Function at 0x1004958c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x100495a7
xor eax, eax
jmp 0x100499a3
mov esi, dword [ebp + 0xc]
lea edi, [ebx - 0x14c]
lea eax, [esi - 0x400]
cmp eax, 0x7bff
ja 0x100495d7
push 0
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push esi
call fcn.1002f51c
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x100499a0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call fcn.10026bc7
test eax, eax
jne 0x100499a0
mov eax, 0x110
cmp esi, eax
ja 0x10049850
je 0x10049a6c
cmp esi, 0x21
ja 0x100496d9
je 0x100496bb
mov eax, esi
sub eax, 6
je 0x10049897
sub eax, 9
je 0x10049659
sub eax, 1
je 0x10049644
push 4
pop ecx
sub eax, ecx
je 0x100499a0
sub eax, 8
je 0x10049897
sub eax, ecx
je 0x10049a6c
jmp 0x100498a7
push 0
push 2
push 0x111
mov ecx, edi
call fcn.1002f6be
jmp 0x100499a0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x100498a7
mov ecx, edi
call fcn.1003a2de
test al, al
je 0x100499a0
mov ecx, edi
call fcn.10047be0
test eax, eax
je 0x100496a1
push dword [ebp + 0x18]
mov ecx, dword [ebx + 0x20]
lea edx, [ebp + 0x14]
push edx
push dword [ebp + 0x10]
mov eax, dword [ecx]
push 0xf
push dword [ebx + 0xc]
push edi
call dword [eax + 8]
jmp 0x100499a0
push 0
mov ecx, edi
call fcn.10047cd9
mov ecx, dword [ebp + 8]
movzx edx, al
call fcn.10048ca9
pop ecx
jmp 0x100499a0
test dword [ebx - 0xa8], 0x8000000
je 0x100498a7
mov eax, dword [ebp + 0x18]
mov dword [eax], 3
jmp 0x100499a0
mov eax, esi
sub eax, 0x24
je 0x1004983a
sub eax, 0x19
je 0x1004981f
sub eax, 0x45
je 0x100497f8
push 4
pop ecx
sub eax, ecx
je 0x10049897
sub eax, 1
je 0x100497a4
sub eax, 0x79
jne 0x100498a7
cmp dword [ebp + 0x10], 0x5b
je 0x10049723
cmp dword [ebp + 0x10], 0x5c
jne 0x100498a7
test dword [ebx - 0xac], 0x10000
jne 0x100498a7
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10088b00]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100897ec]
cmp eax, dword [ecx + 4]
jle 0x10049784
push 0x100897ec
call fcn.1005ec9e
cmp dword [0x100897ec], 0xffffffff
pop ecx
jne 0x10049784
push 0x10064ed4
mov dword [0x10088c74], 0x1006d30c
call fcn.1005f454
mov dword [esp], 0x100897ec
call fcn.1005ec54
pop ecx
call fcn.10051fea
push 0x10088c74
mov ecx, eax
call fcn.1000ee20
mov ecx, 0x10088c74
call sym.WCLDll.dll_public:_void___thiscall_AT::CHookKeyboardLL::SetHook_void_
jmp 0x100498a7
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x100497ee
cmp dword [eax + 4], 0x100
jne 0x100497ee
cmp dword [eax + 8], 9
jne 0x100497ee
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, eax
mov eax, dword [ebx - 0x140]
and edx, 0x8000
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x100497ee
push 0
call fcn.10027686
pop ecx
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 7
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
jmp 0x100499a0
or dword [ebx - 0xf4], 2
mov ecx, edi
call fcn.1002f0fc
call fcn.1003dadf
mov dword [ebx + 0x20], eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100498a7
push dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0x14]
call fcn.10048df1
pop ecx
pop ecx
test eax, eax
je 0x100498a7
jmp 0x100499a0
push 3
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push 0x24
call fcn.1002f51c
jmp 0x100499a3
mov eax, 0x2e0
cmp esi, eax
ja 0x100499d6
je 0x10049897
cmp esi, 0x212
ja 0x100499c5
cmp esi, 0x211
jae 0x10049897
cmp esi, 0x112
je 0x100499ac
cmp esi, 0x115
jbe 0x100498a7
cmp esi, 0x117
jbe 0x10049897
cmp esi, 0x125
jne 0x100498a7
push 3
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push esi
call fcn.1002f51c
push dword [ebp + 0x18]
mov eax, dword [ebx - 0x140]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [eax + 8]
push esi
push dword [ebp + 8]
mov ecx, dword [eax + 4]
push edi
call fcn.100265f1
test eax, eax
jne 0x100499a0
lea eax, [esi - 0x200]
cmp eax, 9
ja 0x10049912
mov edx, dword [ebp + 0x14]
push ecx
push ecx
mov ecx, esp
movsx eax, dx
shr edx, 0x10
push ecx
push ecx
push dword [ebp + 0x10]
mov dword [ecx], eax
movsx eax, dx
mov dword [ecx + 4], eax
mov eax, dword [ebx - 0x140]
push esi
push edi
mov eax, dword [eax + 8]
mov ecx, dword [eax + 4]
call fcn.100260f4
cmp esi, 0x205
jne 0x100499a0
push dword [ebp + 0x18]
mov ecx, dword [ebx + 0x20]
lea edx, [ebp + 0x14]
push edx
push dword [ebp + 0x10]
mov eax, dword [ecx]
push esi
push dword [ebp + 8]
push edi
call dword [eax + 8]
test eax, eax
jne 0x100499a0
cmp esi, 0x815e
je 0x100499a0
cmp esi, 0x46
je 0x100499a0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call dword [ebx + 0x24]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp esi, 0x128
jne 0x100499a0
push 0
push 0
push 0x129
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov edx, dword [ebx - 0xf4]
mov ecx, edx
and ecx, 0xffffffef
or edx, 0x10
and eax, 1
cmove edx, ecx
mov dword [ebx - 0xf4], edx
mov eax, dword [ebx - 0x140]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
call dword [eax + 0x58]
test eax, eax
je 0x100499a0
mov edx, dword [eax]
lea ecx, [eax + 0x5c]
push ecx
mov ecx, eax
call dword [edx + 0x24]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0xf090
cmp dword [ebp + 0x10], eax
jne 0x100498a7
push 0
push eax
push edi
call fcn.1004948a
jmp 0x100499a0
mov eax, esi
sub eax, 0x213
je 0x100499a0
sub eax, 0x33
jmp 0x10049895
mov eax, esi
sub eax, 0x2e4
je 0x10049897
sub eax, 0x2e
je 0x10049897
sub eax, 1
je 0x10049b27
sub eax, 0x7e28
je 0x10049b06
sub eax, 0x26
je 0x10049a17
sub eax, 0x98
jne 0x100498a7
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
jmp 0x100499a0
mov eax, dword [ebx - 0x140]
mov esi, dword [ebp + 0x14]
push esi
push edi
mov eax, dword [eax + 8]
mov ecx, dword [eax + 4]
add ecx, 8
call fcn.100276bd
test eax, eax
jne 0x100499a0
mov ecx, edi
call fcn.100305c7
mov dword [esp + 0xc], eax
mov ecx, edi
mov dword [esp + 0x14], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
call fcn.10030a8c
test eax, eax
je 0x10049a7a
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 1
jmp 0x100499a0
push 0xfffffffffffffff0
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor esi, esi
test eax, 0x40000000
je 0x10049aa3
test dword [ebx - 0xa8], 0x10000
jne 0x10049aa3
cmp dword [ebx - 0x11c], esi
je 0x10049ad5
push esi
push dword [ebp + 0x18]
lea ecx, [ebx - 0x134]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x8161
push edi
call fcn.1002e0b1
jmp 0x100499a3
push esi
push esi
push 0x81f9
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x10049ae9
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_GetParent]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x10049ac3
jmp 0x10049aa3
push esi
push dword [ebp + 0x14]
mov ecx, eax
push dword [ebp + 0x10]
push 0x8161
call fcn.1002f51c
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x100499a3
mov eax, dword [ebp + 0x14]
cmp byte [edi + 0x128], al
je 0x100499a0
mov byte [edi + 0x128], al
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x34]
jmp 0x100499a0
mov ecx, dword [ebp + 0x14]
movsx eax, cx
mov dword [esp + 0xc], eax
mov eax, ecx
shr eax, 0x10
cwde
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push ecx
jmp 0x100499bd