Function at 0x494320
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4d9c3b
push eax
mov eax, 0x1480
mov dword fs:[0], esp
call fcn.004d3780
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
mov ebp, ecx
push 0x11
mov dword [esp + 0x18], ebp
call ebx
movsx edi, ax
push 0x12
shr edi, 0x10
call ebx
movsx esi, ax
push 0x10
shr esi, 0x10
call ebx
movsx eax, ax
shr eax, 0x10
test edi, edi
je 0x494381
test esi, esi
je 0x494381
test eax, eax
mov dword [esp + 0x10], 1
jne 0x494389
mov dword [esp + 0x10], 0
xor ebx, ebx
test edi, edi
je 0x4943ff
test esi, esi
je 0x4943a1
mov eax, dword [0x6c4768]
test eax, eax
je 0x4943a1
mov ebx, 1
test ebx, ebx
jne 0x4943b4
mov eax, dword [esp + 0x14a0]
test eax, eax
je 0x4945b4
lea ecx, [esp + 0x20]
call fcn.0045d080
xor esi, esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1498], esi
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x40]
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp ebx, esi
je 0x494413
cmp edi, esi
je 0x494413
mov eax, 1
jmp 0x494415
test esi, esi
je 0x4943a5
mov eax, dword [0x6c476c]
test eax, eax
je 0x4943a5
mov ebx, 1
jmp 0x4943b4
xor eax, eax
mov edx, dword [esp + 0x10]
mov ecx, ebp
push edx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0049f8b0
push eax
lea ecx, [esp + 0x30]
call fcn.0045d140
cmp eax, esi
jne 0x494509
mov eax, dword [ebp + 0x2638]
mov ecx, dword [esp + 0x28]
lea ebx, [ebp + 0x2638]
cmp eax, ecx
je 0x4944a3
mov edi, dword [eax - 0xc]
lea edx, [eax - 0xc]
cmp edi, esi
mov esi, dword [0x4eb24c]
jge 0x494464
lea edi, [eax - 0xc]
cmp edi, esi
jne 0x49446b
mov edi, dword [ecx - 0xc]
test edi, edi
jge 0x4944d0
mov ebp, dword [ecx - 8]
mov esi, ecx
push ebp
mov ecx, ebx
call fcn.004076f0
test eax, eax
je 0x49449f
mov edi, dword [ebx]
lea eax, [ebp + ebp]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov dword [ecx - 8], ebp
mov edx, dword [ebx]
mov word [eax + edx], 0
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebx]
mov eax, dword [ecx - 8]
test eax, eax
je 0x494597
mov edx, dword [ebp + 4]
mov eax, dword [0x6dcf80]
push ebp
push 0x4935b0
push edx
push 0x116
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x494597
add eax, 0xfffffff4
cmp eax, esi
je 0x4944fb
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4944f0
mov eax, dword [ebx]
sub eax, 0xc
push eax
call fcn.004d3765
add esp, 4
mov eax, dword [0x4eb4c0]
mov ecx, dword [esp + 0x28]
mov dword [ebx], eax
mov dword [ebx], ecx
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4944a3
cmp eax, 1
jne 0x494597
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3a]
mov word [esp + 0x38], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [0x6dcf80]
mov ecx, 0x493
xor eax, eax
lea edi, [esp + 0x242]
mov word [esp + 0x240], si
push 0x103
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ecx
push 0x62
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x38]
push eax
push ecx
lea edx, [esp + 0x248]
push 0x927
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [0x68f38c]
add esp, 0x10
lea ecx, [esp + 0x240]
push ecx
push 0x7d0
push 0x4402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x20]
mov esi, 1
mov dword [esp + 0x1498], 0xffffffff
call fcn.0045d0d0
mov eax, esi
jmp 0x4945b6
xor eax, eax
mov ecx, dword [esp + 0x1490]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148c
ret 4