Function at 0x4fdffc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 0
mov eax, dword [ebp - 8]
test eax, eax
jns 0x4fe01f
call fcn.00403a58
push eax
call sub.user32.dll_MapVirtualKeyA
test eax, eax
jns 0x4fe02e
call fcn.00403a58
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 8], 0xa1
je 0x4fe05a
cmp dword [ebp - 8], 0xa3
je 0x4fe05a
cmp dword [ebp - 8], 0xa5
je 0x4fe05a
cmp dword [ebp - 8], 0x385
jne 0x4fe0a3
cmp dword [ebp - 8], 0xa1
jne 0x4fe06a
mov dword [ebp - 8], 0x10
cmp dword [ebp - 8], 0xa3
jne 0x4fe07a
mov dword [ebp - 8], 0x11
cmp dword [ebp - 8], 0xa5
jne 0x4fe08a
mov dword [ebp - 8], 0x12
cmp dword [ebp - 8], 0x385
jne 0x4fe09a
mov dword [ebp - 8], 0xd
mov dword [ebp - 0x1c], 1
jmp 0x4fe0f5
cmp dword [ebp - 8], 0x26
je 0x4fe0bb
cmp dword [ebp - 8], 0x28
je 0x4fe0bb
cmp dword [ebp - 8], 0x25
je 0x4fe0bb
cmp dword [ebp - 8], 0x27
jne 0x4fe0c4
mov dword [ebp - 0x1c], 1
jmp 0x4fe0f5
cmp dword [ebp - 8], 0x2d
je 0x4fe0ee
cmp dword [ebp - 8], 0x2e
je 0x4fe0ee
cmp dword [ebp - 8], 0x24
je 0x4fe0ee
cmp dword [ebp - 8], 0x23
je 0x4fe0ee
cmp dword [ebp - 8], 0x21
je 0x4fe0ee
cmp dword [ebp - 8], 0x22
je 0x4fe0ee
cmp dword [ebp - 8], 0x6f
jne 0x4fe0f5
mov dword [ebp - 0x1c], 1
cmp byte [ebp + 0xc], 0
je 0x4fe581
cmp dword [ebp + 8], 0
je 0x4fe87e
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4fe87e
cmp dword [ebp - 8], 0x10
je 0x4fe130
cmp dword [ebp - 8], 0x11
je 0x4fe130
cmp dword [ebp - 8], 0x12
jne 0x4fe1b2
cmp dword [ebp - 8], 0x10
jne 0x4fe142
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x219c], eax
cmp dword [ebp - 8], 0x11
jne 0x4fe154
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x21a0], eax
cmp dword [ebp - 8], 0x12
jne 0x4fe166
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x21a4], eax
cmp dword [ebp - 0xc], 0
je 0x4fe176
cmp dword [ebp - 0xc], 2
jne 0x4fe87e
cmp dword [ebp - 8], 0x10
jne 0x4fe187
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x219c], edx
cmp dword [ebp - 8], 0x11
jne 0x4fe198
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x21a0], edx
cmp dword [ebp - 8], 0x12
jne 0x4fe87e
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x21a4], edx
jmp 0x4fe87e
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x18]
and eax, 0xff
shl eax, 0x10
add dword [ebp - 0x34], eax
jae 0x4fe1ce
call fcn.00403a60
cmp dword [ebp - 0x1c], 0
je 0x4fe1e2
add dword [ebp - 0x34], 0x1000000
jae 0x4fe1e2
call fcn.00403a60
cmp dword [ebp - 0xc], 0
je 0x4fe1f2
cmp dword [ebp - 0xc], 1
jne 0x4fe53e
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x219c], 0
je 0x4fe245
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x219c]
mov eax, dword [ebp - 4]
call fcn.0050a7fc
test al, al
jne 0x4fe2a1
push 0
push 0
mov ecx, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x219c]
mov eax, dword [ebp - 4]
call fcn.004fdffc
mov dword [ebp - 0x28], 1
jmp 0x4fe2a1
mov edx, 0xa0
mov eax, dword [ebp - 4]
call fcn.0050a7fc
test al, al
je 0x4fe273
push 0
push 0
mov ecx, 2
mov edx, 0xa0
mov eax, dword [ebp - 4]
call fcn.004fdffc
mov dword [ebp - 0x28], 0xffffffff
mov edx, 0xa1
mov eax, dword [ebp - 4]
call fcn.0050a7fc
test al, al
je 0x4fe2a1
push 0
push 0
mov ecx, 2
mov edx, 0xa1
mov eax, dword [ebp - 4]
call fcn.004fdffc
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 4]
cmp dword [eax + 0x21a0], 0
je 0x4fe2e5
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x21a0]
mov eax, dword [ebp - 4]
call fcn.0050a7fc
test al, al
jne 0x4fe341
push 0
push 0
mov ecx, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x21a0]
mov eax, dword [ebp - 4]
call fcn.004fdffc
mov dword [ebp - 0x2c], 1
jmp 0x4fe341
mov edx, 0xa2
mov eax, dword [ebp - 4]
call fcn.0050a7fc
test al, al
je 0x4fe313
push 0
push 0
mov ecx, 2
mov edx, 0xa2
mov eax, dword [ebp - 4]
call fcn.004fdffc
mov dword [ebp - 0x2c], 0xffffffff
mov edx, 0xa3
mov eax, dword [ebp - 4]
call fcn.0050a7fc
test al, al
je 0x4fe341
push 0
push 0
mov ecx, 2
mov edx, 0xa3
mov eax, dword [ebp - 4]
call fcn.004fdffc
mov dword [ebp - 0x2c], 0xfffffffe
mov eax, dword [ebp - 4]
cmp dword [eax + 0x21a4], 0
je 0x4fe385
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x21a4]
mov eax, dword [ebp - 4]
call fcn.0050a7fc
test al, al
jne 0x4fe3e1
push 0
push 0
mov ecx, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x21a4]
mov eax, dword [ebp - 4]
call fcn.004fdffc
mov dword [ebp - 0x30], 1
jmp 0x4fe3e1
mov edx, 0xa4
mov eax, dword [ebp - 4]
call fcn.0050a7fc
test al, al
je 0x4fe3b3
push 0
push 0
mov ecx, 2
mov edx, 0xa4
mov eax, dword [ebp - 4]
call fcn.004fdffc
mov dword [ebp - 0x30], 0xffffffff
mov edx, 0xa5
mov eax, dword [ebp - 4]
call fcn.0050a7fc
test al, al
je 0x4fe3e1
push 0
push 0
mov ecx, 2
mov edx, 0xa5
mov eax, dword [ebp - 4]
call fcn.004fdffc
mov dword [ebp - 0x30], 0xfffffffe
cmp dword [ebp - 0x28], 0
jne 0x4fe3f3
cmp dword [ebp - 0x2c], 0
jne 0x4fe3f3
cmp dword [ebp - 0x30], 0
je 0x4fe3fa
push 4
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_PostMessageA
mov edx, 0x28
mov eax, dword [ebp - 4]
call fcn.005463e4
cmp dword [ebp - 0x28], 1
jne 0x4fe43d
push 0
push 0
mov ecx, 2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x219c]
mov eax, dword [ebp - 4]
call fcn.004fdffc
cmp dword [ebp - 0x2c], 1
jne 0x4fe45d
push 0
push 0
mov ecx, 2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x21a0]
mov eax, dword [ebp - 4]
call fcn.004fdffc
cmp dword [ebp - 0x30], 1
jne 0x4fe47d
push 0
push 0
mov ecx, 2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x21a4]
mov eax, dword [ebp - 4]
call fcn.004fdffc
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4fe499
push 0
push 0
mov ecx, 1
mov edx, 0xa0
mov eax, dword [ebp - 4]
call fcn.004fdffc
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x4fe4b5
push 0
push 0
mov ecx, 1
mov edx, 0xa2
mov eax, dword [ebp - 4]
call fcn.004fdffc
cmp dword [ebp - 0x30], 0xffffffff
jne 0x4fe4d1
push 0
push 0
mov ecx, 1
mov edx, 0xa4
mov eax, dword [ebp - 4]
call fcn.004fdffc
cmp dword [ebp - 0x28], 0xfffffffe
jne 0x4fe4ed
push 0
push 0
mov ecx, 1
mov edx, 0xa1
mov eax, dword [ebp - 4]
call fcn.004fdffc
cmp dword [ebp - 0x2c], 0xfffffffe
jne 0x4fe509
push 0
push 0
mov ecx, 1
mov edx, 0xa3
mov eax, dword [ebp - 4]
call fcn.004fdffc
cmp dword [ebp - 0x30], 0xfffffffe
jne 0x4fe525
push 0
push 0
mov ecx, 1
mov edx, 0xa5
mov eax, dword [ebp - 4]
call fcn.004fdffc
cmp dword [ebp - 0x28], 0
jne 0x4fe537
cmp dword [ebp - 0x2c], 0
jne 0x4fe537
cmp dword [ebp - 0x30], 0
je 0x4fe53e
push 4
call sub.kernel32.dll_Sleep_1
cmp dword [ebp - 0xc], 0
je 0x4fe54e
cmp dword [ebp - 0xc], 2
jne 0x4fe87e
mov eax, dword [ebp - 0x34]
add eax, 0x40000000
jae 0x4fe55d
call fcn.00403a60
add eax, 0x80000000
jae 0x4fe569
call fcn.00403a60
push eax
mov eax, dword [ebp - 8]
push eax
push 0x101
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fe87e
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0xc], 0
je 0x4fe596
cmp dword [ebp - 0xc], 1
jne 0x4fe67e
cmp dword [ebp - 8], 0x12
je 0x4fe5a5
cmp dword [ebp - 8], 0xa5
jne 0x4fe5ac
mov dword [ebp - 0x24], 1
cmp dword [ebp - 8], 0x11
je 0x4fe5c4
cmp dword [ebp - 8], 0xa2
je 0x4fe5c4
cmp dword [ebp - 8], 0xa3
jne 0x4fe5cb
mov dword [ebp - 0x24], 2
cmp dword [ebp - 8], 0x10
je 0x4fe5e3
cmp dword [ebp - 8], 0xa0
je 0x4fe5e3
cmp dword [ebp - 8], 0xa1
