Function at 0x486050
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d89c8
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
mov ebx, ecx
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp + 0x14]
push ecx
lea edx, [ebp + 0x10]
push edx
mov ecx, ebx
call fcn.0047dc30
test al, al
jne 0x486099
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
push esi
push edi
mov ecx, ebx
mov dword [ebx + 0x1a08], eax
call fcn.0047c3f0
mov esi, dword [ebp + 8]
xor edi, edi
mov byte [ebp - 0xd], al
test al, al
je 0x4861e2
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x124a], 0
je 0x4861e2
cmp dword [ebx + 0x1ac0], edi
setne al
test al, al
jne 0x4861e2
mov ecx, dword [0x52fe2c]
push 1
call fcn.0040c890
test eax, eax
jne 0x4861e2
cmp esi, 0x201
jne 0x486127
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push edx
push eax
call fcn.00425060
add esp, 8
mov dword [ebx + 0x1ae0], eax
mov dword [ebx + 0x1ae4], edx
mov dword [ebx + 0x1adc], 1
jmp 0x4861e8
cmp dword [ebx + 0x1adc], edi
je 0x4861e8
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x4861e2
cmp esi, 0x200
jne 0x4861e8
mov ecx, dword [0x52fe34]
call fcn.0045c5a0
mov ecx, dword [0x52fe34]
mov edi, eax
call fcn.0045c5c0
cmp edi, eax
jg 0x486178
mov edi, eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebx + 0x1ae0]
mov ecx, dword [ebp + 0x14]
sub ecx, dword [ebx + 0x1ae4]
test eax, eax
jge 0x486190
neg eax
cmp eax, edi
jl 0x48619b
mov edi, 0x200
jmp 0x4861aa
test ecx, ecx
jge 0x4861a1
neg ecx
cmp ecx, edi
jl 0x4861e8
mov edi, 0x100
mov ecx, dword [0x52fe2c]
push edi
call fcn.0040c980
mov eax, dword [ebx + 0x1ae4]
mov ecx, dword [ebx + 0x1ae0]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
and edi, 0x300
or dword [ebx + 0x1ac0], edi
push 0x201
mov ecx, ebx
call fcn.00485c00
jmp 0x4861e8
mov dword [ebx + 0x1adc], edi
cmp byte [ebp - 0xd], 0
je 0x48636b
cmp esi, 0x201
jne 0x486227
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
push esi
mov ecx, ebx
call fcn.00485c00
test al, al
je 0x48624d
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
cmp esi, 0x200
jne 0x48624d
cmp dword [ebx + 0x1ac0], 0
jne 0x48624d
mov ecx, dword [0x52fe2c]
push 0
call fcn.0040c890
test eax, eax
jne 0x486945
mov edx, dword [0x52fe30]
mov al, byte [edx + 0x1259]
cmp al, 2
je 0x48626f
cmp al, 3
jne 0x4862cf
cmp dword [ebx + 0x1ac0], 0
setne al
test al, al
jne 0x4862cf
cmp esi, 0x204
je 0x48627f
cmp esi, 0x205
jne 0x4862cf
cmp byte [edx + 0x1258], 2
jne 0x4862a6
mov ecx, dword [ebx + 0x50]
call fcn.00486ee0
test eax, eax
je 0x4862a0
mov ecx, dword [ebx + 0x50]
call fcn.004890d0
test al, al
je 0x4862c1
mov edx, dword [0x52fe30]
cmp byte [edx + 0x1258], 1
jne 0x4862cf
push 1
push 0x7d9
mov ecx, edx
call fcn.00453860
test al, al
je 0x4862c9
cmp esi, 0x205
jmp 0x486344
mov edx, dword [0x52fe30]
mov al, byte [edx + 0x125a]
cmp al, 2
je 0x4862ec
cmp al, 3
jne 0x48636b
mov ecx, ebx
call fcn.0047bd40
test al, al
jne 0x48636b
cmp esi, 0x207
je 0x4862fc
cmp esi, 0x208
jne 0x48636b
cmp byte [edx + 0x1258], 2
jne 0x486323
mov ecx, dword [ebx + 0x50]
call fcn.00486ee0
test eax, eax
je 0x48631d
mov ecx, dword [ebx + 0x50]
call fcn.004890d0
test al, al
je 0x48633e
mov edx, dword [0x52fe30]
cmp byte [edx + 0x1258], 1
jne 0x48636b
push 1
push 0x7d9
mov ecx, edx
call fcn.00453860
test al, al
je 0x48636b
cmp esi, 0x208
jne 0x486356
mov ecx, dword [ebx + 0x50]
push 0
push 0
push 0
push 0
call fcn.00490660
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
xor edi, edi
cmp dword [ebx + 0x1ac0], edi
jne 0x4863b8
mov ecx, dword [ebx + 0x50]
push edi
call fcn.0048b370
test al, al
je 0x4863b8
cmp esi, 0x200
je 0x4863a2
cmp esi, 0x201
je 0x4863a2
cmp esi, 0x202
je 0x4863a2
cmp esi, 0x203
jne 0x4863b8
mov eax, dword [ebp + 0x18]
push 1
push eax
push esi
mov ecx, ebx
call fcn.00481020
test al, al
jne 0x486945
mov ecx, dword [ebx + 0x50]
call fcn.004890d0
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x123a], 0
mov byte [ebp - 0xd], al
jne 0x4863e2
mov ecx, dword [ebx + 0x50]
call fcn.00489120
mov byte [ebp + 0xb], 1
test al, al
jne 0x4863e6
mov byte [ebp + 0xb], 0
xor al, al
cmp esi, 0x20a
je 0x4863f8
cmp esi, 0x20e
jne 0x486424
cmp dword [ebx + 0x1b5c], edi
je 0x486529
cmp dword [ebx], 1
jne 0x486424
cmp byte [ebp - 0xd], 0
je 0x486424
cmp byte [ebp + 0xb], 0
je 0x486424
mov edx, dword [ebx + 0x50]
mov ecx, dword [edx]
push 1
add ecx, 8
call fcn.004b3880
cmp dword [ebx + 0x1b5c], edi
je 0x486529
cmp dword [ebx], 1
jne 0x486468
cmp byte [ebp - 0xd], 0
je 0x486468
cmp byte [ebp + 0xb], 0
je 0x486468
test al, al
jne 0x486468
cmp esi, 0x20a
je 0x486459
cmp esi, 0x20e
jne 0x486529
mov ecx, ebx
call fcn.0047bd40
test al, al
je 0x486529
cmp esi, 0x20a
jne 0x48651e
mov esi, dword [ebp + 0xc]
shr esi, 0x10
push 0x11
mov dword [ebp + 0x14], esi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
xor ecx, ecx
cmp ax, dx
sete cl
cmp byte [ebp + 0x1c], 0
mov edi, ecx
je 0x4864a6
mov eax, 1
jmp 0x4864c5
mov esi, dword [0x52fe2c]
add esi, 0x4148
cmp dword [esi + 0x68], 0
jne 0x4864bf
mov ecx, esi
call fcn.00408880
mov eax, dword [esi + 0x68]
mov esi, dword [ebp + 0x14]
test si, si
jle 0x4864f1
neg edi
push eax
sbb edi, edi
push 0xffffffffffffffff
and edi, 2
push edi
mov ecx, ebx
call fcn.0047d190
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
jge 0x486509
xor edx, edx
test edi, edi
setne dl
push eax
push 0xffffffffffffffff
mov ecx, ebx
lea edx, [edx + edx + 1]
push edx
call fcn.0047d190
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, ebx
call fcn.0047bd00
test al, al
je 0x4865a2
cmp dword [ebx + 0x1ac0], edi
je 0x48655a
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
push esi
mov ecx, ebx
call fcn.00485c00
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
cmp dword [ebx], 1
jne 0x486594
mov eax, dword [0x52fe30]
cmp byte [eax + 0x11291], 0
je 0x486594
cmp esi, 0x204
jne 0x4865bd
mov eax, dword [ebx + 0x1b48]
movsx ecx, word [ebp + 0x1a]
dec eax
cmp ecx, eax
jne 0x486594
mov ecx, dword [ebx + 0x50]
call fcn.0048caf0
test al, al
jne 0x486791
cmp dword [ebx + 0x1b7c], edi
je 0x4865a2
mov dword [ebx + 0x1b7c], edi
xor eax, eax
cmp dword [ebx], 1
pop edi
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
cmp esi, 0x200
je 0x4865cd
cmp esi, 0x205
jne 0x486594
cmp dword [ebx + 0x1b7c], edi
je 0x4865a2
cmp esi, 0x205
jne 0x486939
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp + 0x1c], eax
xor esi, esi
lea esp, [esp]
xor ecx, ecx
test byte [esi*4 + 0x4fdd38], 8
mov word [ebp - 0x134], cx
je 0x486619
push str.Ctrl_
push 0x80
lea edx, [ebp - 0x134]
push edx
call fcn.004017b0
test byte [esi*4 + 0x4fdd38], 2
je 0x486639
push str.Alt_
push 0x80
lea eax, [ebp - 0x134]
push eax
call fcn.004017b0
test byte [esi*4 + 0x4fdd38], 4
je 0x486659
push str.RCtrl_
push 0x80
lea ecx, [ebp - 0x134]
push ecx
call fcn.004017b0
test byte [esi*4 + 0x4fdd38], 1
je 0x486679
push str.RAlt_
push 0x80
lea edx, [ebp - 0x134]
push edx
call fcn.004017b0
test byte [esi*4 + 0x4fdd38], 0x10
je 0x486699
push str.Shift_
push 0x80
lea eax, [ebp - 0x134]
push eax
call fcn.004017b0
mov ecx, dword [ebx + 0x1b8c]
sub ecx, 0x6f
push ecx
push 0x4ff924
