Function at 0x4eaa24
Capabilities:
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add eax, 0x5c
xor ecx, ecx
mov edx, 0xc
call fcn.004030d0
mov eax, dword [ebp - 4]
call fcn.004e6ce0
xor eax, eax
push ebp
push 0x4eb1d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4eb181
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov byte [ebp - 0xd], 0
test bl, bl
je 0x4eaae5
call sub.user32.dll_GetMessagePos
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00408590
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x15]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
call fcn.004e67dc
mov eax, dword [ebp - 0x11]
push eax
lea eax, [ebp - 0xd]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov ecx, dword [ebp - 0x15]
mov dl, byte [0x4eb1e8]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov eax, dword [ebp - 4]
call fcn.004ea1ec
test al, al
je 0x4eaadf
call fcn.0040439c
call fcn.0040439c
jmp 0x4eb1e0
mov byte [ebp - 0xd], 0
jmp 0x4eab14
cmp byte [ebp + 0x10], 0
je 0x4eab14
mov dl, byte [ebp + 0xc]
xor dl, 1
mov eax, dword [ebp - 4]
call fcn.004ea258
mov eax, dword [ebp - 4]
call fcn.004ea1ec
test al, al
je 0x4eab14
call fcn.0040439c
call fcn.0040439c
jmp 0x4eb1e0
call sub.user32.dll_GetActiveWindow
mov dword [ebp - 0xc], eax
jmp 0x4eb15c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x45]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4eab40
call sub.user32.dll_WaitMessage
jmp 0x4eb15c
mov eax, dword [ebp - 0x41]
sub eax, 0x201
je 0x4eab53
sub eax, 3
jne 0x4eac45
lea edx, [ebp - 0x15]
mov eax, dword [ebp - 0x39]
call fcn.00408590
lea eax, [ebp - 0x15]
push eax
mov eax, dword [ebp - 0x45]
push eax
call sub.user32.dll_ClientToScreen
lea eax, [ebp - 0x15]
mov dl, 1
call fcn.00470f40
mov ebx, eax
mov eax, ebx
mov edx, dword [0x4e2438]
call fcn.00403cb0
test al, al
je 0x4eab9e
mov edx, dword [ebx + 0x214]
mov eax, dword [ebp - 4]
call fcn.004e6c14
test al, al
jne 0x4eac45
mov eax, dword [ebp - 4]
cmp byte [eax + 0x70], 0
jne 0x4eabe8
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0xcc]
jne 0x4eabe8
lea ecx, [ebp - 0x50]
lea edx, [ebp - 0x15]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc]
call fcn.004722a0
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc]
mov ecx, dword [eax]
call dword [ecx + 0x44]
lea eax, [ebp - 0x64]
pop edx
call fcn.00407200
test al, al
jne 0x4eabf7
call fcn.0040439c
call fcn.0040439c
jmp 0x4eb1e0
cmp dword [ebp - 0x41], 0x201
jne 0x4eac45
push ebp
lea eax, [ebp - 0x15]
mov dl, 1
call fcn.004ea690
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xac], 0
je 0x4eac36
mov eax, dword [ebp - 4]
cmp byte [eax + 0x88], 0
je 0x4eac36
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov eax, dword [eax + 0x1c]
test byte [eax + 0x64], 0x10
je 0x4eac45
call fcn.0040439c
call fcn.0040439c
jmp 0x4eb1e0
push 3
mov esi, dword [ebp - 0x41]
push esi
push esi
push 0
lea eax, [ebp - 0x45]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4eb15c
mov eax, dword [ebp - 0x41]
cmp eax, 0x113
jg 0x4eac90
je 0x4eae2e
sub eax, 0x4d
je case.0x4eaeaa.512
sub eax, 0x2e
je case.0x4eaeaa.512
add eax, 0xffffff7b
sub eax, 9
jb 0x4eacae
jmp 0x4eb0fa
sub eax, 0x118
je case.0x4eaeaa.512
add eax, 0xffffff18
sub eax, 0xb
jb 0x4eae93
jmp 0x4eb0fa
mov eax, dword [0x5693cc]
mov eax, dword [eax]
call fcn.0049dc58
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4eacdc
cmp byte [ebp + 8], 0
je 0x4eacd8
push 2
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4eacdc
xor eax, eax
jmp 0x4eacde
mov al, 1
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 0x41]
sub eax, 0x100
je 0x4ead03
sub eax, 2
je 0x4ead77
sub eax, 2
je 0x4ead03
sub eax, 2
je 0x4ead77
jmp case.0x4eaeaa.512
cmp dword [ebp - 0x3d], 0xe5
jne 0x4ead18
mov eax, dword [ebp - 0x45]
push eax
call sub.imm32.dll_ImmGetVirtualKey
mov dword [ebp - 0x3d], eax
cmp byte [ebp - 0x1e], 0
je 0x4ead28
cmp dword [ebp - 0x3d], 0x70
jne case.0x4eaeaa.512
mov ax, word [ebp - 0x3d]
mov word [ebp - 0x20], ax
push ebp
mov eax, dword [ebp - 0x39]
call fcn.00493c1c
push eax
push ebp
call fcn.004ea674
pop ecx
lea edx, [ebp - 0x20]
pop ecx
call fcn.004ea790
pop ecx
test al, al
je 0x4ead5e
call fcn.0040439c
call fcn.0040439c
jmp 0x4eb1e0
cmp word [ebp - 0x20], 0
je case.0x4eaeaa.512
lea eax, [ebp - 0x45]
push eax
call sub.user32.dll_TranslateMessage
jmp case.0x4eaeaa.512
cmp byte [ebp - 0x1e], 0
jne case.0x4eaeaa.512
push ebp
call fcn.004ea674
pop ecx
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x1d]
push eax
mov ecx, dword [ebp - 0x3d]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0xac]
mov eax, dword [ebp - 0x1c]
call fcn.004e9c00
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4eae02
mov eax, dword [ebp - 0x3d]
sub eax, 0x20
je 0x4eadbb
sub eax, 0xd
jne 0x4eadf6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x70], 0
jne 0x4eadf6
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 4]
jne 0x4eadf6
call sub.user32.dll_GetActiveWindow
test eax, eax
je 0x4eadf6
call sub.user32.dll_GetActiveWindow
mov edx, eax
mov ecx, dword [ebp - 0x3d]
mov eax, dword [ebp - 4]
call fcn.004ea240
call fcn.0040439c
call fcn.0040439c
jmp 0x4eb1e0
push 0
call sub.user32.dll_MessageBeep
jmp case.0x4eaeaa.512
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
call fcn.004e7760
mov eax, dword [ebp - 0x1c]
call fcn.004ea390
cmp byte [ebp - 0x1d], 0
je case.0x4eaeaa.512
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004ea258
jmp case.0x4eaeaa.512
mov eax, dword [ebp - 0x45]
call fcn.0046f504
mov ebx, eax
test ebx, ebx
je 0x4eae85
mov eax, ebx
mov edx, dword [0x4e2438]
call fcn.00403cb0
test al, al
je 0x4eae85
cmp dword [ebp - 0x3d], 0x2328
jl 0x4eae85
cmp dword [ebp - 0x3d], 0x232b
jg 0x4eae85
cmp dword [ebx + 0x214], 0
je case.0x4eaeaa.512
mov edx, dword [ebp - 0x3d]
sub edx, 0x2328
mov eax, dword [ebx + 0x214]
call fcn.004ea9b4
jmp case.0x4eaeaa.512
lea eax, [ebp - 0x45]
push eax
call sub.user32.dll_DispatchMessageA
jmp case.0x4eaeaa.512
mov eax, dword [ebp - 0x41]
add eax, 0xfffffe00
cmp eax, 0xa
ja case.0x4eaeaa.512
mov al, byte [eax + 0x4eaeb1]
jmp dword [eax*4 + 0x4eaebc]
mov eax, dword [ebp - 0x31]
cmp eax, dword [0x56f618]
jne 0x4eaee6
mov eax, dword [ebp - 0x2d]
cmp eax, dword [0x56f61c]
je 0x4eaeff
mov eax, dword [ebp - 0x31]
mov dword [0x56f618], eax
mov eax, dword [ebp - 0x2d]
mov dword [0x56f61c], eax
push ebp
call fcn.004ea834
pop ecx
push ebp
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.004ea6e4
pop ecx
test al, al
je case.0x4eaeaa.512
lea ecx, [ebp - 0x15]
lea edx, [ebp - 0x31]
mov eax, dword [ebp - 0x28]
call fcn.004e67dc
mov ecx, dword [ebp - 0x11]
mov edx, dword [ebp - 0x15]
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
jmp case.0x4eaeaa.512
mov byte [ebp - 0x29], 0
push ebp
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.004ea6e4
pop ecx
test al, al
je 0x4eaf6f
lea ecx, [ebp - 0x15]
lea edx, [ebp - 0x31]
mov eax, dword [ebp - 0x28]
call fcn.004e67dc
mov eax, dword [ebp - 0x11]
push eax
lea eax, [ebp - 0x29]
push eax
movsx edx, word [ebp - 0x3b]
mov ecx, dword [ebp - 0x15]
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x40]
cmp byte [ebp - 0x29], 0
jne case.0x4eaeaa.512
cmp dword [ebp - 0x1c], 0
je case.0x4eaeaa.512
lea edx, [ebp - 0x15]
mov eax, dword [ebp - 0x39]
call fcn.00408590
lea eax, [ebp - 0x15]
push eax
mov eax, dword [ebp - 0x45]
push eax
call sub.user32.dll_ScreenToClient
mov eax, dword [ebp - 0x11]
push eax
movsx edx, word [ebp - 0x3b]
mov ecx, dword [ebp - 0x15]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0x4c]
jmp case.0x4eaeaa.512
cmp dword [ebp - 0x41], 0x204
setne al
or al, byte [ebp + 8]
je case.0x4eaeaa.512
mov eax, dword [0x5693cc]
mov eax, dword [eax]
call fcn.0049dc58
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
and byte [eax + 0xb3], 0xef
push ebp
lea eax, [ebp - 0x31]
mov dl, 1
call fcn.004ea690
pop ecx
push ebp
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.004ea6e4
pop ecx
test al, al
je case.0x4eaeaa.512
cmp dword [ebp - 0x41], 0x203
je 0x4eb014
mov al, byte [0x4eb1e8]
mov byte [ebp - 0x21], al
jmp 0x4eb01c
mov al, byte [0x4eb1ec]
mov byte [ebp - 0x21], al
lea ecx, [ebp - 0x15]
lea edx, [ebp - 0x31]
mov eax, dword [ebp - 0x28]
call fcn.004e67dc
mov eax, dword [ebp - 0x11]
push eax
lea eax, [ebp - 0xd]
push eax
mov ecx, dword [ebp - 0x15]
mov dl, byte [ebp - 0x21]
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x34]
call sub.user32.dll_GetMessagePos
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00408590
mov eax, dword [ebp - 0x50]
mov dword [0x56f618], eax
mov eax, dword [ebp - 0x4c]
mov dword [0x56f61c], eax
jmp case.0x4eaeaa.512
cmp dword [ebp - 0x41], 0x202
sete al
or al, byte [ebp + 8]
je case.0x4eaeaa.512
push ebp
lea eax, [ebp - 0x31]
xor edx, edx
call fcn.004ea690
pop ecx
push ebp
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.004ea6e4
pop ecx
test al, al
jne 0x4eb0d8
cmp dword [ebp - 0x1c], 0
je 0x4eb0b1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 4]
jne case.0x4eaeaa.512
mov eax, dword [ebp - 4]
cmp byte [eax + 0x71], 0
je case.0x4eaeaa.512
mov eax, dword [ebp - 4]
test byte [eax + 0xb3], 0x10
jne 0x4eb0cc
call fcn.0040439c
call fcn.0040439c
jmp 0x4eb1e0
mov eax, dword [ebp - 4]
and byte [eax + 0xb3], 0xef
jmp case.0x4eaeaa.512
lea ecx, [ebp - 0x15]
lea edx, [ebp - 0x31]
mov eax, dword [ebp - 0x28]
call fcn.004e67dc
mov al, byte [ebp - 0xd]
push eax
mov ecx, dword [ebp - 0x11]
mov edx, dword [ebp - 0x15]
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
jmp case.0x4eaeaa.512
lea eax, [ebp - 0x45]
push eax
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004ea758
pop ecx
test al, al
jne 0x4eb11d
call fcn.0040439c
call fcn.0040439c
jmp 0x4eb1e0
cmp dword [0x56f618], 0x80000000
jne 0x4eb155
call sub.user32.dll_GetMessagePos
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00408590
mov eax, dword [ebp - 0x50]
mov dword [0x56f618], eax
mov eax, dword [ebp - 0x4c]
mov dword [0x56f61c], eax
push ebp
call fcn.004ea834
pop ecx
push ebp
call fcn.004ea928
pop ecx
push ebp
call fcn.004ea758
pop ecx
test al, al
jne 0x4eab21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb188
mov eax, dword [ebp - 4]
call fcn.004e9e90
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc