Function at 0x4956a0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4db1db
push eax
mov eax, 0x1480
mov dword fs:[0], esp
call fcn.004d4ce0
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
mov ebp, ecx
push 0x11
mov dword [esp + 0x18], ebp
call ebx
movsx edi, ax
push 0x12
shr edi, 0x10
call ebx
movsx esi, ax
push 0x10
shr esi, 0x10
call ebx
movsx eax, ax
shr eax, 0x10
test edi, edi
je 0x495701
test esi, esi
je 0x495701
test eax, eax
mov dword [esp + 0x10], 1
jne 0x495709
mov dword [esp + 0x10], 0
xor ebx, ebx
test edi, edi
je 0x49577f
test esi, esi
je 0x495721
mov eax, dword [0x727700]
test eax, eax
je 0x495721
mov ebx, 1
test ebx, ebx
jne 0x495734
mov eax, dword [esp + 0x14a0]
test eax, eax
je 0x495934
lea ecx, [esp + 0x20]
call fcn.0045e5b0
xor esi, esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1498], esi
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x40]
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp ebx, esi
je 0x495793
cmp edi, esi
je 0x495793
mov eax, 1
jmp 0x495795
test esi, esi
je 0x495725
mov eax, dword [0x727704]
test eax, eax
je 0x495725
mov ebx, 1
jmp 0x495734
xor eax, eax
mov edx, dword [esp + 0x10]
mov ecx, ebp
push edx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004a0d10
push eax
lea ecx, [esp + 0x30]
call fcn.0045e670
cmp eax, esi
jne 0x495889
mov eax, dword [ebp + 0x2638]
mov ecx, dword [esp + 0x28]
lea ebx, [ebp + 0x2638]
cmp eax, ecx
je 0x495823
mov edi, dword [eax - 0xc]
lea edx, [eax - 0xc]
cmp edi, esi
mov esi, dword [0x4ed100]
jge 0x4957e4
lea edi, [eax - 0xc]
cmp edi, esi
jne 0x4957eb
mov edi, dword [ecx - 0xc]
test edi, edi
jge 0x495850
mov ebp, dword [ecx - 8]
mov esi, ecx
push ebp
mov ecx, ebx
call fcn.004066f0
test eax, eax
je 0x49581f
mov edi, dword [ebx]
lea eax, [ebp + ebp]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov dword [ecx - 8], ebp
mov edx, dword [ebx]
mov word [eax + edx], 0
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebx]
mov eax, dword [ecx - 8]
test eax, eax
je 0x495917
mov edx, dword [ebp + 4]
mov eax, dword [0x73ff28]
push ebp
push 0x494930
push edx
push 0x116
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x495917
add eax, 0xfffffff4
cmp eax, esi
je 0x49587b
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x495870
mov eax, dword [ebx]
sub eax, 0xc
push eax
call fcn.004d4cc1
add esp, 4
mov eax, dword [0x4ed0fc]
mov ecx, dword [esp + 0x28]
mov dword [ebx], eax
mov dword [ebx], ecx
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x495823
cmp eax, 1
jne 0x495917
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3a]
mov word [esp + 0x38], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [0x73ff28]
mov ecx, 0x493
xor eax, eax
lea edi, [esp + 0x242]
mov word [esp + 0x240], si
push 0x103
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ecx
push 0x62
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x38]
push eax
push ecx
lea edx, [esp + 0x248]
push 0x927
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [0x6f287c]
add esp, 0x10
lea ecx, [esp + 0x240]
push ecx
push 0x7d0
push 0x4402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x20]
mov esi, 1
mov dword [esp + 0x1498], 0xffffffff
call fcn.0045e600
mov eax, esi
jmp 0x495936
xor eax, eax
mov ecx, dword [esp + 0x1490]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148c
ret 4