Function at 0x4930f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
je 0x493436
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, 0x102
je 0x493133
cmp ebx, 0x106
je 0x493133
cmp ebx, 0x286
je 0x493133
cmp edi, 0x19
je case.0x49323f.258
cmp edi, 0xe5
je case.0x49323f.258
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [esi + 0x41f0]
push edi
push ebx
push edx
call fcn.00485910
test al, al
jne case.0x49323f.258
cmp edi, 0x12
jne 0x4931d8
cmp ebx, 0x101
je 0x493169
cmp ebx, 0x105
jne 0x4931d8
mov eax, dword [0x52fe30]
cmp byte [eax + 0x11439], 0
je 0x4931d8
call fcn.00425f40
cmp eax, dword [0x52fe14]
je 0x4931d8
cmp dword [esi + 0x46c8], 0
je 0x4931d8
mov eax, dword [esi + 0x4924]
test al, 4
je 0x4931d8
test al, 0x10
jne 0x4931d8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x4931d8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x4931d8
push 0xffffffffffffffff
push 0
push 2
push 0x11
mov ecx, esi
call fcn.00491f40
mov eax, edi
and eax, 0xff
cmp eax, 0xd0
jb 0x4931f1
cmp eax, 0xd3
jbe case.0x49323f.258
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
push esi
push eax
push ecx
mov ecx, dword [0x52fe2c]
push edi
push ebx
add ecx, 0x118
call fcn.0042dec0
test al, al
jne case.0x49323f.258
mov eax, dword [esi + 0x10]
test eax, eax
je 0x49334b
cmp eax, 0xffffffff
je 0x49334b
lea eax, [ebx - 0x100]
cmp eax, 6
ja case.default.0x49323f
movzx edx, byte [eax + 0x493444]
jmp dword [edx*4 + 0x49343c]
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x493285
cmp ebx, 0x100
je 0x493261
cmp ebx, 0x104
jne case.0x49323f.258
mov dword [esi + 0x730], ebx
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
push ecx
mov ecx, dword [esi + 0x10]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0048a640
pop edi
pop ebx
pop esi
pop ebp
ret 0x18
mov ecx, dword [esi + 0x730]
test ecx, ecx
je 0x49331b
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4932f5
movzx eax, word [eax]
test ax, ax
je 0x4932f5
xor edi, edi
movzx eax, ax
mov ebx, 0x100
lea esp, [esp]
mov edx, dword [ebp + 0x14]
xor ecx, ecx
cmp dword [esi + 0x730], ebx
push edx
mov edx, dword [esi + 0x10]
setne cl
movzx eax, ax
push eax
lea ecx, [ecx*4 + 0x102]
push ecx
push edx
mov ecx, esi
call fcn.0048a640
mov eax, dword [ebp + 0x18]
movzx eax, word [eax + edi*2 + 2]
inc edi
test ax, ax
jne 0x4932b0
pop edi
pop ebx
mov dword [esi + 0x730], 0
pop esi
pop ebp
ret 0x18
test ecx, ecx
je 0x49331b
cmp ebx, 0x101
je case.0x49323f.258
cmp ebx, 0x105
je case.0x49323f.258
mov dword [esi + 0x730], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [esi + 0x10]
push ecx
push edi
push ebx
push edx
mov ecx, esi
call fcn.0048a640
pop edi
pop ebx
pop esi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
mov ecx, dword [esi + 0x10]
push eax
push edi
push ebx
push ecx
mov ecx, esi
call fcn.0048a640
pop edi
pop ebx
pop esi
pop ebp
ret 0x18
mov ecx, dword [0x52fe2c]
call fcn.0040b6e0
test al, al
jne case.0x49323f.258
mov ecx, dword [esi + 0x41f0]
call fcn.0047bd40
test al, al
je 0x493419
mov eax, dword [0x52fe30]
cmp byte [eax + 0x1252], 0
je 0x49338c
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x49338c
cmp word [ecx], 0
jne 0x4933fe
cmp byte [eax + 0x1253], 0
je case.0x49323f.258
cmp ebx, 0x100
je 0x4933ad
cmp ebx, 0x104
jne case.0x49323f.258
cmp edi, 0x10
je case.0x49323f.258
cmp edi, 0x11
je case.0x49323f.258
cmp edi, 0x12
je case.0x49323f.258
cmp edi, 0x5b
je case.0x49323f.258
cmp edi, 0x5c
je case.0x49323f.258
cmp edi, 0x5d
je case.0x49323f.258
mov ecx, dword [esi + 0x41f0]
push 0
call fcn.0047bd60
mov ecx, dword [0x52fe30]
xor edx, edx
test al, al
setne dl
add edx, 0x7d7
push edx
call fcn.00453860
test al, al
jne case.0x49323f.258
mov eax, dword [0x52fe30]
cmp byte [eax + 0x1252], 1
push 0
sete al
movzx ecx, al
push ecx
mov ecx, dword [esi + 0x41f0]
call fcn.00485820
mov ecx, esi
call fcn.00486bc0
cmp eax, 1
jne case.0x49323f.258
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push edx
push eax
push edi
push ebx
call fcn.0048edf0
pop edi
pop ebx
pop esi
pop ebp
ret 0x18