Function at 0x4b9134
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x58]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4b99e3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x4f7f10]
mov eax, dword [eax]
xor edx, edx
call fcn.00463e94
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x3c]
xor edx, edx
xor eax, eax
call fcn.00418268
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
push 0
push 0x32
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004b55a4
test eax, eax
jle 0x4b9267
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004b55a4
mov edx, eax
dec edx
mov eax, ebx
call fcn.004b55ac
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x4b9253
mov eax, esi
call fcn.004b55a4
cmp ebx, eax
jge 0x4b9253
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.004b55ac
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x4b923f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004b55a4
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x4b923f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.004b55ac
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4b9253
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004b86ac
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x4b927d
mov eax, ebx
call fcn.0044b3d8
call fcn.0046d034
mov byte [ebp - 6], 1
jmp 0x4b99a0
cmp byte [ebp - 6], 0
jne 0x4b9291
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4b997f
mov eax, dword [edi + 4]
cmp eax, 0x113
jg 0x4b92c9
je 0x4b93d5
sub eax, 0x12
je 0x4b93c9
sub eax, 0x34
je 0x4b92da
add eax, 0xffffffa5
sub eax, 9
jb 0x4b93c9
jmp 0x4b9456
sub eax, 0x201
je 0x4b92eb
sub eax, 3
je 0x4b92eb
jmp 0x4b9456
push ebp
call fcn.004b90e0
pop ecx
call fcn.0040401c
jmp 0x4b99ea
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.004078a4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x60]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00444700
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4b936e
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4b936e
push 0
push 0xd
push 0x100
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044b3d8
push eax
call sub.user32.dll_PostMessageA
jmp 0x4b9456
mov ebx, dword [ebp - 4]
mov byte [ebp - 0x21], 0
jmp 0x4b93a4
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [ebx + 0x3c]
call fcn.00444700
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [ebx + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4b93a1
mov byte [ebp - 0x21], 1
mov ebx, dword [ebx + 0x68]
test ebx, ebx
je 0x4b93ae
cmp byte [ebp - 0x21], 0
je 0x4b9377
cmp byte [ebp - 0x21], 0
jne 0x4b9456
push ebp
call fcn.004b90e0
pop ecx
call fcn.0040401c
jmp 0x4b99ea
push ebp
call fcn.004b90e0
pop ecx
jmp 0x4b997f
cmp dword [edi], 0
jne 0x4b9456
add dword [ebp - 0x28], 0x32
lea edx, [ebp - 0x34]
mov eax, dword [0x4f7ec4]
mov eax, dword [eax]
call fcn.0044fce8
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x3c]
jne 0x4b9445
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x38]
jne 0x4b9445
cmp dword [ebp - 0x28], 0x1f4
jl 0x4b944a
mov ebx, dword [ebp - 4]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea edx, [ebp - 0x70]
mov eax, dword [ebx + 0x3c]
call fcn.0044455c
lea eax, [ebp - 0x70]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4b943e
push 0
push 0
push 0x46f
mov eax, dword [ebx + 0x3c]
call fcn.0044b3d8
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x4b944a
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4b997f
mov eax, dword [edi + 4]
sub eax, 0x7b
je 0x4b997f
add eax, 0xffffff7b
sub eax, 9
jb 0x4b94a8
add eax, 0xffffff09
sub eax, 0xb
jb 0x4b978b
sub eax, 0x264
jne 0x4b9979
mov eax, dword [ebp - 4]
call fcn.004b8d90
jmp 0x4b997f
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4b997f
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4b94de
sub eax, 2
je 0x4b972b
sub eax, 2
je 0x4b94de
sub eax, 2
je 0x4b972b
jmp 0x4b997f
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4b9521
je 0x4b95dd
cmp eax, 0x12
jg 0x4b950a
je 0x4b9714
sub eax, 9
je 0x4b997f
sub eax, 4
je 0x4b9546
jmp 0x4b9720
sub eax, 0x1b
je 0x4b95b0
sub eax, 5
je 0x4b997f
jmp 0x4b9720
sub eax, 0x26
je 0x4b96d7
dec eax
je 0x4b9652
dec eax
je 0x4b96f1
sub eax, 0x51
je 0x4b9714
jmp 0x4b9720
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4b955e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov si, 0xffef
call fcn.00403998
mov eax, dword [ebp - 4]
call fcn.004b8d90
test al, al
jne 0x4b997f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4b997f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4b99f8
call fcn.00404f28
je 0x4b997f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x4b997f
push ebp
call fcn.004b90e0
pop ecx
jmp 0x4b997f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4b95c3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.0040401c
jmp 0x4b99ea
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4b95f3
mov eax, dword [ebp - 4]
call fcn.004b8fa0
jmp 0x4b997f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4b997f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
cmp byte [eax + 0x34], 0
je 0x4b9633
push 0
push 0x25
push 0x100
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov eax, dword [eax + 0x3c]
call fcn.0044b3d8
push eax
call sub.user32.dll_PostMessageA
call fcn.0040401c
jmp 0x4b99ea
push 0
push 0x1b
push 0x100
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044b3d8
push eax
call sub.user32.dll_PostMessageA
jmp 0x4b997f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4b9668
mov eax, dword [ebp - 4]
call fcn.004b8e70
jmp 0x4b997f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x4b997f
mov eax, dword [ebp - 4]
call fcn.004b8d90
test al, al
jne 0x4b997f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
cmp byte [eax + 0x34], 0
je 0x4b96b8
push 0
push 0x27
push 0x100
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov eax, dword [eax + 0x3c]
call fcn.0044b3d8
push eax
call sub.user32.dll_PostMessageA
call fcn.0040401c
jmp 0x4b99ea
push 0
push 0x1b
push 0x100
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044b3d8
push eax
call sub.user32.dll_PostMessageA
jmp 0x4b997f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4b997f
mov eax, dword [ebp - 4]
call fcn.004b8fa0
jmp 0x4b997f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4b9707
mov eax, dword [ebp - 4]
call fcn.004b8e70
jmp 0x4b997f
mov eax, dword [ebp - 4]
call fcn.004b8d90
jmp 0x4b997f
push ebp
call fcn.004b90e0
pop ecx
jmp 0x4b997f
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4b997f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004b7ba0
test eax, eax
je 0x4b997f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004b7ba0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4b976c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push 0x100
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044b3d8
push eax
call sub.user32.dll_PostMessageA
jmp 0x4b997f
mov eax, dword [edi + 4]
sub eax, 0x200
je 0x4b97a3
sub eax, 2
je 0x4b98aa
jmp 0x4b997f
xor eax, eax
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.004078a4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x50fc68]
jne 0x4b97d9
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x50fc6c]
je 0x4b997f
mov ebx, dword [ebp - 4]
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea edx, [ebp - 0x70]
mov eax, dword [ebx + 0x3c]
call fcn.0044455c
lea eax, [ebp - 0x70]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4b9809
lea edx, [ebp - 0xe]
mov eax, ebx
call fcn.004b86ac
jmp 0x4b9893
mov ebx, dword [ebp - 4]
jmp 0x4b9811
mov ebx, dword [ebx + 0x68]
cmp dword [ebx + 0x68], 0
jne 0x4b980e
test ebx, ebx
je 0x4b9893
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0xe]
mov eax, ebx
call fcn.004b86ac
mov eax, dword [ebx + 0x40]
cmp eax, dword [ebp - 0x1c]
je 0x4b988c
cmp ebx, dword [ebp - 4]
je 0x4b988c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp ebx, dword [ebp - 0x20]
je 0x4b986b
push 0
push 0x1b
push 0x100
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x3c]
call fcn.0044b3d8
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0x20], eax
cmp ebx, dword [ebp - 0x20]
jne 0x4b9843
push 0
push 0
push 0x46f
mov eax, dword [ebx + 0x3c]
call fcn.0044b3d8
push eax
call sub.user32.dll_PostMessageA
call fcn.0040401c
jmp 0x4b99ea
mov ebx, dword [ebx + 0x6c]
test ebx, ebx
jne 0x4b981b
mov eax, dword [ebp - 0xe]
mov dword [0x50fc68], eax
mov eax, dword [ebp - 0xa]
mov dword [0x50fc6c], eax
jmp 0x4b997f
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.004078a4
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x60]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00444700
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4b992a
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4b992a
push 0
push 0xd
push 0x100
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044b3d8
push eax
call sub.user32.dll_PostMessageA
jmp 0x4b997f
mov ebx, dword [ebp - 4]
mov byte [ebp - 0x21], 0
jmp 0x4b9960
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [ebx + 0x3c]
call fcn.00444700
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [ebx + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4b995d
mov byte [ebp - 0x21], 1
mov ebx, dword [ebx + 0x68]
test ebx, ebx
je 0x4b996a
cmp byte [ebp - 0x21], 0
je 0x4b9933
cmp byte [ebp - 0x21], 0
jne 0x4b997f
push ebp
call fcn.004b90e0
pop ecx
jmp 0x4b997f
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004b910c
pop ecx
test al, al
je 0x4b99a0
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4b929a
push ebp
call fcn.004b910c
pop ecx
test al, al
jne 0x4b9286
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b99ea
mov eax, dword [ebp - 0x2c]
push eax
push 0
call sub.user32.dll_KillTimer
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4b99d6
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.0046d054
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret