Function at 0x490f4d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x490fbd
cmp dword [ebp + 0x1c], 0x6a
jne 0x491325
cmp dword [ebp + 0xc], 0x100
jne 0x491325
xor ebx, ebx
cmp dword [ebp + 0x10], 0x61
mov dword [edi + 0x5b4], ebx
je 0x490f8a
cmp dword [ebp + 0x10], 0x41
jne 0x490fa4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x490fa4
sub esp, 0xc
lea ecx, [edi + 0x588]
call fcn.00494841
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x5b4], ebx
je 0x491325
xor eax, eax
inc eax
jmp 0x491327
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
inc ebx
cmp ecx, 0x113
jne 0x490ff6
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004924e7
mov ecx, dword [ebp + 0x18]
mov dword [ecx], esi
cmp dword [edi + 0x5b4], esi
je 0x4912fb
mov eax, ebx
jmp 0x491327
cmp ecx, 0x4e
jne 0x49101d
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 0xffffffff
jne 0x4912f8
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00490de4
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x490fe3
cmp ecx, 0x110
jne 0x491049
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004919c0
mov esi, dword [ebp + 0x18]
mov dword [esi], eax
cmp dword [edi + 0x5b4], 0
jne 0x490fef
mov ecx, esi
jmp 0x4912fb
cmp ecx, 0x10
jne 0x49106a
push esi
push 2
push 0x111
push dword [edi + 4]
mov dword [edi + 0x5b4], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x490fde
push 2
pop edx
cmp ecx, edx
jne 0x491091
lea eax, [edi + 0x63c]
mov dword [edi + 0x5b4], ebx
push eax
push edx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, edi
call fcn.0044e203
jmp 0x490fde
cmp ecx, 0x112
jne 0x4910c4
mov eax, dword [ebp + 0x10]
and eax, 0xfff0
mov dword [edi + 0x5b4], esi
cmp eax, 0xf060
jne 0x490fde
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00492322
jmp 0x490fde
cmp ecx, 0x111
jne 0x4910ee
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
mov dword [edi + 0x5b4], ebx
push ecx
mov dword [eax], ecx
mov ecx, edi
mov eax, dword [ebp + 0x10]
shr eax, 0x10
push eax
call fcn.00493488
jmp 0x490fde
cmp ecx, 0x133
jne 0x491118
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
push ecx
mov dword [edi + 0x5b4], ebx
mov dword [eax], ecx
mov eax, esp
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov ecx, edi
call fcn.00493303
jmp 0x491016
cmp ecx, 0x467
jne 0x491142
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00492ad1
push dword [ebp + 0x10]
mov ecx, edi
push ebx
call fcn.0049284e
jmp 0x490fde
cmp ecx, 0x46b
jne 0x491161
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.00491d27
jmp 0x491016
cmp ecx, 0x46e
jne 0x49119b
mov dword [edi + 0x5b4], ebx
mov dword [edi + 0x618], 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.005f2387
pop ecx
push esi
push 0x96
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x490fde
cmp ecx, 0x46d
jne 0x4911bc
push esi
push 0xc8
lea ecx, [edi + 0x28]
mov dword [edi + 0x5b4], ebx
call fcn.004486ab
jmp 0x490fde
cmp ecx, 0x470
jne 0x4911d9
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.00491dbf
jmp 0x491016
cmp ecx, 0x471
jne 0x4911f6
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.00491e36
jmp 0x491016
cmp ecx, 0x46c
jne 0x491215
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.00491fb7
jmp 0x491016
cmp ecx, 0x468
jne 0x491264
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x10], edx
jne 0x49125a
cmp dword [ebp + 0x14], 0x204
je 0x491237
cmp dword [ebp + 0x14], 0x201
jne 0x49125a
cmp byte [edi + 0x5f0], 0
jne 0x491246
mov byte [edi + 0x5f0], bl
push 9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], esi
jmp 0x490fef
cmp ecx, 0x46a
jne 0x49127f
push edx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00448832
jmp 0x490fde
cmp ecx, 0x472
jne 0x491299
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00492440
jmp 0x490fde
cmp ecx, 0x474
jne 0x4912b6
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.00492018
jmp 0x491016
cmp ecx, 0x476
jne 0x4912d8
mov ecx, dword [ebp + 0x14]
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.00492092
jmp 0x491016
cmp ecx, 0x479
jne 0x4912f8
mov ecx, dword [ebp + 0x14]
push ecx
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004922ae
jmp 0x491016
mov ecx, dword [ebp + 0x18]
mov esi, dword [edi + 0x578]
push 0
push ecx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044b4de
mov dword [edi + 0x578], esi
test eax, eax
jne 0x490fef
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18