Function at 0x4a0690
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x38
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0xc]
push edi
cmp ecx, eax
je 0x4a06d4
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov cx, word [ecx + 0x14]
mov word [eax + 0x14], cx
xor edi, edi
cmp word [esi + 0x14e], di
jne 0x4a06f9
movsx edx, word [esi + 0x1c]
movsx eax, word [esi + 0x18]
movsx ecx, word [esi + 0xe]
sub edx, eax
add edx, 0xa
cmp ecx, edx
jle 0x4a06f9
lea eax, [edi + 1]
jmp 0x4a06fb
xor eax, eax
cmp byte [0x5329f4], 0
mov byte [esi + 0x22], al
jne 0x4a0d4b
mov dword [esi + 0x44], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], 1
xor eax, eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esi + 0x40], edi
movzx edx, byte [eax + 0x25]
shr edx, 4
mov dword [esi + 0x1960], edx
mov edx, dword [ecx + edx*4]
mov dword [esi + 0x1964], edx
movzx edx, byte [eax + 0x22]
shr edx, 4
mov dword [esi + 0x1968], edx
mov edx, dword [ecx + edx*4]
mov dword [esi + 0x196c], edx
movzx edx, byte [eax + 0x21]
shr edx, 4
mov edx, dword [ecx + edx*4]
mov dword [esi + 0x1970], edx
movzx edx, byte [eax + 0x21]
and edx, 0xf
mov edx, dword [ecx + edx*4]
mov dword [esi + 0x1974], edx
movzx edx, byte [eax + 0x26]
shr edx, 4
mov edx, dword [ecx + edx*4]
mov dword [esi + 0x1978], edx
movzx edx, byte [eax + 0x26]
and edx, 0xf
mov ecx, dword [ecx + edx*4]
mov dword [esi + 0x197c], ecx
movzx edx, byte [eax + 0x24]
shr edx, 4
mov dword [esi + 0x1980], edx
movzx ecx, byte [eax + 0x24]
and ecx, 0xf
mov dword [esi + 0x1984], ecx
movzx edx, byte [eax + 0x23]
shr edx, 4
mov dword [esi + 0x1988], edx
movzx ecx, byte [eax + 0x23]
and ecx, 0xf
xor edx, edx
mov dword [esi + 0x198c], ecx
cmp dword [eax + 0x1a8], edi
setne dl
mov dword [esi + 0x1998], edx
cmp dword [eax + 0x1ac], 0xffffffff
je 0x4a0803
mov ecx, dword [eax + 0x1ac]
sar ecx, 4
and ecx, 0xf
mov dword [esi + 0x1990], ecx
mov edx, dword [eax + 0x1ac]
jmp 0x4a0814
movzx ecx, byte [eax + 0x1c]
shr ecx, 4
mov dword [esi + 0x1990], ecx
movzx edx, byte [eax + 0x1c]
and edx, 0xf
mov dword [esi + 0x1994], edx
mov ecx, dword [eax + 0x11c]
and ecx, 8
shr ecx, 3
xor edx, edx
test cl, cl
setne dl
mov byte [esi + 0x199c], cl
inc edx
mov dword [esi + 0x19a0], edx
mov ecx, dword [eax + 0x11c]
and ecx, 0x10
shr ecx, 4
mov byte [esi + 0x19a4], cl
test cl, cl
je 0x4a0857
or dword [esi + 0x44], 8
xor ecx, ecx
cmp byte [esi + 0x19a4], cl
push ebx
mov ebx, dword [ebp + 0x20]
setne cl
mov byte [ebp + 0xf], 0
mov byte [ebp + 0x13], 0
mov byte [ebp + 0xb], 0
mov dword [esi + 0x19a8], ecx
cmp dword [eax + 0x134], edi
mov edi, dword [ebp + 0x1c]
je 0x4a08e4
mov edx, dword [eax + 0x144]
mov ecx, dword [eax + 0x148]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 0x14c]
mov eax, dword [eax + 0x150]
lea edx, [edi - 1]
mov byte [ebp + 0xf], 1
cmp ecx, edx
jne 0x4a08b0
mov byte [ebp + 0xb], 1
cmp ecx, edi
jl 0x4a08b6
mov ecx, edx
cmp eax, ebx
jl 0x4a08bd
lea eax, [ebx - 1]
mov edx, dword [ebp - 0x20]
push 0xffffffffffffffff
push 1
push 1
push eax
mov eax, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
push ebx
push edi
push ecx
push edx
mov ecx, esi
call fcn.0049f050
cmp byte [ebp + 0xb], 0
jne 0x4a093b
mov eax, dword [esi + 4]
cmp dword [eax + 0x138], 0
je 0x4a093b
mov ecx, dword [eax + 0x178]
mov edx, dword [eax + 0x174]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 0x17c]
cmp ecx, edi
mov eax, dword [eax + 0x180]
mov byte [ebp + 0x13], 1
jl 0x4a0916
lea ecx, [edi - 1]
cmp eax, ebx
jl 0x4a091d
lea eax, [ebx - 1]
push 0xffffffffffffffff
push 1
push 1
push eax
mov eax, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
push edx
mov edx, dword [ebp + 0x14]
push ebx
push edi
push ecx
push edx
mov ecx, esi
call fcn.0049f050
cmp byte [esi + 0x19a4], 0
mov dword [esi + 0x28], 1
jne 0x4a097e
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0x14]
cmp ecx, dword [esi + 0x196c]
jne 0x4a09a2
mov ecx, 0x20
cmp word [eax], cx
jne 0x4a09a2
cmp word [eax + 2], cx
jne 0x4a09a2
cmp word [eax + 4], cx
jne 0x4a09a2
cmp word [eax + 6], cx
jne 0x4a09a2
cmp word [eax + 8], cx
je 0x4a09a2
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
push 8
push 0
push 0
push 0
lea edx, [edi - 1]
push edx
push 0
push 0
push ebx
push edi
push eax
push ecx
mov ecx, esi
call fcn.0049f050
mov eax, dword [ebp + 0x14]
mov edx, dword [esi + 4]
cmp dword [edx + 0x19c], 0
je 0x4a09e0
test dword [esi + 0x44], 7
jne 0x4a09e0
mov edx, dword [ebp + 0x18]
push 0x80
push 0
push 0
lea eax, [ebx - 1]
push eax
mov eax, dword [ebp + 0x14]
lea ecx, [edi - 1]
push ecx
push 0
push 0
push ebx
push edi
push edx
push eax
mov ecx, esi
call fcn.0049f050
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov edx, 0x250c
mov eax, 0x2510
mov ecx, 0x2514
mov word [ebp - 0x38], dx
mov word [ebp - 0x36], ax
mov word [ebp - 0x34], cx
mov edx, 0x2518
mov eax, 0x2554
mov ecx, 0x2557
mov word [ebp - 0x32], dx
mov word [ebp - 0x30], ax
mov word [ebp - 0x2e], cx
xor ecx, ecx
mov edx, 0x255a
mov eax, 0x255d
mov word [ebp - 0x2c], dx
mov word [ebp - 0x2a], ax
mov word [ebp - 0x28], cx
mov dword [ebp + 8], ecx
test ebx, ebx
jle 0x4a0c66
mov eax, edi
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
add eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x19a8]
cmp dword [ebp + 8], eax
jl 0x4a0c48
mov edx, dword [ebp + 0x20]
sub edx, dword [esi + 0x19a0]
cmp dword [ebp + 8], edx
jge 0x4a0c48
mov ecx, dword [ebp + 8]
cmp ecx, eax
jne 0x4a0b48
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4a0a8c
cmp eax, 8
jne 0x4a0b48
mov ebx, dword [ebp - 4]
movzx edx, word [ebx]
mov eax, dword [ebp - 8]
cmp dx, 0x5b
jne 0x4a0ab6
mov edi, dword [eax + 4]
cmp edi, dword [esi + 0x1978]
jne 0x4a0ab6
mov edi, dword [eax]
and edi, 0xffffff
cmp edi, dword [esi + 0x197c]
je 0x4a0afa
test ecx, ecx
jne 0x4a0b4b
cmp dx, 0x50
jne 0x4a0adc
mov ecx, dword [eax + 8]
mov edi, ecx
and edi, 0x700
cmp edi, 0x200
jne 0x4a0adc
cmp cl, 0xf
je 0x4a0afa
cmp dx, 0x52
jne 0x4a0b4b
mov ecx, dword [eax + 8]
mov edx, ecx
and edx, 0x700
cmp edx, 0x400
jne 0x4a0b4b
cmp cl, 0xf
jne 0x4a0b4b
mov edx, dword [ebp + 0x1c]
mov ecx, 0x2551
cmp word [ebx + edx*2], cx
jne 0x4a0b4b
mov ecx, dword [ebp - 0x10]
mov edi, dword [ecx + eax + 4]
cmp edi, dword [esi + 0x1970]
jne 0x4a0b4b
mov eax, dword [ecx + eax]
and eax, 0xffffff
cmp eax, dword [esi + 0x1974]
jne 0x4a0b4b
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x20]
push 0
push 0
inc ecx
push ecx
mov ecx, dword [ebp + 0x18]
push 0
push eax
push edx
mov edx, dword [ebp + 0x14]
push ecx
push edx
mov ecx, esi
call fcn.004a03e0
jmp 0x4a0b4b
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x1c]
add eax, eax
add eax, ebx
mov dword [ebp - 0xc], eax
cmp ebx, eax
jae 0x4a0c48
lea ecx, [ecx]
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x38]
push eax
push ebx
mov dword [ebp - 0x14], ecx
call fcn.004c9bf0
mov edi, eax
add esp, 8
test edi, edi
jne 0x4a0ba4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebx + eax*2 + 2]
cmp ebx, dword [ebp - 0xc]
jae 0x4a0ba4
lea ecx, [ebp - 0x38]
push ecx
push ebx
call fcn.004c9bf0
mov edi, eax
add esp, 8
test edi, edi
je 0x4a0b81
mov dx, word [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov word [eax], dx
test edi, edi
je 0x4a0c48
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
lea ebx, [edi + 2]
sub edi, ecx
sar edi, 1
lea edx, [edi + edi*2]
test byte [eax + edx*8 + 0x14], 4
lea eax, [eax + edx*8]
jne case.0x4a0be6.9485
movzx ecx, word [ecx + edi*2]
add ecx, 0xffffdaf4
cmp ecx, 0x51
ja case.0x4a0be6.9485
movzx ecx, byte [ecx + 0x4a0d5c]
jmp dword [ecx*4 + 0x4a0d54]
test byte [esi + 0x44], 0x80
je 0x4a0c1f
movzx ecx, byte [eax + 9]
cmp ecx, dword [esi + 0x1980]
jne 0x4a0c0b
movzx edx, byte [eax + 8]
cmp edx, dword [esi + 0x1984]
je 0x4a0c1f
cmp ecx, dword [esi + 0x1988]
jne case.0x4a0be6.9485
movzx eax, byte [eax + 8]
cmp eax, dword [esi + 0x198c]
jne case.0x4a0be6.9485
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x1c]
push 0
push 0
push ecx
mov ecx, dword [ebp + 0x18]
push edi
push edx
mov edx, dword [ebp + 0x14]
push eax
push ecx
push edx
mov ecx, esi
call fcn.004a03e0
cmp ebx, dword [ebp - 0xc]
jb 0x4a0b60
mov eax, dword [ebp + 0x1c]
add eax, eax
add dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], eax
mov eax, dword [ebp + 8]
inc eax
cmp eax, dword [ebp + 0x20]
mov dword [ebp + 8], eax
jl 0x4a0a50
cmp byte [esi + 0x22], 0
jne 0x4a0d41
cmp byte [ebp + 0xf], 0
jne 0x4a0cbf
cmp byte [ebp + 0x13], 0
jne 0x4a0cbf
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x4a0cbf
push 0x10
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x4a0cbf
push 0x12
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x4a0d41
cmp byte [esi + 0x23], 0
mov edi, dword [ebp + 0x18]
je 0x4a0d41
mov ebx, dword [ebp + 0x20]
xor ecx, ecx
mov dword [ebp + 0x14], ecx
test ebx, ebx
jle 0x4a0d41
mov eax, dword [ebp + 0x1c]
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
add eax, eax
mov dword [ebp - 0x10], eax
cmp ecx, dword [esi + 0x19a8]
jl 0x4a0d37
mov edx, ebx
sub edx, dword [esi + 0x19a0]
cmp ecx, edx
jge 0x4a0d37
lea edx, [eax + edi]
cmp edi, edx
jae 0x4a0d37
sub edx, edi
dec edx
mov eax, 0xaaaaaaab
mul edx
shr edx, 4
lea ecx, [edi + 0x14]
inc edx
nop
mov eax, dword [ecx]
test al, 1
jne 0x4a0d26
mov ebx, dword [ecx - 0x10]
cmp ebx, dword [esi + 0x1964]
jne 0x4a0d26
or eax, 0x10
mov dword [ecx], eax
add ecx, 0x18
sub edx, 1
jne 0x4a0d10
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x14]
inc ecx
add edi, eax
cmp ecx, ebx
mov dword [ebp + 0x14], ecx
jl 0x4a0ce3
mov eax, dword [esi + 0x44]
mov dword [esi + 0x138], eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c