jne 0x4fe5ea
mov dword [ebp - 0x24], 4
cmp dword [ebp - 8], 0x5b
je 0x4fe5f6
cmp dword [ebp - 8], 0x5c
jne 0x4fe5fd
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20b0]
call fcn.00406234
sub eax, 1
jno 0x4fe615
call fcn.00403a60
test eax, eax
jl 0x4fe67e
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
imul eax, eax, 2
jno 0x4fe631
call fcn.00403a60
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20b0]
lea eax, [edx + eax*8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
xor edx, edx
call fcn.00405614
je 0x4fe676
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
je 0x4fe664
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 4]
and eax, dword [ebp - 0x24]
je 0x4fe676
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0045e0f0
push eax
call sub.user32.dll_UnregisterHotKey
inc dword [ebp - 0x10]
dec dword [ebp - 0x38]
jne 0x4fe624
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x1c
call fcn.0040346c
cmp dword [ebp - 0xc], 0
je 0x4fe69d
cmp dword [ebp - 0xc], 1
jne 0x4fe739
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x5c], 1
xor eax, eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 8], 0xff
jle 0x4fe6e8
mov word [ebp - 0x58], 0
mov eax, dword [ebp - 8]
cmp eax, 0xffff
jbe 0x4fe6db
call fcn.00403a58
mov word [ebp - 0x56], ax
mov dword [ebp - 0x54], 4
jmp 0x4fe71d
mov eax, dword [ebp - 8]
cmp eax, 0xffff
jbe 0x4fe6f7
call fcn.00403a58
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x18]
cmp eax, 0xffff
jbe 0x4fe70a
call fcn.00403a58
mov word [ebp - 0x56], ax
mov eax, dword [ebp - 0x1c]
test eax, eax
jns 0x4fe71a
call fcn.00403a58
mov dword [ebp - 0x54], eax
push 0x1c
lea eax, [ebp - 0x5c]
push eax
push 1
call sub.user32.dll_SendInput
cmp dword [ebp - 0x20], 0
jne 0x4fe739
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetAsyncKeyState
cmp dword [ebp - 0xc], 0
je 0x4fe749
cmp dword [ebp - 0xc], 2
jne 0x4fe7ca
mov dword [ebp - 0x5c], 1
xor eax, eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 8], 0xff
jle 0x4fe785
mov word [ebp - 0x58], 0
mov eax, dword [ebp - 8]
cmp eax, 0xffff
jbe 0x4fe778
call fcn.00403a58
mov word [ebp - 0x56], ax
mov dword [ebp - 0x54], 6
jmp 0x4fe7bd
mov eax, dword [ebp - 8]
cmp eax, 0xffff
jbe 0x4fe794
call fcn.00403a58
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x18]
cmp eax, 0xffff
jbe 0x4fe7a7
call fcn.00403a58
mov word [ebp - 0x56], ax
mov eax, dword [ebp - 0x1c]
or eax, 2
test eax, eax
jns 0x4fe7ba
call fcn.00403a58
mov dword [ebp - 0x54], eax
push 0x1c
lea eax, [ebp - 0x5c]
push eax
push 1
call sub.user32.dll_SendInput
cmp dword [ebp - 0xc], 0
je 0x4fe7da
cmp dword [ebp - 0xc], 1
jne 0x4fe87e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20b0]
call fcn.00406234
sub eax, 1
jno 0x4fe7f2
call fcn.00403a60
test eax, eax
jl 0x4fe87e
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
imul eax, eax, 2
jno 0x4fe812
call fcn.00403a60
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20b0]
lea eax, [edx + eax*8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 8]
xor edx, edx
call fcn.00405614
je 0x4fe876
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
je 0x4fe845
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 4]
and eax, dword [ebp - 0x24]
je 0x4fe876
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
test eax, eax
jns 0x4fe853
call fcn.00403a58
push eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 4]
test eax, eax
jns 0x4fe863
call fcn.00403a58
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0045e0f0
push eax
call sub.user32.dll_RegisterHotKey
inc dword [ebp - 0x10]
dec dword [ebp - 0x38]
jne 0x4fe805
mov esp, ebp
pop ebp
ret 8