Function at 0x4f1360
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov byte [rbp + 0x3e], dl
mov byte [rbp + 0x3f], r8b
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
mov rcx, qword [0x004e3390]
mov dl, 1
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0xb0]
mov r8, rbp
neg r8
mov r8, qword [rax + r8]
movzx rax, byte [rbp + 0x3e]
test al, al
setne r9b
movzx rax, byte [rbp + 0x3e]
cmp al, 2
sete al
mov byte [rsp + 0x20], al
movzx rax, byte [rbp + 0x3f]
mov byte [rsp + 0x28], al
call fcn.004ed510
mov rbx, rax
jmp 0x4f1619
cmp dword [rbp + 0x68], 0x100
jne 0x4f140c
cmp qword [rbp + 0x70], 0x1b
jne 0x4f140c
mov rax, qword [rbx + 0x68]
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x68], 0x10
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
jmp 0x4f15c3
cmp dword [rbp + 0x68], 0x100
jne 0x4f1443
cmp qword [rbp + 0x70], 0x70
jne 0x4f1443
mov byte [rbp + 0x5f], 0
mov rcx, qword [rbx + 0x68]
mov dl, 1
mov r8b, 0xa
mov r9, qword [rbx + 0xe8]
lea rax, [rbp + 0x5f]
mov qword [rsp + 0x20], rax
call fcn.004bdcb0
jmp 0x4f15c3
cmp dword [rbp + 0x68], 0x100
jne 0x4f14ff
mov eax, dword [rbp + 0x70]
cmp eax, dword [0x00b2db94]
jne 0x4f14ff
mov ecx, 0x10
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x4f14ff
mov ecx, 0x11
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x4f14ff
mov ecx, 0x12
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x4f14ff
movzx rcx, byte [rbp + 0x3e]
cmp cl, 7
ja 0x4f14c5
mov al, 1
shl eax, cl
movzx rcx, byte [0x004f1778]
test al, cl
setne al
jmp 0x4f14c8
xor rax, rax
test al, al
je 0x4f14ff
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0xb0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x180]
test al, al
jne 0x4f14ff
mov rcx, rbx
call fcn.004e53a0
jmp 0x4f15c3
cmp dword [rbp + 0x68], 0x100
jne 0x4f15c3
cmp qword [rbp + 0x70], 0x43
jne 0x4f15c3
mov ecx, 0x11
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x4f15c3
mov qword [rbp + 0x70], 0
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0xb0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x180]
test al, al
je 0x4f1594
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0xb0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, rax
lea rdx, [rbp + 0x48]
xor r8, r8
mov rsi, qword [rax]
call qword [rsi + 0x788]
mov rcx, qword [rbp + 0x48]
call fcn.004adf00
jmp 0x4f15c3
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0xb0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, rax
lea rdx, [rbp + 0x40]
mov rsi, qword [rax]
call qword [rsi + 0x700]
mov rcx, qword [rbp + 0x40]
call fcn.004adf00
cmp dword [rbp + 0x68], 0
jne 0x4f15ec
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [0x00bb8ed8]
cmp eax, dword [rcx]
jne 0x4f15ec
cmp qword [0x00b2dc70], 0
je 0x4f15ec
xor rcx, rcx
call qword [0x00b2dc70]
mov rax, qword [rbp + 0x60]
cmp rax, qword [rbx + 0x78]
je 0x4f1607
mov rcx, qword [rbx + 0x68]
lea rdx, [rbp + 0x60]
call sub.user32.dll_IsDialogMessageW
test eax, eax
jne 0x4f1619
lea rcx, [rbp + 0x60]
call sub.user32.dll_TranslateMessage
lea rcx, [rbp + 0x60]
call sub.user32.dll_DispatchMessageW
mov rcx, qword [rbx + 0x68]
call sub.user32.dll_IsWindow
test eax, eax
je 0x4f1644
lea rcx, [rbp + 0x60]
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.user32.dll_GetMessageW
add eax, 1
cmp eax, 1
ja 0x4f13d8
movzx rcx, byte [rbp + 0x3e]
cmp cl, 7
ja 0x4f1661
mov al, 1
shl eax, cl
movzx rcx, byte [0x004f1778]
test al, cl
setne al
jmp 0x4f1664
xor rax, rax
test al, al
je 0x4f1671
cmp byte [rbx + 0xc5], 0
jne 0x4f1676
xor rax, rax
jmp 0x4f1678
mov al, 1
mov byte [rbp + 0x5f], al
mov rcx, rbx
call fcn.0040ccc0
cmp byte [rbp + 0x5f], 0
je 0x4f172f
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0xb0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, rax
mov dl, 1
mov rbx, qword [rax]
call qword [rbx + 0x188]
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0xb0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, rax
xor rdx, rdx
mov rbx, qword [rax]
call qword [rbx + 0x98]
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0xb0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, rax
xor rdx, rdx
mov rbx, qword [rax]
call qword [rbx + 0xa8]
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0xb0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, rax
xor rdx, rdx
mov rbx, qword [rax]
call qword [rbx + 0xb8]
mov rcx, qword [rbp + 0x30]
xor rdx, rdx
xor r8, r8
call fcn.004f1360
nop
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.00410160
lea rsp, [rbp + 0x90]
pop rbx
pop rsi
pop rbp
ret