Function at 0x45e2b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4c75d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x4ed528]
cmp dword [eax + 4], 0
push ebx
push esi
mov dword [ebp - 0x1c], 0
je 0x45e491
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
lea ecx, [ebp - 0x18]
push ecx
push eax
push eax
push 0x188
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call esi
push eax
push 0x198
push edi
call esi
mov ecx, dword [0x4ed528]
mov eax, dword [ecx + 4]
cmp dword [eax + 0x14], 0x63
jne 0x45e343
mov edx, dword [ebp + 8]
cmp edx, 0x27
jne 0x45e322
cmp dword [eax + 0x18], 0
jne 0x45e32d
jmp 0x45e343
cmp edx, 0x25
jne 0x45e343
cmp dword [eax + 0x18], 0
jne 0x45e343
push eax
call fcn.0045be20
mov ecx, dword [0x4ed528]
add esp, 4
mov dword [ebp - 0x1c], 1
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x14]
mov ebx, dword [ebp + 8]
cmp eax, 8
jne 0x45e3f3
cmp ebx, 0x20
je 0x45e35f
cmp ebx, 0xd
jne 0x45e3c8
mov edx, dword [edx + 8]
mov esi, dword [sym.imp.MSVCR100.dll__mbsicmp]
push str.TTFTFTTFT
push edx
call esi
add esp, 8
test eax, eax
jne 0x45e48b
mov edx, dword [0x4ed528]
mov eax, dword [edx + 4]
mov eax, dword [eax + 0x10]
push 0x4b8048
push eax
call esi
add esp, 8
test eax, eax
mov eax, 0x4b804c
je 0x45e3a0
mov eax, 0x4b8050
mov ecx, dword [0x4ed528]
mov edx, dword [ecx + 4]
push 0x105
mov dword [edx + 0x10], eax
push 0
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.USER32.dll_RedrawWindow]
call fcn.00458840
jmp 0x45e48b
cmp eax, 8
jne 0x45e3f3
cmp ebx, 0x1b
jne 0x45e3f0
mov dword [edx + 8], 0x4b8054
push 0x105
push 0
lea ecx, [ebp - 0x18]
push ecx
push edi
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x45e48b
cmp eax, 8
mov ebx, dword [sym.imp.MSVCR100.dll__mbsicmp]
jne 0x45e422
mov eax, dword [ebp + 8]
add eax, 0xffffffdb
cmp eax, 3
ja 0x45e422
mov edx, dword [edx + 8]
push 0x4b8058
push edx
call ebx
add esp, 8
test eax, eax
je 0x45e4bc
mov ecx, dword [0x4ed528]
mov eax, dword [ebp + 8]
cmp eax, 9
jne 0x45e5dd
mov edx, dword [ecx + 4]
cmp dword [edx + 0x14], 4
mov eax, dword [ecx + 0x24]
jne 0x45e43f
add eax, 0x15
jmp 0x45e440
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + 0x14]
cmp edx, 0x63
ja case.0x45e459.4
movzx edx, byte [edx + 0x45e658]
jmp dword [edx*4 + 0x45e63c]
call fcn.00459250
jmp 0x45e48b
mov edx, dword [ebp - 0x10]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, edi
call fcn.0045e210
add esp, 0x14
cmp dword [ebp - 0x1c], 0
jne 0x45e4bc
movzx ecx, word [ebp + 0x10]
movzx edx, word [ebp + 0xc]
mov eax, dword [ebp + 8]
shl ecx, 0x10
or ecx, edx
push ecx
push eax
push 0x100
push edi
push 0x4b7bec
push edi
call dword [sym.imp.USER32.dll_GetPropA]
push eax
call dword [sym.imp.USER32.dll_CallWindowProcA]
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042dbe7
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 8], eax
mov eax, edi
mov dword [ecx + 0xc], edx
call fcn.0045dad0
jmp 0x45e488
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
mov esi, ecx
mov ecx, edi
mov dword [edx + 0xc], eax
call fcn.0045e110
add esp, 0x10
jmp 0x45e48b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x45e548
movzx edx, word [ebp + 0x10]
movzx eax, word [ebp + 0xc]
shl edx, 0x10
or edx, eax
push edx
push 0x1b
push 0x100
push edi
call esi
jmp 0x45e3d9
mov ecx, dword [0x4ed528]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 8]
push 0x4b805c
push eax
call ebx
add esp, 8
test eax, eax
jne 0x45e57c
mov eax, dword [0x4ed528]
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0x4b8060
call fcn.00459250
jmp 0x45e3d9
mov edx, dword [0x4ed528]
mov eax, dword [edx + 4]
mov dword [eax + 8], 0x4b8064
jmp 0x45e3d9
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov edx, edi
call fcn.0045ddd0
add esp, 0x10
jmp 0x45e48b
mov edx, dword [ebp - 0x14]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 8], eax
push edi
mov dword [ecx + 0xc], edx
call fcn.0045cc40
jmp 0x45e488
cmp eax, 0x21
jne 0x45e60a
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push 0x24
push 0x100
push edi
call esi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042dbe7
mov esp, ebp
pop ebp
ret
cmp eax, 0x22
jne 0x45e48b
movzx edx, word [ebp + 0x10]
movzx eax, word [ebp + 0xc]
shl edx, 0x10
or edx, eax
push edx
push 0x23
push 0x100
push edi
call esi
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dbe7
mov esp, ebp
pop ebp
ret