Function at 0x4bb190
Capabilities:
Inspect section memory permissions
Log keystrokes via polling

Disassembly:
sub esp, 8
xor eax, eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, 0x20000000
mov dword [esi + 0x210], eax
mov dword [esi + 0x214], eax
test byte [esi + 0x1cc], 1
je 0x4bb33e
mov eax, dword [esi + 0x1dc]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x4bb1dc
or dword [esi + 0x210], 0x10000000
mov edx, dword [esi + 0x1e0]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x4bb1f5
or dword [esi + 0x210], ebx
mov ecx, dword [esi + 0x1e4]
push ecx
call edi
movsx edx, ax
test edx, 0x80000000
je 0x4bb213
or dword [esi + 0x210], 0x40000000
mov eax, dword [esi + 0x1e8]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x4bb231
or dword [esi + 0x210], 0x80000000
mov edx, dword [esi + 0x1ec]
push edx
call edi
movsx eax, ax
test eax, reloc.WSOCK32.dll_accept
je 0x4bb252
mov eax, dword [esi + 0x210]
or al, 1
mov dword [esi + 0x210], eax
mov ecx, dword [esi + 0x1f0]
push ecx
call edi
movsx edx, ax
test edx, reloc.WSOCK32.dll_accept
je 0x4bb274
mov eax, dword [esi + 0x210]
or al, 2
mov dword [esi + 0x210], eax
mov eax, dword [esi + 0x1f4]
push eax
call edi
movsx ecx, ax
test ecx, reloc.WSOCK32.dll_accept
je 0x4bb296
mov eax, dword [esi + 0x210]
or al, 4
mov dword [esi + 0x210], eax
mov edx, dword [esi + 0x1f8]
push edx
call edi
movsx eax, ax
test eax, reloc.WSOCK32.dll_accept
je 0x4bb2b7
mov eax, dword [esi + 0x210]
or al, 8
mov dword [esi + 0x210], eax
mov ecx, dword [esi + 0x1fc]
push ecx
call edi
movsx edx, ax
test edx, reloc.WSOCK32.dll_accept
je 0x4bb2d9
mov eax, dword [esi + 0x210]
or al, 0x10
mov dword [esi + 0x210], eax
mov eax, dword [esi + 0x200]
push eax
call edi
movsx ecx, ax
test ecx, reloc.WSOCK32.dll_accept
je 0x4bb2fb
mov eax, dword [esi + 0x210]
or al, 0x20
mov dword [esi + 0x210], eax
mov edx, dword [esi + 0x204]
push edx
call edi
movsx eax, ax
test eax, reloc.WSOCK32.dll_accept
je 0x4bb31c
mov eax, dword [esi + 0x210]
or al, 0x40
mov dword [esi + 0x210], eax
mov ecx, dword [esi + 0x208]
push ecx
call edi
movsx edx, ax
test edx, reloc.WSOCK32.dll_accept
je 0x4bb33e
mov eax, dword [esi + 0x210]
or al, 0x80
mov dword [esi + 0x210], eax
test byte [esi + 0x1cc], 4
je 0x4bb3f7
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x238]
mov ecx, dword [esi + 0x230]
mov edx, eax
neg edx
cmp ecx, edx
jge 0x4bb374
or dword [esi + 0x210], 0x10000000
cmp ecx, eax
jle 0x4bb37e
or dword [esi + 0x210], ebx
mov eax, dword [esi + 0x23c]
mov ecx, dword [esi + 0x234]
mov edx, eax
neg edx
cmp ecx, edx
jge 0x4bb39c
or dword [esi + 0x210], 0x40000000
cmp ecx, eax
jle 0x4bb3aa
or dword [esi + 0x210], 0x80000000
push 1
call edi
movsx eax, ax
test eax, reloc.WSOCK32.dll_accept
je 0x4bb3c6
mov eax, dword [esi + 0x210]
or al, 1
mov dword [esi + 0x210], eax
push 2
call edi
movsx ecx, ax
test ecx, reloc.WSOCK32.dll_accept
je 0x4bb3e3
mov eax, dword [esi + 0x210]
or al, 2
mov dword [esi + 0x210], eax
mov edx, dword [esi + 0x244]
mov eax, dword [esi + 0x240]
push edx
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
mov al, byte [esi + 0x1cc]
mov edi, 0x100
test al, 2
je 0x4bb502
mov edx, dword [esi]
lea ecx, [esi + 0x198]
push ecx
push edx
mov dword [esi + 0x19c], 0x83
call dword [sym.imp.WINMM.dll_joyGetPosEx]
mov eax, dword [esi + 0x1a0]
mov ecx, dword [esi + 0x220]
cmp eax, ecx
jae 0x4bb43e
or dword [esi + 0x210], 0x10000000
cmp eax, dword [esi + 0x224]
jbe 0x4bb44c
or dword [esi + 0x210], ebx
mov eax, dword [esi + 0x1a4]
mov ecx, dword [esi + 0x228]
cmp eax, ecx
jae 0x4bb466
or dword [esi + 0x210], 0x40000000
cmp eax, dword [esi + 0x22c]
jbe 0x4bb478
or dword [esi + 0x210], 0x80000000
mov eax, dword [esi + 0x1b8]
test al, 1
je 0x4bb489
or dword [esi + 0x210], 1
test al, 2
je 0x4bb494
or dword [esi + 0x210], 2
test al, 4
je 0x4bb49f
or dword [esi + 0x210], 4
test al, 8
