Function at 0x474b1c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push str.RunsSinceLastInstall
push str.Settings
call fcn.004248dd
test eax, eax
jle 0x474b48
push str.NotifyInstalledReminder
call fcn.00451db6
push str.NCHSoftware_InstanceWindow
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.00424ccb
push ebx
push fcn.0047e33a
push edi
push 1
push dword [0x5a9cd0]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
test eax, eax
je 0x47506e
push dword [ebx + 4]
push 0xffffffffffffffeb
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebx + 0x1a63]
call fcn.004e6124
lea eax, [ebp - 0x70]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x70], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp byte [ebp + 0xc], 0
mov dword [ebp - 0x6c], edi
mov esi, str.MainWindow
je 0x474bb8
mov dword [ebp - 0x68], 2
jmp 0x474bd6
push edi
push str.Maximized
push esi
mov dword [ebp - 0x68], 1
call fcn.004014f2
test al, al
je 0x474bd6
mov dword [ebp - 0x68], 3
push dword [ebx + 4]
mov edi, 0x214
mov ecx, edi
call fcn.0047a462
mov dword [ebp - 0x14], eax
push 0xf0
mov eax, ebx
call fcn.0047a453
mov ecx, dword [ebp - 0x14]
push 0
push str.Width
push esi
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x45], ecx
mov dword [ebx + 0x49], eax
call fcn.004248dd
test eax, eax
sete byte [ebp + 0xb]
cmp byte [ebp + 0xb], 0
mov dword [ebp - 8], eax
je 0x474c29
push dword [ebx + 4]
mov ecx, edi
call fcn.0047a462
mov dword [ebp - 8], eax
push 0
push str.Height
push esi
call fcn.004248dd
cmp byte [ebp + 0xb], 0
mov dword [ebp - 0xc], eax
je 0x474c43
test eax, eax
jne 0x474c56
test eax, eax
jne 0x474c56
push 0x158
mov eax, ebx
call fcn.0047a453
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
jge 0x474c61
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xc], eax
jge 0x474c6c
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
sar ecx, 1
sar eax, 1
sub eax, ecx
mov ecx, dword [ebp - 0xc]
push eax
push 0x548d34
sar ecx, 1
sar edi, 1
push esi
sub edi, ecx
call fcn.004248dd
push edi
push 0x548d38
push esi
mov dword [ebp - 0x54], eax
call fcn.004248dd
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 8]
add ecx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x50], eax
push str.Height
add eax, ecx
push esi
mov dword [ebp - 0x48], eax
call fcn.00444b7f
test al, al
jne 0x474d5f
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov edx, ecx
sub edx, dword [ebp - 0x54]
cmp edx, eax
jle 0x474cf7
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x48]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov edi, eax
sub edi, dword [ebp - 0x50]
sub esi, edx
cmp edi, esi
jle 0x474d16
mov eax, dword [ebp - 0x50]
sub eax, edx
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov esi, dword [ebp - 0x28]
cmp dword [ebp - 0x54], esi
jge 0x474d2b
mov edi, esi
sub edi, dword [ebp - 0x54]
mov dword [ebp - 0x54], esi
add ecx, edi
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x50], edx
jge 0x474d3d
mov esi, edx
sub esi, dword [ebp - 0x50]
mov dword [ebp - 0x50], edx
add eax, esi
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x20]
cmp ecx, edx
jle 0x474d4e
mov esi, edx
sub esi, ecx
add dword [ebp - 0x54], esi
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jle 0x474d5f
mov edx, ecx
sub edx, eax
add dword [ebp - 0x50], edx
mov dword [ebp - 0x48], ecx
lea eax, [ebp - 0x70]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowPlacement]
cmp dword [ebp - 0x68], 3
jne 0x474d8e
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x1000000
push eax
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [ebp + 0xc], 0
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 1], 0
mov edi, 0x466
je 0x474db9
push 0
push 0
push 0x3e5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
xor al, al
jmp 0x474e0c
mov byte [ebp + 0xb], 0
call fcn.0044f1fa
mov byte [ebp - 2], al
lea eax, [ebp + 0xb]
push eax
push dword [ebx + 4]
call fcn.0044e972
test al, al
jne 0x474de8
call fcn.00476119
push 1
push 0
push edi
push dword [ebx + 4]
call esi
mov byte [ebp - 1], 1
cmp byte [ebp + 0xb], 0
je 0x474e09
call fcn.0044f1fa
cmp al, byte [ebp - 2]
je 0x474e05
push 0
push ebx
mov ecx, 0x53ec98
call fcn.004060c3
cmp byte [ebp + 0xb], 0
sete al
cmp byte [ebp + 0xc], 0
jne 0x474e30
test al, al
je 0x474e30
push dword [ebx + 4]
call fcn.0044207c
test al, al
jne 0x474e30
push 1
push 0
push edi
push dword [ebx + 4]
call esi
mov byte [ebp - 1], 1
xor edi, edi
push edi
push str.Thanks
push str.Settings
call fcn.004014f2
test al, al
jne 0x474e5a
push edi
push 0x36ee800
push 0x3e4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0040134a
test al, al
je 0x474e79
push ebx
call fcn.0047da50
push eax
push str.lluim
push str.UsageStatsChoice
call fcn.004248a7
cmp byte [ebp - 1], 0
jne 0x474ea6
call fcn.0044f254
test al, al
jne 0x474e91
call fcn.0044f44e
test al, al
je 0x474ea6
push dword [0x5a9cc0]
mov ecx, dword [0x5a5314]
lea eax, [ebx + 0x4d]
push eax
call fcn.00440d7c
mov eax, 0x5aa818
call fcn.0044bf28
call fcn.0044f254
test al, al
je 0x474ec3
push str.LikeSurvey
call fcn.00451db6
cmp byte [ebp + 0xc], 0
mov dword [0x5a9cac], 5
jne 0x47500c
push edi
push edi
push 0x806a
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x47500c
push edi
push edi
push edi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 1
jne 0x47501f
mov eax, dword [ebx + 0x31]
cmp eax, edi
je 0x474f27
sub esp, 0x1c
push 7
pop ecx
mov edi, esp
lea esi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.00476d6f
xor edi, edi
test al, al
jne 0x47500c
cmp dword [ebp - 0x40], 0x100
jne 0x474f7d
cmp byte [ebp - 0x3c], 0x52
jne 0x474f7d
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov edi, 0x8000
test di, ax
je 0x474f7b
push 0x10
call esi
test di, ax
je 0x474f7b
push 0x12
call esi
test di, ax
je 0x474f7b
push dword [ebx + 4]
call fcn.0044f440
call fcn.0044f1fa
test al, al
je 0x474f7b
mov esi, dword [ebx + 0x56]
test esi, esi
je 0x474f7b
push 0x61
call fcn.00481d8c
xor edi, edi
mov eax, dword [ebx + 0x56]
cmp eax, edi
je 0x474fba
mov ecx, dword [ebp - 0x40]
cmp ecx, 0x100
jb 0x474fb4
cmp ecx, 0x101
jbe 0x474fa7
cmp ecx, 0x103
jbe 0x474fb4
cmp ecx, 0x105
ja 0x474fb4
push dword [ebp - 0x3c]
push eax
mov eax, ecx
call fcn.004852d5
jmp 0x474fb6
xor al, al
test al, al
jne 0x47500c
push dword [ebp - 0x38]
lea ecx, [ebx + 0x39]
push dword [ebp - 0x3c]
mov eax, dword [ecx]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call dword [eax + 0x10]
test al, al
je 0x474fdb
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
jmp 0x47500c
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [ebp - 0x44]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x475004
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
lea esi, [ebx + 0x35]
call fcn.00421cba
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x474eec
jmp 0x475028
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x475028
push dword [ebx + 0x489]
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
call esi
push dword [ebx + 0x4b2]
mov dword [ebx + 0x4d2], edi
call esi
push 0xffffffffffffffff
lea esi, [ebx + 0x480]
call fcn.00454c78
mov dword [0x5a9cac], 4
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebx
leave
ret 8