Function at 0x4f9ddf
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
sub esp, 0x1c
push 0x74
mov eax, 0x6371bf
call fcn.0058c0ed
mov esi, ecx
cmp byte [ebp + 0x28], 0
je 0x4f9e0a
mov eax, dword [esi + 0x1d4]
cmp byte [eax + 0x20], 0
jne 0x4f9e0a
xor al, al
jmp 0x4fa164
push 0xfffffffffffffff0
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0x10000000
mov dword [ebp], eax
je 0x4f9e2b
xor ebx, ebx
push ebx
mov ecx, esi
call fcn.0055c063
jmp 0x4f9e2d
xor ebx, ebx
mov eax, dword [esi + 0x334]
cmp byte [eax + 0xce1], 0
mov byte [ebp + 0x1f], 0
je 0x4f9f36
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setl al
test al, al
je 0x4f9e72
mov eax, 0xffff0001
mov dword [esi + 0x328], eax
mov dword [esi + 0x32c], eax
mov dword [esi + 0x330], eax
jmp 0x4f9f36
cmp dword [esi + 0x328], 0xffff0001
jne 0x4f9eae
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.004f179d
mov eax, dword [ebp + 4]
mov dword [esi + 0x328], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x32c], eax
mov eax, dword [esi + 0x1a8]
sub eax, ebx
jne 0x4f9f12
mov ecx, esi
call fcn.004f17ed
jmp 0x4f9e67
cmp byte [ebp + 0x28], 0
mov byte [ebp + 0x1f], 1
je 0x4f9f36
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.004f179d
mov ecx, esi
call fcn.004f17ed
push 1
push dword [esi + 0x32c]
mov ecx, esi
push dword [esi + 0x328]
mov edi, eax
call fcn.004f1729
mov ecx, esi
call fcn.004f7c77
push eax
push dword [esi + 0x330]
mov ecx, esi
call fcn.004f995f
mov eax, dword [ebp + 4]
mov dword [esi + 0x328], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x32c], eax
mov eax, dword [esi + 0x1a8]
sub eax, ebx
je 0x4f9f30
dec eax
je 0x4f9f24
dec eax
jne 0x4f9f36
mov dword [esi + 0x330], 0xffffff9d
jmp 0x4f9f36
mov dword [esi + 0x330], 0xffffff9e
jmp 0x4f9f36
mov dword [esi + 0x330], edi
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0xa4]
call edi
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x20]
call edi
lea ecx, [ebp - 0x80]
call fcn.0040d212
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.004f5b39
cmp byte [ebp + 0x28], 0
je 0x4f9fe8
mov ecx, esi
call fcn.004f7c77
cmp byte [esi + 0x238], 0
mov ecx, dword [esi + 0x1d4]
mov dword [esi + 0x1f8], eax
lea eax, [ebp - 0x80]
push eax
je 0x4f9fb1
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
call fcn.004dc018
mov ecx, dword [ebp + 0x18]
push edi
push ebx
sub ecx, eax
push ecx
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetRect]
xor ebx, ebx
jmp 0x4f9fcd
call fcn.004dc018
add eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetRect]
lea edi, [esi + 0x84]
mov ecx, edi
call fcn.0049f0e4
push 1
push ebx
push ebx
mov eax, 0xffffd8f0
push eax
mov ecx, edi
jmp 0x4fa05d
cmp byte [esi + 0x238], 0
je 0x4fa003
push dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
sub eax, dword [esi + 0x1f8]
push dword [ebp + 0x14]
push eax
jmp 0x4fa013
mov eax, dword [esi + 0x1f8]
add eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetRect]
cmp byte [esi + 0x1d9], 0
jne 0x4fa034
lea ecx, [esi + 0x84]
call fcn.0049f102
mov ecx, dword [esi + 0x1d4]
push 1
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
call fcn.004dbfdc
mov ecx, dword [esi + 0x1d4]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004dbffa
lea ecx, [esi + 0x84]
push eax
push 0x6c19b8
call fcn.0055c39a
push 1
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.00409ee9
cmp byte [ebp + 0x1f], 0
je 0x4fa0fa
cmp byte [ebp + 0x28], 0
jne 0x4fa0fa
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.004f179d
mov ecx, esi
call fcn.004f17ed
push 1
push dword [esi + 0x32c]
mov ecx, esi
push dword [esi + 0x328]
mov edi, eax
mov byte [esi + 0x190], 0
call fcn.004f1729
mov eax, dword [esi + 0x330]
mov ecx, esi
cmp eax, 0xffffff9d
je 0x4fa0db
cmp eax, 0xffffff9e
je 0x4fa0d8
call fcn.004f7c77
push eax
push dword [esi + 0x330]
mov ecx, esi
call fcn.004f995f
jmp 0x4fa0e2
push ebx
jmp 0x4fa0dd
push 1
call fcn.004f9a49
mov eax, dword [ebp + 4]
mov dword [esi + 0x328], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x32c], eax
mov dword [esi + 0x330], edi
cmp dword [ebp], ebx
je 0x4fa108
push 1
mov ecx, esi
call fcn.0055c063
mov al, byte [ebp + 0x28]
mov ecx, esi
mov byte [esi + 0x190], al
call fcn.004f7d2e
mov ecx, esi
call fcn.004f0a1f
mov ecx, dword [esi + 0x334]
call fcn.00409c36
mov ecx, esi
call fcn.004fbc73
cmp byte [ebp + 0x28], 0
push esi
push ecx
mov ecx, esp
mov dword [ebp + 0x28], esp
je 0x4fa145
push str.517_desktop_sticky_rolled
jmp 0x4fa14a
push str.517_desktop_sticky_unrolled
call fcn.00402035
mov ecx, dword [esi + 0x334]
call fcn.0040c8a2
lea ecx, [ebp - 0x80]
call fcn.0040c7d6
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x20
leave
ret 4