je 0x4bb4aa
or dword [esi + 0x210], 8
mov ecx, dword [esi + 0x1d4]
test ecx, ecx
je 0x4bb502
test al, 0x10
je 0x4bb4bf
or dword [esi + 0x210], 0x10
test al, 0x20
je 0x4bb4ca
or dword [esi + 0x210], 0x20
test al, 0x40
je 0x4bb4d5
or dword [esi + 0x210], 0x40
test al, 0x80
je 0x4bb4e8
mov ecx, dword [esi + 0x210]
or cl, 0x80
mov dword [esi + 0x210], ecx
cmp dword [esi + 0x40], 9
jb 0x4bb502
mov ecx, dword [esi + 0x1d8]
test ecx, ecx
jne 0x4bb502
test edi, eax
je 0x4bb502
or dword [esi + 0x210], edi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
test eax, 0x10000000
mov eax, dword [esi + 0x20c]
je 0x4bb535
test eax, 0x10000000
je 0x4bb52e
and dword [esi + 0x210], 0xefffffff
jmp 0x4bb540
or eax, 0x10000000
jmp 0x4bb53a
and eax, 0xefffffff
mov dword [esi + 0x20c], eax
test dword [esi + 0x214], ebx
mov eax, dword [esi + 0x20c]
je 0x4bb562
test ebx, eax
je 0x4bb55e
and dword [esi + 0x210], 0xdfffffff
jmp 0x4bb56d
or eax, ebx
jmp 0x4bb567
and eax, 0xdfffffff
mov dword [esi + 0x20c], eax
test dword [esi + 0x214], 0x40000000
mov eax, dword [esi + 0x20c]
je 0x4bb599
test eax, 0x40000000
je 0x4bb592
and dword [esi + 0x210], 0xbfffffff
jmp 0x4bb5a4
or eax, 0x40000000
jmp 0x4bb59e
and eax, 0xbfffffff
mov dword [esi + 0x20c], eax
test dword [esi + 0x214], 0x80000000
mov eax, dword [esi + 0x20c]
je 0x4bb5d0
test eax, 0x80000000
je 0x4bb5c9
and dword [esi + 0x210], 0x7fffffff
jmp 0x4bb5db
or eax, 0x80000000
jmp 0x4bb5d5
and eax, 0x7fffffff
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 1
mov eax, dword [esi + 0x20c]
je 0x4bb602
test al, 1
je 0x4bb5fe
mov eax, dword [esi + 0x210]
and al, 0xfe
mov dword [esi + 0x210], eax
jmp 0x4bb60a
or al, 1
jmp 0x4bb604
and al, 0xfe
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 2
mov eax, dword [esi + 0x20c]
je 0x4bb631
test al, 2
je 0x4bb62d
mov eax, dword [esi + 0x210]
and al, 0xfd
mov dword [esi + 0x210], eax
jmp 0x4bb639
or al, 2
jmp 0x4bb633
and al, 0xfd
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 4
mov eax, dword [esi + 0x20c]
je 0x4bb660
test al, 4
je 0x4bb65c
mov eax, dword [esi + 0x210]
and al, 0xfb
mov dword [esi + 0x210], eax
jmp 0x4bb668
or al, 4
jmp 0x4bb662
and al, 0xfb
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 8
mov eax, dword [esi + 0x20c]
je 0x4bb68f
test al, 8
je 0x4bb68b
mov eax, dword [esi + 0x210]
and al, 0xf7
mov dword [esi + 0x210], eax
jmp 0x4bb697
or al, 8
jmp 0x4bb691
and al, 0xf7
mov dword [esi + 0x20c], eax
mov eax, dword [esi + 0x1d4]
test eax, eax
je 0x4bb7a1
test byte [esi + 0x214], 0x10
mov eax, dword [esi + 0x20c]
je 0x4bb6cc
test al, 0x10
je 0x4bb6c8
mov eax, dword [esi + 0x210]
and al, 0xef
mov dword [esi + 0x210], eax
jmp 0x4bb6d4
or al, 0x10
jmp 0x4bb6ce
and al, 0xef
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 0x20
mov eax, dword [esi + 0x20c]
je 0x4bb6fb
test al, 0x20
je 0x4bb6f7
mov eax, dword [esi + 0x210]
and al, 0xdf
mov dword [esi + 0x210], eax
jmp 0x4bb703
or al, 0x20
jmp 0x4bb6fd
and al, 0xdf
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 0x40
mov eax, dword [esi + 0x20c]
je 0x4bb72a
test al, 0x40
je 0x4bb726
mov eax, dword [esi + 0x210]
and al, 0xbf
mov dword [esi + 0x210], eax
jmp 0x4bb732
or al, 0x40
jmp 0x4bb72c
and al, 0xbf
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 0x80
mov eax, dword [esi + 0x20c]
je 0x4bb759
test al, 0x80
je 0x4bb755
mov eax, dword [esi + 0x210]
and al, 0x7f
mov dword [esi + 0x210], eax
jmp 0x4bb761
or al, 0x80
jmp 0x4bb75b
and al, 0x7f
mov dword [esi + 0x20c], eax
test dword [esi + 0x214], edi
mov eax, dword [esi + 0x20c]
je 0x4bb798
test edi, eax
je 0x4bb789
mov eax, dword [esi + 0x210]
and ah, 0xfe
mov dword [esi + 0x210], eax
pop edi
pop esi
pop ebx
add esp, 8
ret
or eax, edi
mov dword [esi + 0x20c], eax
pop edi
pop esi
pop ebx
add esp, 8
ret
and ah, 0xfe
mov dword [esi + 0x20c], eax
pop edi
pop esi
pop ebx
add esp, 8
ret