Function at 0x4fdbdc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x4c]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4fe43a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x6b0134]
mov eax, dword [eax]
xor edx, edx
call fcn.0046e10c
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x30]
xor edx, edx
xor eax, eax
call fcn.00418ed0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
push 0
push 0x32
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004fa1a8
test eax, eax
jle 0x4fdd0f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004fa1a8
mov edx, eax
dec edx
mov eax, ebx
call fcn.004fa1b0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x4fdcfb
mov eax, esi
call fcn.004fa1a8
cmp ebx, eax
jge 0x4fdcfb
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.004fa1b0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x4fdce7
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004fa1a8
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x4fdce7
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.004fa1b0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4fdcfb
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004fd154
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x4fdd25
mov eax, ebx
call fcn.00455814
call fcn.00477274
mov byte [ebp - 6], 1
jmp 0x4fe3f7
cmp byte [ebp - 6], 0
jne 0x4fdd39
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4fe3d6
mov eax, dword [edi + 4]
cmp eax, 0x113
jg 0x4fdd71
je 0x4fde71
sub eax, 0x12
je 0x4fde65
sub eax, 0x34
je 0x4fdd82
add eax, 0xffffffa5
sub eax, 9
jb 0x4fde65
jmp 0x4fdef2
sub eax, 0x201
je 0x4fdd93
sub eax, 3
je 0x4fdd93
jmp 0x4fdef2
push ebp
call fcn.004fdb88
pop ecx
call fcn.004043d8
jmp 0x4fe441
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.004083f8
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044e9fc
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4fde12
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fde12
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00455814
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fdef2
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4fde44
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.0044e9fc
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fde41
mov bl, 1
mov esi, dword [esi + 0x68]
test esi, esi
je 0x4fde4c
test bl, bl
je 0x4fde19
test bl, bl
jne 0x4fdef2
push ebp
call fcn.004fdb88
pop ecx
call fcn.004043d8
jmp 0x4fe441
push ebp
call fcn.004fdb88
pop ecx
jmp 0x4fe3d6
cmp dword [edi], 0
jne 0x4fdef2
add dword [ebp - 0x1c], 0x32
lea edx, [ebp - 0x28]
mov eax, dword [0x6b0070]
mov eax, dword [eax]
call fcn.00459fb4
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jne 0x4fdee1
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jne 0x4fdee1
cmp dword [ebp - 0x1c], 0x1f4
jl 0x4fdee6
mov esi, dword [ebp - 4]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea edx, [ebp - 0x64]
mov eax, dword [esi + 0x3c]
call fcn.0044e858
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fdeda
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.00455814
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4fdee6
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4fe3d6
mov eax, dword [edi + 4]
sub eax, 0x7b
je 0x4fe3d6
add eax, 0xffffff7b
sub eax, 9
jb 0x4fdf44
add eax, 0xffffff09
sub eax, 0xb
jb 0x4fe205
sub eax, 0x264
jne 0x4fe3d0
mov eax, dword [ebp - 4]
call fcn.004fd838
jmp 0x4fe3d6
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4fe3d6
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4fdf7a
sub eax, 2
je 0x4fe1ac
sub eax, 2
je 0x4fdf7a
sub eax, 2
je 0x4fe1ac
jmp 0x4fe3d6
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4fdfbd
je 0x4fe06f
cmp eax, 0x12
jg 0x4fdfa6
je 0x4fe195
sub eax, 9
je 0x4fe3d6
sub eax, 4
je 0x4fdfe2
jmp 0x4fe1a1
sub eax, 0x1b
je 0x4fe047
sub eax, 5
je 0x4fe3d6
jmp 0x4fe1a1
sub eax, 0x26
je 0x4fe158
dec eax
je 0x4fe0d9
dec eax
je 0x4fe172
sub eax, 0x51
je 0x4fe195
jmp 0x4fe1a1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4fdff5
mov si, 0xffef
call fcn.00403c98
mov eax, dword [ebp - 4]
call fcn.004fd838
test al, al
jne 0x4fe3d6
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4fe3d6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4fe450
call fcn.0040538c
je 0x4fe3d6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x4fe3d6
push ebp
call fcn.004fdb88
pop ecx
jmp 0x4fe3d6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4fe055
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.004043d8
jmp 0x4fe441
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4fe085
mov eax, dword [ebp - 4]
call fcn.004fda48
jmp 0x4fe3d6
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x68]
test ebx, ebx
je 0x4fe3d6
cmp byte [ebx + 0x34], 0
je 0x4fe0ba
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00455814
push eax
call sub.user32.dll_PostMessageA
call fcn.004043d8
jmp 0x4fe441
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00455814
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fe3d6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4fe0ef
mov eax, dword [ebp - 4]
call fcn.004fd918
jmp 0x4fe3d6
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4fe3d6
mov eax, dword [ebp - 4]
call fcn.004fd838
test al, al
jne 0x4fe3d6
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x68]
cmp byte [ebx + 0x34], 0
je 0x4fe139
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00455814
push eax
call sub.user32.dll_PostMessageA
call fcn.004043d8
jmp 0x4fe441
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00455814
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fe3d6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4fe3d6
mov eax, dword [ebp - 4]
call fcn.004fda48
jmp 0x4fe3d6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4fe188
mov eax, dword [ebp - 4]
call fcn.004fd918
jmp 0x4fe3d6
mov eax, dword [ebp - 4]
call fcn.004fd838
jmp 0x4fe3d6
push ebp
call fcn.004fdb88
pop ecx
jmp 0x4fe3d6
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4fe3d6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004fc694
test eax, eax
je 0x4fe3d6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004fc694
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], ebx
test ebx, ebx
je 0x4fe1e6
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00455814
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fe3d6
mov eax, dword [edi + 4]
sub eax, 0x200
je 0x4fe21d
sub eax, 2
je 0x4fe30d
jmp 0x4fe3d6
xor eax, eax
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.004083f8
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x6c8d58]
jne 0x4fe253
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x6c8d5c]
je 0x4fe3d6
mov esi, dword [ebp - 4]
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea edx, [ebp - 0x64]
mov eax, dword [esi + 0x3c]
call fcn.0044e858
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fe280
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004fd154
jmp 0x4fe2f6
mov esi, dword [ebp - 4]
jmp 0x4fe287
mov esi, eax
mov eax, dword [esi + 0x68]
test eax, eax
jne 0x4fe285
test esi, esi
je 0x4fe2f6
mov ebx, dword [esi + 0x40]
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004fd154
cmp ebx, dword [esi + 0x40]
je 0x4fe2ef
cmp esi, dword [ebp - 4]
je 0x4fe2ef
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x4fe2ce
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.00455814
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x68]
cmp esi, ebx
jne 0x4fe2b0
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.00455814
push eax
call sub.user32.dll_PostMessageA
call fcn.004043d8
jmp 0x4fe441
mov esi, dword [esi + 0x6c]
test esi, esi
jne 0x4fe292
mov eax, dword [ebp - 0xe]
mov dword [0x6c8d58], eax
mov eax, dword [ebp - 0xa]
mov dword [0x6c8d5c], eax
jmp 0x4fe3d6
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.004083f8
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044e9fc
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4fe389
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fe389
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00455814
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fe3d6
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4fe3bb
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.0044e9fc
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4fe3b8
mov bl, 1
mov esi, dword [esi + 0x68]
test esi, esi
je 0x4fe3c3
test bl, bl
je 0x4fe390
test bl, bl
jne 0x4fe3d6
push ebp
call fcn.004fdb88
pop ecx
jmp 0x4fe3d6
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004fdbb4
pop ecx
test al, al
je 0x4fe3f7
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4fdd42
push ebp
call fcn.004fdbb4
pop ecx
test al, al
jne 0x4fdd2e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe441
mov eax, dword [ebp - 0x20]
push eax
push 0
call sub.user32.dll_KillTimer
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4fe42d
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.00477294
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret