Function at 0x4c16a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
push ebx
push esi
cmp eax, 0x10
push edi
jne 0x4c16c2
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov byte [eax + 0x20f], 1
mov esp, ebp
pop ebp
ret
mov bl, byte [0x598e88]
mov esi, dword [ebp + 8]
inc bl
lea ecx, [ebp - 0x24]
mov byte [0x598e88], bl
mov edx, dword [esi]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov al, byte [esi + 0x20d]
test al, al
je 0x4c1703
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov edi, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], ecx
jmp 0x4c1729
mov edx, dword [esi + 0x130]
mov eax, dword [esi + 0x134]
mov ecx, dword [esi + 0x114]
mov dword [ebp - 8], edx
mov edx, dword [esi + 0x118]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
mov edi, eax
mov eax, dword [esi + 0x1a8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi + 0x1ac]
lea ebx, [esi + 0x1a8]
mov dword [ebp - 4], eax
lea eax, [edx - 0x21]
cmp eax, 7
mov dword [ebp + 8], ecx
ja case.default.0x4c1750
jmp dword [eax*4 + 0x4c1be8]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x4c176b
mov dword [ebp + 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jl 0x4c177d
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
test eax, eax
jge 0x4c1852
xor eax, eax
jmp 0x4c185c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x4c17a3
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x10]
dec ecx
mov dword [ebp - 4], ecx
jmp 0x4c1840
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x4c17cd
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
cdq
idiv dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 4], ecx
jmp 0x4c1840
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
cdq
idiv edi
sub ecx, eax
mov dword [ebp + 8], ecx
jmp 0x4c1840
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x4c17fb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
cdq
idiv dword [ebp - 8]
add ecx, eax
mov dword [ebp - 4], ecx
jmp 0x4c1840
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
cdq
idiv edi
add ecx, eax
mov dword [ebp + 8], ecx
jmp 0x4c1840
movsx edx, byte [0x598e88]
sub dword [ebp + 8], edx
jmp 0x4c1840
movsx eax, byte [0x598e88]
add dword [ebp + 8], eax
jmp 0x4c1840
movsx ecx, byte [0x598e88]
mov eax, dword [ebp - 4]
sub eax, ecx
jmp 0x4c183d
movsx edx, byte [0x598e88]
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
jge 0x4c1770
xor ecx, ecx
jmp 0x4c177a
mov edx, dword [ebp - 0x14]
cmp eax, edx
jl 0x4c185f
lea eax, [edx - 1]
mov dword [ebp + 8], eax
mov dl, byte [esi + 0x20f]
test dl, dl
jne 0x4c1935
mov al, byte [esi + 0x210]
test al, al
jne 0x4c19fd
mov al, byte [esi + 0x20d]
test al, al
je 0x4c1892
push 0
push esi
call fcn.004c1c50
add esp, 8
jmp 0x4c18b5
mov eax, dword [esi + 0x1ac]
mov ecx, dword [ebx]
mov edx, dword [esi + 0x1a4]
push eax
mov eax, dword [esi + 0x1a0]
push ecx
push edx
push eax
push 0
push esi
call fcn.004c1f50
add esp, 0x18
mov ecx, dword [0x598dd8]
push 1
push 0x3ec
push ecx
call dword [sym.imp.USER32.dll_EnableMenuItem]
call fcn.004bb580
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov al, byte [esi + 0x20d]
test al, al
je 0x4c18fd
mov edx, dword [esi]
push 1
push 0x401
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov byte [esi + 0x20d], 1
jmp 0x4c1919
mov eax, dword [esi]
push 0
push 0x401
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov byte [esi + 0x20c], 1
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_ShowCaret]
mov byte [esi + 0x210], 1
mov byte [esi + 0x20e], 0
jmp 0x4c19fd
mov dl, byte [esi + 0x210]
test dl, dl
je 0x4c19ed
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_HideCaret]
mov al, byte [esi + 0x20d]
mov byte [esi + 0x210], 0
test al, al
je 0x4c196a
push 0
push esi
call fcn.004c1c50
add esp, 8
jmp 0x4c19cb
mov eax, dword [0x5994b8]
test eax, eax
je 0x4c19a8
mov eax, dword [ebp + 0xc]
cmp eax, 0x27
jne 0x4c1982
mov eax, 0xfffffffe
jmp 0x4c1996
cmp eax, 0x26
je 0x4c198c
cmp eax, 0x28
jne 0x4c1993
mov eax, 0xfffffffe
jmp 0x4c1996
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x1ac]
push eax
push ebx
push esi
call fcn.004ba4e0
add esp, 0x10
mov ecx, dword [esi + 0x1ac]
mov edx, dword [ebx]
mov eax, dword [esi + 0x1a4]
push ecx
mov ecx, dword [esi + 0x1a0]
push edx
push eax
push ecx
push 0
push esi
call fcn.004c1f50
add esp, 0x18
mov edx, dword [0x598dd8]
push 0
push 0x3ec
push edx
call dword [sym.imp.USER32.dll_EnableMenuItem]
call fcn.004bb580
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
jmp 0x4c19fd
cmp ecx, dword [ebx]
jne 0x4c19fd
cmp eax, dword [esi + 0x1ac]
je case.default.0x4c1750
lea eax, [ebp - 4]
push eax
push ebx
call fcn.004c13e0
lea ecx, [ebp + 8]
lea edi, [esi + 0x1ac]
push ecx
push edi
call fcn.004c13e0
mov al, byte [esi + 0x20f]
add esp, 0x10
test al, al
je 0x4c1a54
mov al, byte [esi + 0x20d]
test al, al
je 0x4c1a41
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
push edx
push eax
push esi
call fcn.004c1de0
add esp, 0xc
jmp 0x4c1ab7
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
push ecx
push edx
push esi
call fcn.004c2190
add esp, 0xc
jmp 0x4c1ab7
mov eax, dword [0x5994b8]
test eax, eax
je 0x4c1aa7
mov eax, dword [ebx]
mov ecx, dword [edi]
push esi
mov dword [esi + 0x1a0], eax
mov dword [esi + 0x1a4], ecx
call fcn.004ba7a0
add esp, 4
cmp eax, 3
je 0x4c1aa7
cmp eax, 7
jne 0x4c1aa7
mov eax, dword [ebp + 0xc]
cmp eax, 0x27
je 0x4c1a9c
cmp eax, 0x26
je 0x4c1a9c
cmp eax, 0x28
je 0x4c1a9c
cmp eax, 0x25
jne 0x4c1aa7
mov eax, dword [ebx]
dec eax
jmp 0x4c1a9f
mov eax, dword [ebx]
inc eax
mov dword [ebx], eax
mov dword [esi + 0x1a0], eax
mov edx, dword [ebx]
mov eax, dword [edi]
mov dword [esi + 0x1a0], edx
mov dword [esi + 0x1a4], eax
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
imul edi, dword [ebx]
imul eax, dword [ebp - 8]
mov ecx, dword [esi + 0x18c]
mov ebx, dword [esi + 0x1ac]
imul ebx, dword [ebp - 0xc]
sub edi, ecx
sub eax, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 0x190]
imul ecx, dword [ebp - 0xc]
sub ebx, edx
sub ecx, edx
test edi, edi
mov dword [ebp - 4], eax
mov dword [ebp + 8], ecx
jge 0x4c1b19
mov ecx, dword [esi + 0x24]
mov edx, dword [esi]
add ecx, edi
push 0
and ecx, 0xffff
shl ecx, 0x10
or ecx, 4
push ecx
push 0x114
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
xor edi, edi
jmp 0x4c1b5b
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
sub ecx, edx
cmp edi, ecx
jle 0x4c1b5b
mov edx, dword [esi + 0x24]
push 0
sub edx, eax
mov eax, dword [esi]
add edx, edi
and edx, 0xffff
shl edx, 0x10
or edx, 4
push edx
push 0x114
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [ebp - 8]
mov eax, dword [esi + 0x18c]
imul edi, dword [esi + 0x1a8]
sub edi, eax
test ebx, ebx
jge 0x4c1b92
mov ecx, dword [esi + 0x28]
mov edx, dword [esi]
add ecx, ebx
push 0
and ecx, 0xffff
shl ecx, 0x10
or ecx, 4
push ecx
push 0x115
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_SetCaretPos]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
sub eax, edx
cmp ebx, eax
jle 0x4c1bd7
mov ecx, dword [esi + 0x28]
mov edx, dword [ebp + 8]
sub ecx, edx
mov edx, dword [esi]
add ecx, ebx
push 0
and ecx, 0xffff
shl ecx, 0x10
or ecx, 4
push ecx
push 0x115
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [esi + 0x1ac]
mov eax, dword [esi + 0x190]
imul ebx, dword [ebp - 0xc]
sub ebx, eax
push ebx
push edi
call dword [sym.imp.USER32.dll_SetCaretPos]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret