Function at 0x4a5e20
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
push ebx
mov ebx, dword [esp + 0xbc]
push ebp
push esi
mov esi, dword [ebx + 4]
cmp esi, 0x200
push edi
mov ebp, ecx
je 0x4a5e62
cmp esi, 0xa0
je 0x4a5e62
cmp esi, 0x202
je 0x4a5e62
cmp esi, 0x205
je 0x4a5e62
cmp esi, 0x208
jne 0x4a63c9
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ax, ax
jl 0x4a63c9
push 2
call edi
test ax, ax
jl 0x4a63c9
push 4
call edi
test ax, ax
jl 0x4a63c9
mov eax, dword [esp + 0xcc]
test eax, eax
mov edi, dword [esp + 0xc4]
jne 0x4a5ed4
mov eax, dword [ebx]
push eax
call fcn.004fdb2c
test eax, eax
je 0x4a5ecc
mov esi, dword [sym.imp.USER32.dll_GetParent]
test dword [eax + 0x38], 0x401
jne 0x4a5ecc
mov ecx, dword [eax + 0x1c]
push ecx
call esi
push eax
call fcn.004fdb2c
test eax, eax
jne 0x4a5eb3
cmp eax, edi
jne 0x4a64b3
test edi, edi
jne 0x4a5edc
xor eax, eax
jmp 0x4a5edf
mov eax, dword [edi + 0x1c]
push eax
call fcn.00467050
mov esi, eax
mov eax, dword [ebp + 0x58]
add esp, 4
test eax, eax
mov dword [esp + 0x44], esi
je 0x4a5f2e
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x4a5f2e
mov edx, ecx
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4a5f2e
test esi, esi
jne 0x4a5f2e
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax + 0x1c]
push esi
push esi
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc
mov ecx, edi
call fcn.004fde1c
mov ebx, dword [ebp + 0x58]
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
je 0x4a5f6a
mov ecx, ebx
call fcn.00421844
cmp eax, edi
je 0x4a6034
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x60]
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 4]
mov dword [ebp + 0x58], 0
mov edx, dword [ebp]
push edi
mov ecx, ebp
call dword [edx + 0x50]
mov ebx, eax
test ebx, ebx
je 0x4a64b3
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4a61a2
mov ecx, dword [ebp + 0x34]
push ecx
push 0
push 0x418
push eax
call esi
mov eax, dword [ebx + 0x1c]
lea edx, [ebp + 0x3c]
push edx
push 0
push 0x41a
push eax
call esi
mov eax, dword [ebp + 0x88]
or edi, 0xffffffff
cmp eax, edi
je 0x4a5fc2
mov ecx, dword [ebx + 0x1c]
push 0
push eax
push 0x413
push ecx
call esi
mov eax, dword [ebp + 0x8c]
cmp eax, edi
je 0x4a5fda
mov edx, dword [ebx + 0x1c]
push 0
push eax
push 0x414
push edx
call esi
mov eax, dword [ebp + 0x50]
cmp eax, edi
je 0x4a5ff2
mov ecx, dword [ebx + 0x1c]
movzx eax, ax
push eax
push 1
push 0x403
push ecx
call esi
mov eax, dword [ebp + 0x4c]
cmp eax, edi
je 0x4a600a
movzx edx, ax
mov eax, dword [ebx + 0x1c]
push edx
push 3
push 0x403
push eax
call esi
mov eax, dword [ebp + 0x54]
cmp eax, edi
je 0x4a6022
mov edx, dword [ebx + 0x1c]
movzx ecx, ax
push ecx
push 2
push 0x403
push edx
call esi
mov eax, dword [ebx + 0x1c]
push 0
push 0
push 0x401
push eax
call esi
mov dword [ebp + 0x58], ebx
mov eax, dword [esp + 0xc8]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0xc4]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x4a60a4
mov eax, dword [ebp + 0x20]
test eax, eax
mov dword [esp + 0x48], 0x28
je 0x4a60ac
mov dword [esp + 0x48], 0x2c
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x78], ecx
mov ecx, dword [esp + 0xcc]
mov edx, dword [ecx]
push eax
call dword [edx + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x1c]
xor edi, edi
cmp eax, edi
je 0x4a610b
mov ecx, dword [esp + 0x24]
cmp ecx, edi
je 0x4a610b
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x4a610b
push eax
push ecx
call fcn.0042c9e5
add esp, 8
test eax, eax
jne 0x4a610b
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042c81d
add esp, 4
mov dword [esp + 0x24], edi
test byte [ebp + 0x38], 2
jne 0x4a612b
mov edx, dword [esp + 0x6c]
push edx
call fcn.00466f20
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 4]
push ecx
call fcn.00466f20
add esp, 8
mov edx, dword [ebp + 0x68]
cmp edx, dword [esp + 0x54]
jne 0x4a61bf
mov eax, dword [ebp + 0x64]
cmp eax, dword [esp + 0x50]
jne 0x4a61bf
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0xb4]
mov dword [esp + 0x14], edi
mov edi, dword [sym.imp.USER32.dll_CopyRect]
push edx
call edi
lea eax, [ebp + 0x6c]
push eax
lea ecx, [esp + 0xa4]
push ecx
