Function at 0x4cfee0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push esi
mov esi, ecx
push edi
push 0x10
mov dword [esi], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], bl
mov byte [esi + 0xb], bl
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xd], 1
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call ebp
test ax, ax
setl al
push 0x11
mov byte [esi + 9], al
call ebp
test ax, ax
jge 0x4cff37
push 0x12
call ebp
test ax, ax
jl 0x4cff37
mov eax, 1
jmp 0x4cff39
xor eax, eax
push 0x90
mov byte [esi + 0xa], al
mov byte [esi + 8], bl
mov byte [esi + 0xb], bl
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], 1
mov dword [esi + 0x10], ebx
call ebp
and eax, 1
mov dword [esp + 0x10], eax
cmp byte [esp + 0x1c], bl
je 0x4d0236
mov edi, dword [esp + 0x18]
push edi
call ebp
test ax, ax
setl cl
cmp edi, 0x10
mov byte [esi + 0xc], cl
je 0x4d01f3
cmp edi, 0x11
je 0x4d01f3
cmp dword [esp + 0x10], ebx
je 0x4cffb0
cmp edi, 0x5f
jle 0x4cffb0
cmp edi, 0x6a
jge 0x4cffb0
add edi, 0xffffffd0
mov dword [esi], edi
pop edi
mov byte [esi + 0xb], 1
mov dword [esi + 0x10], 3
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, 0x69
jle 0x4cffd4
cmp edi, 0x70
jge 0x4cffd4
add edi, 0xffffffc0
mov dword [esi], edi
pop edi
mov byte [esi + 0xb], 1
mov dword [esi + 0x10], 3
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, 0x6f
jle 0x4cfff1
cmp edi, 0x7f
jge 0x4cfff1
add edi, 0xffffffb9
mov dword [esi], edi
pop edi
mov byte [esi + 8], 1
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
lea eax, [edi - 8]
cmp eax, 0x89
ja case.0x4d0006.10
movzx edx, byte [eax + 0x4d02a8]
jmp dword [edx*4 + 0x4d0248]
pop edi
mov byte [esi + 8], 1
mov dword [esi], 1
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 2
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 3
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 4
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 5
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 6
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 7
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 8
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x12
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0xd
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0xe
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0xf
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x10
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x11
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x16
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x17
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x18
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x19
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x13
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x20
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x38
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x39
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x3a
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push edi
mov ecx, esi
call fcn.004cfe60
movzx eax, al
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
add edi, 0x55
push 0xa1
mov byte [esi + 8], 1
mov dword [esi], edi
call ebp
test ax, ax
jl 0x4d0225
push 0xa3
call ebp
test ax, ax
jl 0x4d0225
pop edi
mov dword [esi + 0x10], 1
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov dword [esi + 0x10], 2
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x18]
pop edi
mov dword [esi], ecx
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8