Function at 0x4993d2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov eax, 0x105
cmp ecx, eax
push edi
ja 0x49955e
je 0x49954f
cmp ecx, 0x14
ja 0x499467
je 0x499547
mov eax, ecx
dec eax
dec eax
je 0x49945e
sub eax, 3
je 0x49944d
dec eax
dec eax
je 0x499444
dec eax
je 0x49942b
dec eax
dec eax
je 0x499432
sub eax, 5
jne 0x4997c7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x70]
xor eax, eax
jmp 0x4997d9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x64]
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4997c7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
jmp 0x499432
call fcn.004b3c7f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x68]
jmp 0x4997c7
and dword [ebp + 8], 0
jmp 0x4996da
mov eax, ecx
sub eax, 0x20
je 0x499524
sub eax, 0x67
je 0x4994fe
sub eax, 0x79
je 0x499492
dec eax
je 0x49954f
dec eax
je 0x4994ef
dec eax
dec eax
jne 0x4997c7
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, dword [ebp + 0x10]
push 0x11
call edi
test ax, ax
jns 0x4994aa
or ebx, 0x20000
push 0x12
call edi
test ax, ax
jns 0x4994b9
or ebx, 0x10000
push 0x10
call edi
test ax, ax
jns 0x4994c8
or ebx, 0x40000
test dword [ebp + 0x14], 0x40000000
jne 0x4994dd
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x50]
test al, al
jne 0x499547
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x54]
test al, al
je 0x4997c7
jmp 0x499547
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x5c]
jmp 0x4997c7
cmp byte [esi + 0x19], 0
je 0x4997c7
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x87
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
or eax, 4
jmp 0x4997d9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
test al, al
je 0x4997c7
cmp word [ebp + 0x14], 1
je 0x4997c7
push dword [esi + 0x15]
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
inc eax
jmp 0x4997d9
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
jmp 0x4997c7
mov eax, 0x205
cmp ecx, eax
ja 0x49969a
je 0x49967f
mov eax, ecx
sub eax, 0x111
je 0x499667
sub eax, 0xef
je 0x499601
dec eax
je 0x4995e6
dec eax
je 0x4995cb
dec eax
je 0x4995b0
dec eax
jne 0x4997c7
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi]
shr ecx, 0x10
movsx ecx, cx
push ecx
movsx ecx, word [ebp + 0x14]
push ecx
mov ecx, esi
call dword [eax + 0x38]
jmp 0x4997c7
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi]
shr ecx, 0x10
movsx ecx, cx
push ecx
movsx ecx, word [ebp + 0x14]
push ecx
mov ecx, esi
call dword [eax + 0x4c]
jmp 0x4997c7
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi]
shr ecx, 0x10
movsx ecx, cx
push ecx
movsx ecx, word [ebp + 0x14]
push ecx
mov ecx, esi
call dword [eax + 0x30]
jmp 0x4997c7
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi]
shr ecx, 0x10
movsx ecx, cx
push ecx
movsx ecx, word [ebp + 0x14]
push ecx
mov ecx, esi
call dword [eax + 0x2c]
jmp 0x4997c7
mov eax, dword [ebp + 0x14]
movsx edi, word [ebp + 0x14]
shr eax, 0x10
cmp byte [esi + 0x14], 0
movsx ebx, ax
jne 0x499659
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 3
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 0x14], 1
call dword [eax + 0x10]
test al, al
je 0x4997c7
push dword [esi + 0x15]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esi]
push ebx
push edi
mov ecx, esi
call dword [eax + 0x24]
jmp 0x4997c7
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi]
shr ecx, 0x10
push ecx
movzx ecx, word [ebp + 0x10]
push ecx
mov ecx, esi
call dword [eax + 0x6c]
jmp 0x4997c7
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi]
shr ecx, 0x10
movsx ecx, cx
push ecx
movsx ecx, word [ebp + 0x14]
push ecx
mov ecx, esi
call dword [eax + 0x34]
jmp 0x4997c7
mov eax, ecx
sub eax, 0x207
je 0x4997b1
dec eax
je 0x499799
dec eax
dec eax
je 0x499760
sub eax, 4
je 0x499727
sub eax, 0x93
je 0x4996e3
dec eax
dec eax
jne 0x4997c7
cmp byte [esi + 0x14], al
je 0x4997c7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
mov byte [esi + 0x14], 0
jmp 0x4997c7
cmp byte [esi + 0x14], 0
je 0x4997c7
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi]
shr ecx, 0x10
push ecx
movzx ecx, word [ebp + 0x14]
push ecx
mov ecx, esi
call dword [eax + 0x28]
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 3
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
jmp 0x4997c7
movsx eax, word [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi]
shr ecx, 0x10
movsx ecx, cx
push ecx
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call dword [eax + 0x48]
jmp 0x4997c7
movsx eax, word [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi]
shr ecx, 0x10
movsx ecx, cx
push ecx
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call dword [eax + 0x44]
jmp 0x4997c7
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi]
shr ecx, 0x10
movsx ecx, cx
push ecx
movsx ecx, word [ebp + 0x14]
push ecx
mov ecx, esi
call dword [eax + 0x3c]
jmp 0x4997c7
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi]
shr ecx, 0x10
movsx ecx, cx
push ecx
movsx ecx, word [ebp + 0x14]
push ecx
mov ecx, esi
call dword [eax + 0x40]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
leave
ret 0x10