call edi
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x4a61c7
cmp dword [esp + 0x14], 0xffffffff
je 0x4a637c
mov ecx, dword [esp + 0xc8]
push ecx
push ebx
mov ecx, ebp
call fcn.004a5b00
jmp 0x4a637c
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x60]
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc
mov dword [esp + 0x10], 1
mov ecx, dword [ebp + 0x5c]
cmp ecx, 0x28
lea eax, [ebp + 0x5c]
mov dword [esp + 0x18], eax
jb 0x4a61ec
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x4a61ec
mov edx, dword [ebx + 0x1c]
push eax
push 0
push 0x433
push edx
call esi
cmp dword [esp + 0x14], 0xffffffff
je 0x4a6329
lea eax, [esp + 0x74]
push eax
mov ecx, 0xb
lea esi, [esp + 0x4c]
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x7c]
mov ecx, dword [ebx + 0x1c]
push 0
push 0x432
and edx, 0x3fffffff
push ecx
mov dword [esp + 0x88], edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x28]
cmp eax, 3
je 0x4a62a6
cmp dword [ebp + 0x2c], 0x50050
jae 0x4a6242
test eax, eax
je 0x4a62a6
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x4a628f
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4a628f
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4a628f
mov edx, dword [ebp + 0x30]
push eax
push edx
push 0x421
mov ecx, ebx
call fcn.004069f0
mov edx, dword [ebx + 0x1c]
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x74]
push ecx
push 0
push 0x439
push edx
mov dword [esp + 0xa8], eax
call esi
jmp 0x4a62ac
mov eax, dword [ebx + 0x1c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x421
push eax
call esi
jmp 0x4a62ac
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x4a62ed
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x4a62de
mov edx, dword [ebp + 0x24]
mov eax, dword [esp + 0x14]
push 1
add edx, eax
push edx
call fcn.00498f20
test eax, eax
je 0x4a62de
push eax
mov eax, dword [ebx + 0x1c]
push 0
push 0x2a49
push eax
jmp 0x4a62eb
mov ecx, dword [ebx + 0x1c]
push 0
push 0
push 0x2a49
push ecx
call esi
test dword [esp + 0x4c], 0x40000000
jne 0x4a62ff
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4a633e
mov edx, dword [ebx + 0x1c]
push 0
push 1
push 0x401
push edx
call esi
mov eax, dword [ebx + 0x1c]
push 0x213
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x4a633e
mov ecx, dword [ebx + 0x1c]
push 0
push 0
push 0x401
push ecx
call esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0xc8]
push edx
push ebx
mov ecx, ebp
call fcn.004a5b00
mov eax, dword [esp + 0x18]
cmp dword [eax], 0x28
jb 0x4a636d
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4a636d
push eax
mov eax, dword [ebx + 0x1c]
push 0
push 0x433
push eax
call esi
mov edi, dword [esp + 0x18]
mov ecx, 0xb
lea esi, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x6c]
cmp eax, 0xffffffff
je 0x4a6396
mov ecx, dword [esp + 0x68]
test ecx, ecx
jne 0x4a6396
push eax
call fcn.0042c81d
add esp, 4
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4a63a7
push eax
call fcn.0042c81d
add esp, 4
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4a64b3
push eax
call fcn.0042c81d
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc
mov eax, dword [esp + 0xcc]
test eax, eax
jne 0x4a6415
mov ecx, dword [ebx]
push ecx
call fcn.004fdb2c
test eax, eax
mov edi, dword [esp + 0xc4]
je 0x4a640d
mov ebx, dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ecx]
cmp eax, edi
je 0x4a6415
test dword [eax + 0x38], 0x401
jne 0x4a640d
mov edx, dword [eax + 0x1c]
push edx
call ebx
push eax
call fcn.004fdb2c
test eax, eax
jne 0x4a63f0
cmp eax, edi
jne 0x4a64b3
cmp esi, 0x100
jb 0x4a6425
cmp esi, 0x108
jbe 0x4a6495
cmp esi, 0x104
jb 0x4a6435
cmp esi, 0x107
jbe 0x4a6495
cmp esi, 0x201
je 0x4a6495
cmp esi, 0x203
je 0x4a6495
cmp esi, 0x204
je 0x4a6495
cmp esi, 0x206
je 0x4a6495
cmp esi, 0x207
je 0x4a6495
cmp esi, 0x209
je 0x4a6495
cmp esi, 0xa1
je 0x4a6495
cmp esi, 0xa3
je 0x4a6495
cmp esi, 0xa4
je 0x4a6495
cmp esi, 0xa6
je 0x4a6495
cmp esi, 0xa7
je 0x4a6495
cmp esi, 0xa9
jne 0x4a64b3
mov ebp, dword [ebp + 0x58]
test ebp, ebp
je 0x4a64b3
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x4a64b3
push 0
push 0
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc