mov eax, dword [esi + 0x3c]
call fcn.004459f0
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4e3bba
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004e2aac
jmp 0x4e3c30
mov esi, dword [ebp - 4]
jmp 0x4e3bc1
mov esi, eax
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x4e3bbf
test esi, esi
je 0x4e3c30
mov ebx, dword [esi + 0x40]
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004e2aac
cmp ebx, dword [esi + 0x40]
je 0x4e3c29
cmp esi, dword [ebp - 4]
je 0x4e3c29
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x4e3c08
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044c828
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x48]
cmp esi, ebx
jne 0x4e3bea
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.0044c828
push eax
call sub.user32.dll_PostMessageA
call fcn.00404188
jmp 0x4e3d7b
mov esi, dword [esi + 0x4c]
test esi, esi
jne 0x4e3bcc
mov eax, dword [ebp - 0xe]
mov dword [0x5105a8], eax
mov eax, dword [ebp - 0xa]
mov dword [0x5105ac], eax
jmp 0x4e3d10
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407ca4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00445b94
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4e3cc3
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4e3cc3
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c828
push eax
call sub.user32.dll_PostMessageA
jmp 0x4e3d10
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4e3cf5
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00445b94
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4e3cf2
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x4e3cfd
test bl, bl
je 0x4e3cca
test bl, bl
jne 0x4e3d10
push ebp
call fcn.004e34c0
pop ecx
jmp 0x4e3d10
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004e34ec
pop ecx
test al, al
je 0x4e3d31
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4e367a
push ebp
call fcn.004e34ec
pop ecx
test al, al
jne 0x4e3666
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3d7b
mov eax, dword [ebp - 0x20]
push eax
push 0
call sub.user32.dll_KillTimer
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x4e3d67
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.0049f0d0
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret