Function at 0x4950a4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x32]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x495788
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x4c0ed8]
mov eax, dword [eax]
xor edx, edx
call fcn.00455970
push eax
call sub.user32.dll_SetCursor
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00492d84
test eax, eax
jle 0x495130
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.00492d84
mov edx, eax
dec edx
mov eax, ebx
call fcn.00492d8c
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
call fcn.00494ea8
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004949b8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x495146
mov eax, ebx
call fcn.0043e1c4
call fcn.0047bcf4
mov byte [ebp - 6], 1
jmp 0x49575f
cmp byte [ebp - 6], 0
jne 0x49515a
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x49573e
mov eax, dword [edi + 4]
sub eax, 0x12
je 0x49527a
sub eax, 0x34
je 0x49518c
add eax, 0xffffffa5
sub eax, 9
jb 0x49527a
sub eax, 0x157
je 0x49519d
jmp 0x495286
push ebp
call fcn.00495050
pop ecx
call fcn.0040406c
jmp 0x49578f
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407650
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00437654
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x495223
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea ecx, [ebp - 0x4c]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00494a74
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x495223
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043e1c4
push eax
call sub.user32.dll_PostMessageA
jmp 0x495286
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x49525d
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00437654
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea ecx, [ebp - 0x4c]
mov edx, dword [esi + 0x40]
mov eax, esi
call fcn.00494a74
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x49525a
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x495265
test bl, bl
je 0x49522a
test bl, bl
jne 0x495286
push ebp
call fcn.00495050
pop ecx
call fcn.0040406c
jmp 0x49578f
push ebp
call fcn.00495050
pop ecx
jmp 0x49573e
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x49573e
mov eax, dword [edi + 4]
sub eax, 0x7b
je 0x49573e
add eax, 0xffffff7b
sub eax, 9
jb 0x4952d8
add eax, 0xffffff09
sub eax, 0xb
jb 0x49557c
sub eax, 0x264
jne 0x495738
mov eax, dword [ebp - 4]
call fcn.00494dec
jmp 0x49573e
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x49573e
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x49530e
sub eax, 2
je 0x49552b
sub eax, 2
je 0x49530e
sub eax, 2
je 0x49552b
jmp 0x49573e
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x495351
je 0x495403
cmp eax, 0x12
jg 0x49533a
je 0x495514
sub eax, 9
je 0x49573e
sub eax, 4
je 0x495376
jmp 0x495520
sub eax, 0x1b
je 0x4953db
sub eax, 5
je 0x49573e
jmp 0x495520
sub eax, 0x26
je 0x4954d7
dec eax
je 0x49546d
dec eax
je 0x4954f1
sub eax, 0x51
je 0x495514
jmp 0x495520
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x495389
mov si, 0xffef
call fcn.004039f0
mov eax, dword [ebp - 4]
call fcn.00494dec
test al, al
jne 0x49573e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x49573e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4957a4
call fcn.004049e0
je 0x49573e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x49573e
push ebp
call fcn.00495050
pop ecx
jmp 0x49573e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x4953e9
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.0040406c
jmp 0x49578f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x495419
mov eax, dword [ebp - 4]
call fcn.00494f74
jmp 0x49573e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x49573e
cmp byte [ebx + 0x34], 0
je 0x49544e
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0043e1c4
push eax
call sub.user32.dll_PostMessageA
call fcn.0040406c
jmp 0x49578f
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043e1c4
push eax
call sub.user32.dll_PostMessageA
jmp 0x49573e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x495483
mov eax, dword [ebp - 4]
call fcn.00494ea8
jmp 0x49573e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x49573e
cmp byte [ebx + 0x34], 0
je 0x4954b8
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0043e1c4
push eax
call sub.user32.dll_PostMessageA
call fcn.0040406c
jmp 0x49578f
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043e1c4
push eax
call sub.user32.dll_PostMessageA
jmp 0x49573e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x49573e
mov eax, dword [ebp - 4]
call fcn.00494f74
jmp 0x49573e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x495507
mov eax, dword [ebp - 4]
call fcn.00494ea8
jmp 0x49573e
mov eax, dword [ebp - 4]
call fcn.00494dec
jmp 0x49573e
push ebp
call fcn.00495050
pop ecx
jmp 0x49573e
push edi
call sub.user32.dll_TranslateMessage
jmp 0x49573e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.00494138
test eax, eax
je 0x49573e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.00494138
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043e1c4
push eax
call sub.user32.dll_PostMessageA
jmp 0x49573e
mov eax, dword [edi + 4]
sub eax, 0x200
je 0x495594
sub eax, 2
je 0x495663
jmp 0x49573e
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407650
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x4c21ac]
jne 0x4955c5
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x4c21b0]
je 0x49573e
mov esi, dword [ebp - 4]
jmp 0x4955cc
mov esi, eax
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x4955ca
test esi, esi
je 0x49563b
mov ebx, dword [esi + 0x40]
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004949b8
cmp ebx, dword [esi + 0x40]
je 0x495634
cmp esi, dword [ebp - 4]
je 0x495634
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x495613
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0043e1c4
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x48]
cmp esi, ebx
jne 0x4955f5
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.0043e1c4
push eax
call sub.user32.dll_PostMessageA
call fcn.0040406c
jmp 0x49578f
mov esi, dword [esi + 0x4c]
test esi, esi
jne 0x4955d7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x49564c
mov eax, dword [ebp - 4]
call fcn.00494dec
mov eax, dword [ebp - 0xe]
mov dword [0x4c21ac], eax
mov eax, dword [ebp - 0xa]
mov dword [0x4c21b0], eax
jmp 0x49573e
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407650
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00437654
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4956e9
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea ecx, [ebp - 0x4c]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00494a74
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4956e9
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043e1c4
push eax
call sub.user32.dll_PostMessageA
jmp 0x49573e
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x495723
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00437654
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea ecx, [ebp - 0x4c]
mov edx, dword [esi + 0x40]
mov eax, esi
call fcn.00494a74
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x495720
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x49572b
test bl, bl
je 0x4956f0
test bl, bl
jne 0x49573e
push ebp
call fcn.00495050
pop ecx
jmp 0x49573e
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.0049507c
pop ecx
test al, al
je 0x49575f
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x495163
push ebp
call fcn.0049507c
pop ecx
test al, al
jne 0x49514f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49578f
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.0047bd14
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret