Function at 0x4be194
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x4c]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4be9f2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x50cc54]
mov eax, dword [eax]
xor edx, edx
call fcn.0045ca4c
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x30]
xor edx, edx
xor eax, eax
call fcn.004157c0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
push 0
push 0x32
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004ba9f0
test eax, eax
jle 0x4be2c7
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004ba9f0
mov edx, eax
dec edx
mov eax, ebx
call fcn.004ba9f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x4be2b3
mov eax, esi
call fcn.004ba9f0
cmp ebx, eax
jge 0x4be2b3
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.004ba9f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x4be29f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004ba9f0
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x4be29f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.004ba9f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4be2b3
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004bd72c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x4be2dd
mov eax, ebx
call fcn.00444694
call fcn.004761a0
mov byte [ebp - 6], 1
jmp 0x4be9af
cmp byte [ebp - 6], 0
jne 0x4be2f1
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4be98e
mov eax, dword [edi + 4]
cmp eax, 0x113
jg 0x4be329
je 0x4be429
sub eax, 0x12
je 0x4be41d
sub eax, 0x34
je 0x4be33a
add eax, 0xffffffa5
sub eax, 9
jb 0x4be41d
jmp 0x4be4aa
sub eax, 0x201
je 0x4be34b
sub eax, 3
je 0x4be34b
jmp 0x4be4aa
push ebp
call fcn.004be140
pop ecx
call fcn.00404098
jmp 0x4be9f9
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407af4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043daec
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4be3ca
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4be3ca
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00444694
push eax
call sub.user32.dll_PostMessageA
jmp 0x4be4aa
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4be3fc
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.0043daec
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4be3f9
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x4be404
test bl, bl
je 0x4be3d1
test bl, bl
jne 0x4be4aa
push ebp
call fcn.004be140
pop ecx
call fcn.00404098
jmp 0x4be9f9
push ebp
call fcn.004be140
pop ecx
jmp 0x4be98e
cmp dword [edi], 0
jne 0x4be4aa
add dword [ebp - 0x1c], 0x32
lea edx, [ebp - 0x28]
mov eax, dword [0x50cc0c]
mov eax, dword [eax]
call fcn.00448e34
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jne 0x4be499
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jne 0x4be499
cmp dword [ebp - 0x1c], 0x1f4
jl 0x4be49e
mov esi, dword [ebp - 4]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea edx, [ebp - 0x64]
mov eax, dword [esi + 0x3c]
call fcn.0043d948
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4be492
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.00444694
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4be49e
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4be98e
mov eax, dword [edi + 4]
sub eax, 0x7b
je 0x4be98e
add eax, 0xffffff7b
sub eax, 9
jb 0x4be4fc
add eax, 0xffffff09
sub eax, 0xb
jb 0x4be7bd
sub eax, 0x264
jne 0x4be988
mov eax, dword [ebp - 4]
call fcn.004bddf0
jmp 0x4be98e
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4be98e
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4be532
sub eax, 2
je 0x4be764
sub eax, 2
je 0x4be532
sub eax, 2
je 0x4be764
jmp 0x4be98e
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4be575
je 0x4be627
cmp eax, 0x12
jg 0x4be55e
je 0x4be74d
sub eax, 9
je 0x4be98e
sub eax, 4
je 0x4be59a
jmp 0x4be759
sub eax, 0x1b
je 0x4be5ff
sub eax, 5
je 0x4be98e
jmp 0x4be759
sub eax, 0x26
je 0x4be710
dec eax
je 0x4be691
dec eax
je 0x4be72a
sub eax, 0x51
je 0x4be74d
jmp 0x4be759
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4be5ad
mov si, 0xffef
call fcn.00403a1c
mov eax, dword [ebp - 4]
call fcn.004bddf0
test al, al
jne 0x4be98e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4be98e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4bea08
call fcn.00404fe8
je 0x4be98e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x4be98e
push ebp
call fcn.004be140
pop ecx
jmp 0x4be98e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x4be60d
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.00404098
jmp 0x4be9f9
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4be63d
mov eax, dword [ebp - 4]
call fcn.004be000
jmp 0x4be98e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x4be98e
cmp byte [ebx + 0x34], 0
je 0x4be672
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00444694
push eax
call sub.user32.dll_PostMessageA
call fcn.00404098
jmp 0x4be9f9
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00444694
push eax
call sub.user32.dll_PostMessageA
jmp 0x4be98e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4be6a7
mov eax, dword [ebp - 4]
call fcn.004bded0
jmp 0x4be98e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x4be98e
mov eax, dword [ebp - 4]
call fcn.004bddf0
test al, al
jne 0x4be98e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
cmp byte [ebx + 0x34], 0
je 0x4be6f1
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00444694
push eax
call sub.user32.dll_PostMessageA
call fcn.00404098
jmp 0x4be9f9
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00444694
push eax
call sub.user32.dll_PostMessageA
jmp 0x4be98e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4be98e
mov eax, dword [ebp - 4]
call fcn.004be000
jmp 0x4be98e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4be740
mov eax, dword [ebp - 4]
call fcn.004bded0
jmp 0x4be98e
mov eax, dword [ebp - 4]
call fcn.004bddf0
jmp 0x4be98e
push ebp
call fcn.004be140
pop ecx
jmp 0x4be98e
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4be98e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004bccac
test eax, eax
je 0x4be98e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004bccac
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], ebx
test ebx, ebx
je 0x4be79e
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00444694
push eax
call sub.user32.dll_PostMessageA
jmp 0x4be98e
mov eax, dword [edi + 4]
sub eax, 0x200
je 0x4be7d5
sub eax, 2
je 0x4be8c5
jmp 0x4be98e
xor eax, eax
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407af4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x524d08]
jne 0x4be80b
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x524d0c]
je 0x4be98e
mov esi, dword [ebp - 4]
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea edx, [ebp - 0x64]
mov eax, dword [esi + 0x3c]
call fcn.0043d948
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4be838
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004bd72c
jmp 0x4be8ae
mov esi, dword [ebp - 4]
jmp 0x4be83f
mov esi, eax
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x4be83d
test esi, esi
je 0x4be8ae
mov ebx, dword [esi + 0x40]
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004bd72c
cmp ebx, dword [esi + 0x40]
je 0x4be8a7
cmp esi, dword [ebp - 4]
je 0x4be8a7
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x4be886
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00444694
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x48]
cmp esi, ebx
jne 0x4be868
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.00444694
push eax
call sub.user32.dll_PostMessageA
call fcn.00404098
jmp 0x4be9f9
mov esi, dword [esi + 0x4c]
test esi, esi
jne 0x4be84a
mov eax, dword [ebp - 0xe]
mov dword [0x524d08], eax
mov eax, dword [ebp - 0xa]
mov dword [0x524d0c], eax
jmp 0x4be98e
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00407af4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0043daec
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4be941
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4be941
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00444694
push eax
call sub.user32.dll_PostMessageA
jmp 0x4be98e
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4be973
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.0043daec
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4be970
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x4be97b
test bl, bl
je 0x4be948
test bl, bl
jne 0x4be98e
push ebp
call fcn.004be140
pop ecx
jmp 0x4be98e
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004be16c
pop ecx
test al, al
je 0x4be9af
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4be2fa
push ebp
call fcn.004be16c
pop ecx
test al, al
jne 0x4be2e6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be9f9
mov eax, dword [ebp - 0x20]
push eax
push 0
call sub.user32.dll_KillTimer
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x4be9e5
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.004761c0
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret