Function at 0x4b3ff0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov byte [0x563edd], 0
cmp byte [0x563edc], 0
push ebx
push esi
push edi
jne 0x4b4045
cmp byte [0x563ede], 0
jne 0x4b4025
mov al, byte [0x563edf]
inc al
mov byte [0x563edf], al
cmp al, 1
jbe 0x4b4045
movsd xmm1, qword [0x545540]
mov ecx, 0x563ed0
mov byte [0x563ede], 1
call fcn.004a4240
mov byte [0x563edc], 1
movzx eax, byte [0x564406]
xor ecx, ecx
cmp dword [0x5643ac], ecx
cmovg eax, ecx
mov byte [0x564406], al
mov eax, dword [0x5603c4]
mov eax, dword [eax]
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
test edx, edx
jle 0x4b407c
nop dword [eax]
mov eax, dword [esi + ecx*4]
inc ecx
mov byte [eax + 0x60], 0
cmp ecx, edx
jl 0x4b4070
mov eax, dword [0x564560]
mov esi, dword [0x56455c]
mov byte [0x560588], 0
mov byte [0x563840], 0
mov byte [0x5637b0], 0
mov byte [0x563720], 0
mov dword [esp + 0x14], eax
cmp esi, eax
je 0x4b413d
mov ebx, dword [0x5645c8]
mov eax, dword [0x557104]
nop word [eax + eax]
mov ecx, dword [esi]
mov dword [esp + 0x10], ecx
mov edx, dword [ecx]
lea edi, [edx - 1]
cmp edi, dword [eax + 4]
jae 0x4b42ea
mov ecx, dword [eax + 8]
mov edi, dword [ecx + edi*4]
cmp byte [edi + 0x15], 0
je 0x4b40f9
mov edx, dword [edi + 0x16]
test edx, edx
je 0x4b4134
mov ecx, dword [0x5645cc]
sub ecx, ebx
cmp ecx, edx
jbe 0x4b4134
cmp byte [ebx + edx], 0
je 0x4b4134
mov ebx, dword [esp + 0x10]
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov eax, dword [eax]
cmp dword [eax + 4], 0
jg 0x4b4124
push dword [edi + 8]
xor edx, edx
call fcn.00454cb0
mov ecx, dword [edi + 0xc]
add esp, 4
mov dword [eax + 0x18], ecx
mov byte [eax + 0x31], 0x24
mov ecx, dword [ebx + 4]
call fcn.00454d90
mov ebx, dword [0x5645c8]
mov eax, dword [0x557104]
add esi, 4
cmp esi, dword [esp + 0x14]
jne 0x4b40c0
mov eax, dword [0x5603c4]
xor edi, edi
mov eax, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
test ebx, ebx
jle 0x4b41c3
nop dword [eax + eax]
mov esi, dword [eax + edi*4]
cmp byte [esi + 8], 0
je 0x4b41be
mov ecx, dword [esi + 0x7d]
test ecx, ecx
je 0x4b41be
cmp byte [ecx + 0x27], 4
jne 0x4b41b1
mov ebx, dword [esi + 0x88]
mov eax, dword [ebx]
mov eax, dword [eax]
cmp dword [eax + 4], 0
jg 0x4b41a6
push dword [ecx + 0xc]
mov edx, dword [esi + 4]
mov ecx, ebx
call fcn.00454cb0
mov ecx, dword [esi + 4]
add esp, 4
mov dword [eax + 0x18], ecx
mov byte [eax + 0x31], 0x14
mov ebx, dword [esi + 0x88]
mov ecx, ebx
call fcn.00454d90
mov ebx, dword [esp + 0x14]
push esi
call fcn.0048adc0
mov eax, dword [esp + 0x14]
add esp, 4
inc edi
cmp edi, ebx
jl 0x4b4160
push 0
call fcn.00470880
mov eax, dword [0x560531]
add esp, 4
cmp dword [0x5637e9], eax
jne 0x4b41ec
push 0x5637e0
call fcn.0048adc0
mov eax, dword [0x560531]
add esp, 4
cmp dword [0x563759], eax
jne 0x4b4206
push 0x563750
call fcn.0048adc0
mov eax, dword [0x560531]
add esp, 4
cmp dword [0x5636c9], eax
jne 0x4b421b
push 0x5636c0
call fcn.0048adc0
add esp, 4
call fcn.004c70d0
call fcn.00472830
call fcn.004832e0
mov edi, dword [0x56456c]
xor esi, esi
mov eax, dword [0x564568]
sub edi, eax
sar edi, 2
test edi, edi
jle 0x4b4261
mov ecx, dword [eax + esi*4]
cmp dword [ecx + 0xf0], 0
jle 0x4b425c
cmp dword [ecx + 0x78], 0
jle 0x4b425c
call fcn.00475560
mov eax, dword [0x564568]
inc esi
cmp esi, edi
jl 0x4b4240
call fcn.00454eb0
mov ecx, 0x5604f8
call fcn.0046cd10
call fcn.004b5490
cmp dword [0x5643ac], 7
mov edx, 1
mov eax, dword [0x563eec]
cmove eax, edx
cmp byte [0x5645b0], 0
mov dword [0x563eec], eax
je 0x4b42b0
movsd xmm1, qword [0x545540]
mov ecx, 0x563ed0
call fcn.004a4380
mov byte [0x563edc], 0
cmp byte [0x556b21], 0
je 0x4b42e3
push 0x78
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x4b42e3
test byte [0x5646b8], 0x20
jne 0x4b42e3
push 0
push 1
push 0x8001
push dword [0x563870]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, str.Common_Event
call fcn.004a1c00
int3