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x134]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, esi
and dl, 3
add esp, 0xc
movzx eax, dl
neg eax
sbb eax, eax
lea ecx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp + 0x1c]
and eax, 0xffffffc0
lea edi, [esi + 1]
push edi
add eax, 0x40
push eax
push ecx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov esi, edi
cmp esi, 0xc
jb 0x4865f0
mov eax, dword [ebx + 0x1b84]
mov ecx, dword [ebx + 0x1b88]
mov edi, dword [ebp + 0x1c]
lea edx, [eax - 1]
mov dword [ebp - 0x2c], edx
lea edx, [ecx - 1]
mov dword [ebp - 0x28], edx
lea edx, [eax + 1]
mov dword [ebp - 0x24], edx
lea edx, [ecx + 1]
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x2c]
push edx
mov edx, dword [0x52fe14]
push edx
push ecx
push eax
mov eax, dword [0x52fe2c]
mov ecx, dword [eax + 0x409c]
push 0x122
push edi
push 5
call fcn.00448420
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
lea ecx, [esi - 1]
cmp ecx, 0xb
ja 0x486772
mov edx, dword [esi*4 + 0x4fdd34]
movzx eax, word [ebx + 0x1b8c]
mov ecx, dword [ebx + 0x50]
push 0xffffffffffffffff
push 0
push edx
push eax
call fcn.00491f40
pop edi
pop esi
mov dword [ebx + 0x1b7c], 0
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x1c]
call fcn.004c6b20
lea edx, [ebp - 0x1c]
push edx
movsx edx, word [ebp + 0x1a]
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp + 0x1c]
push ecx
push edx
mov ecx, ebx
mov dword [ebp - 4], edi
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x10], edi
call fcn.0047be10
test eax, eax
je 0x486893
mov edx, dword [ebp + 0x1c]
cmp word [edx], 0x31
jne 0x486893
xor esi, esi
cmp dword [ebp + 0x10], 1
mov dword [ebp + 0x14], esi
lea edi, [esi + 2]
jle 0x486893
xor ecx, ecx
mov dword [ebp + 0x1c], 0xfffffff8
add edx, 4
jmp 0x4867f3
mov esi, dword [ebp + 0x14]
movzx eax, word [edx - 2]
cmp ax, 0x30
jb 0x486883
cmp ax, 0x39
ja 0x486883
cmp edi, 9
jg 0x48683a
movzx eax, ax
sub eax, 0x30
cmp eax, edi
jne 0x486883
cmp word [edx - 4], 0x20
jne 0x486883
movzx eax, word [edx]
cmp ax, 0x30
jb 0x48682c
cmp ax, 0x39
jbe 0x486883
movsx eax, word [ebp + 0x18]
cmp eax, ecx
jg 0x48687c
cmp eax, esi
jge 0x4868a8
jmp 0x48687c
mov esi, dword [ebp + 0x1c]
cmp esi, 2
jg 0x48692b
cmp ax, 0x31
jne 0x486883
movzx eax, word [edx]
sub eax, 0x30
cmp eax, esi
jne 0x486883
cmp word [edx - 4], 0x20
jne 0x486883
movzx eax, word [edx + 2]
cmp ax, 0x30
jb 0x48686d
cmp ax, 0x39
jbe 0x486883
movsx eax, word [ebp + 0x18]
cmp eax, ecx
jg 0x48687c
mov esi, dword [ebp + 0x14]
cmp eax, esi
jge 0x4868a7
inc edi
inc dword [ebp + 0x1c]
mov dword [ebp + 0x14], ecx
inc ecx
lea eax, [ecx + 1]
add edx, 2
cmp eax, dword [ebp + 0x10]
jl 0x4867f0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.004c75e0
jmp 0x4865a2
inc esi
add edi, 0x6e
test edi, edi
je 0x486893
mov ecx, dword [ebp + 0x18]
mov dword [ebx + 0x1b7c], 1
mov dword [ebx + 0x1b80], ecx
lea eax, [esi + 1]
cmp edi, 0x70
je 0x4868cd
lea eax, [esi + 2]
movsx edx, word [ebp + 0x1a]
mov ecx, dword [ebx + 0x50]
mov ecx, dword [ecx]
push edx
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004bf300
mov edx, dword [eax]
lea ecx, [ebx + 0x1b84]
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
push ecx
mov ecx, dword [ebx + 0x50]
call fcn.00488d00
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
lea ecx, [ebp - 0x1c]
mov dword [ebx + 0x1b8c], edi
mov dword [ebp - 4], 0xffffffff
call fcn.004c75e0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
mov esi, dword [ebp + 0x14]
inc esi
mov edi, 0x7b
jmp 0x4868af
cmp esi, 0x200
jne 0x4865a2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18