Function at 0x49e7e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
cmp eax, 0x206
jg 0x49e864
je 0x49e8dc
cmp eax, 0x102
jg 0x49e83e
je 0x49ec70
sub eax, 2
je 0x49e8bd
sub eax, 0xd
je 0x49f22a
sub eax, 0x38
je case.0x49e872.1126
sub eax, 0xb9
je 0x49e99b
jmp case.0x49e872.1127
sub eax, 0x104
je 0x49e91a
add eax, 0xfffffff1
sub eax, 3
jb 0x49e8dc
add eax, 0xffffff16
sub eax, 5
jb 0x49e8dc
jmp case.0x49e872.1127
add eax, 0xfffffb9b
cmp eax, 0x10
ja case.0x49e872.1127
jmp dword [eax*4 + 0x49e879]
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
mov eax, dword [ebp + 8]
push eax
push 0x4e3168
call sym.Cari___.exe__Tablefunction
add esp, 0x14
jmp case.0x49e872.1127
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
mov eax, dword [ebp + 8]
push eax
push 0x4e3168
call sym.Cari___.exe__Tablefunction
add esp, 0x14
jmp case.0x49e872.1127
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
mov eax, dword [ebp + 8]
push eax
push 0x4e3168
call sym.Cari___.exe__Tablefunction
add esp, 0x14
jmp 0x49f256
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
mov eax, dword [ebp + 8]
push eax
push 0x4e3168
call sym.Cari___.exe__Tablefunction
add esp, 0x14
test eax, eax
je 0x49e942
mov eax, 1
jmp 0x49f256
push 0x10
call sub.USER32.DLL_GetKeyState
movsx edx, ax
and edx, 0x8000
mov dword [ebp - 0x10], edx
push 0x11
call sub.USER32.DLL_GetKeyState
movsx ecx, ax
and ecx, 0x8000
mov eax, dword [0x4e3278]
mov dword [ebp - 0xc], ecx
push eax
push 0x4e316c
call sym.Cari___.exe__Getsortedbyselection
add esp, 8
mov ebx, eax
push ebx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp - 0x10]
push edx
push 1
mov ecx, dword [ebp - 0xc]
push ecx
push 0x14
call fcn.00496e98
add esp, 0x18
jmp 0x49f256
push 0x10
call sub.USER32.DLL_GetKeyState
movsx eax, ax
and eax, 0x8000
mov dword [ebp - 0x10], eax
push 0x11
call sub.USER32.DLL_GetKeyState
movsx edx, ax
and edx, 0x8000
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push 3
push 0x4e3168
call sym.Cari___.exe__Gettableselectionxy
add esp, 0x10
mov edx, dword [0x4e3278]
push edx
push 0x4e316c
call sym.Cari___.exe__Getsortedbyselection
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x49e9fb
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x49ea78
mov eax, dword [ebx]
push eax
call sym.Cari___.exe__Findmemory
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x49ea2a
push 3
mov edx, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push ecx
lea eax, [ebp - 0x21c]
push eax
call sym.Cari___.exe__Readmemory
add esp, 0x10
cmp eax, dword [ebx + 4]
je 0x49ea2f
or esi, 0xffffffff
jmp 0x49ea78
mov eax, dword [ebx + 4]
push eax
lea edx, [ebx + 0xc]
push edx
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004a37d4
add esp, 0xc
test eax, eax
jne 0x49ea4e
xor esi, esi
jmp 0x49ea78
mov eax, dword [ebx + 4]
push eax
lea edx, [ebx + 0x10c]
push edx
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004a37d4
add esp, 0xc
test eax, eax
jne 0x49ea73
mov esi, 1
jmp 0x49ea78
mov esi, 2
cmp dword [ebp - 0xc], 0
jne 0x49ead0
cmp dword [ebp + 0x10], 0x71
je 0x49ea90
cmp dword [ebp + 0x10], 0x73
jne 0x49ead0
cmp dword [ebp - 0x10], 0
je 0x49ead0
cmp dword [ebp - 0x18], 0
je 0x49ead0
test ebx, ebx
je 0x49ead0
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [0x4e33a1]
push ecx
push 0
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebx]
push ecx
call fcn.00419974
add esp, 0x1c
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call sub.USER32.DLL_InvalidateRect
jmp 0x49ec66
cmp dword [ebp - 0xc], 0
jne 0x49eb00
cmp dword [ebp - 0x10], 0
jne 0x49eb00
cmp dword [ebp + 0x10], 0xd
jne 0x49eb00
test ebx, ebx
je 0x49eb00
test esi, esi
jl 0x49eb00
push 0xd
mov edx, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push ecx
call sym.Cari___.exe__Setdisasm
add esp, 0xc
jmp 0x49ec66
cmp dword [ebp + 0x10], 0x2e
jne 0x49eb50
cmp dword [ebp - 0xc], 0
jne 0x49eb50
test ebx, ebx
je 0x49eb50
mov eax, dword [0x4e3278]
cmp eax, dword [0x4e3270]
jge 0x49eb2e
push 2
inc eax
push eax
push 0x4e3168
call sym.Cari___.exe__Selectandscroll
add esp, 0xc
mov edx, dword [ebx]
push edx
push 0x4e316c
call sym.Cari___.exe__Deletesorteddata
add esp, 8
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.DLL_InvalidateRect
jmp 0x49ec66
cmp dword [ebp + 0x10], 0x20
jne 0x49ec2a
cmp dword [ebp - 0xc], 0
jne 0x49ec2a
test ebx, ebx
je 0x49ec2a
test esi, esi
je 0x49eb79
cmp esi, 1
jne 0x49ec2a
push 0x1000c
mov eax, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push edx
call sym.Cari___.exe__Setdisasm
add esp, 0xc
push 0x35
call fcn.0041d0c8
pop ecx
test eax, eax
je 0x49ebc8
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x24], 0
jne 0x49ebc8
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx]
cmp ecx, dword [eax + 0x375]
jne 0x49ebc8
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 4]
cmp ecx, dword [eax + 0x379]
jne 0x49ebc8
push 1
push eax
call sym.Cari___.exe__Dumpbackup
add esp, 8
push 5
test esi, esi
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx]
push eax
jne 0x49ebdd
lea edx, [ebx + 0x10c]
jmp 0x49ebe0
lea edx, [ebx + 0xc]
push edx
call sym.Cari___.exe__Writememory
add esp, 0x10
push 0x1800c
mov eax, dword [ebx + 4]
push eax
mov ecx, dword [ebx]
push ecx
call sym.Cari___.exe__Setdisasm
add esp, 0xc
mov eax, dword [0x4e3278]
cmp eax, dword [0x4e3270]
jge 0x49ec1b
push 2
inc eax
push eax
push 0x4e3168
call sym.Cari___.exe__Selectandscroll
add esp, 0xc
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call sub.USER32.DLL_InvalidateRect
jmp 0x49ec66
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
mov edx, dword [ebp + 8]
push edx
push 0x4e3168
call sym.Cari___.exe__Tablefunction
add esp, 0x14
test eax, eax
jne 0x49ec66
push ebx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp - 0x10]
push eax
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x14
call fcn.00496e98
add esp, 0x18
jmp 0x49f256
mov eax, 1
jmp 0x49f256
cmp dword [0x4e3288], 0
je 0x49ed0c
cmp dword [ebp + 0x10], 0x2d
jne 0x49ec8c
cmp dword [0x4e3278], 0
jg 0x49eca1
cmp dword [ebp + 0x10], 0x2b
jne 0x49ed0c
mov edx, dword [0x4e3270]
dec edx
cmp edx, dword [0x4e3278]
jle 0x49ed0c
push 2
mov ecx, 1
cmp dword [ebp + 0x10], 0x2b
je 0x49ecb1
add ecx, 0xfffffffe
add ecx, dword [0x4e3278]
push ecx
push 0x4e3168
call sym.Cari___.exe__Selectandscroll
add esp, 0xc
mov eax, dword [0x4e3278]
push eax
push 0x4e316c
call sym.Cari___.exe__Getsortedbyselection
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x49ecff
mov eax, dword [ebx]
push eax
call sym.Cari___.exe__Findmemory
pop ecx
test eax, eax
je 0x49ecff
push 0x1000c
mov edx, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push ecx
call sym.Cari___.exe__Setdisasm
add esp, 0xc
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call sub.USER32.DLL_InvalidateRect
xor eax, eax
jmp 0x49f256
mov edx, dword [0x4e3278]
push edx
push 0x4e316c
call sym.Cari___.exe__Getsortedbyselection
add esp, 8
mov ebx, eax
call sub.USER32.DLL_CreatePopupMenu
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x1c], 0
je 0x49ef31
cmp dword [0x4d5a68], 0
je 0x49ed5b
push 0x4ca2d5
push 1
push 0
mov edx, dword [ebp - 0x1c]
push edx
call sub.USER32.DLL_AppendMenuA
test ebx, ebx
je 0x49ef31
mov ecx, dword [ebx]
push ecx
call sym.Cari___.exe__Findmemory
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x49ed92
push 3
mov eax, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push edx
lea ecx, [ebp - 0x21c]
push ecx
call sym.Cari___.exe__Readmemory
add esp, 0x10
cmp eax, dword [ebx + 4]
je 0x49ed97
or esi, 0xffffffff
jmp 0x49ede0
mov eax, dword [ebx + 4]
push eax
lea edx, [ebx + 0xc]
push edx
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004a37d4
add esp, 0xc
test eax, eax
jne 0x49edb6
xor esi, esi
jmp 0x49ede0
mov eax, dword [ebx + 4]
push eax
lea edx, [ebx + 0x10c]
push edx
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004a37d4
add esp, 0xc
test eax, eax
jne 0x49eddb
mov esi, 1
jmp 0x49ede0
mov esi, 2
cmp dword [ebp - 0x18], 0
je 0x49edf8
push 0x4ca2df
push 2
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.USER32.DLL_AppendMenuA
cmp dword [0x4e3278], 0
jle 0x49ee13
push 0x4ca2fc
push 3
push 0
mov edx, dword [ebp - 0x1c]
push edx
call sub.USER32.DLL_AppendMenuA
mov ecx, dword [0x4e3270]
dec ecx
cmp ecx, dword [0x4e3278]
jle 0x49ee34
push 0x4ca312
push 4
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.USER32.DLL_AppendMenuA
push 0x4ca29e
push 0
push 0x800
mov edx, dword [ebp - 0x1c]
push edx
call sub.USER32.DLL_AppendMenuA
cmp dword [ebp - 0x18], 0
je 0x49ee65
test esi, esi
jne 0x49ee65
push 0x4ca323
push 0xb
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.USER32.DLL_AppendMenuA
cmp dword [ebp - 0x18], 0
je 0x49ee80
dec esi
jne 0x49ee80
push 0x4ca335
push 0xc
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.USER32.DLL_AppendMenuA
push 0x4ca351
push 0xd
push 0
mov edx, dword [ebp - 0x1c]
push edx
call sub.USER32.DLL_AppendMenuA
mov ecx, dword [ebx]
push ecx
call sym.Cari___.exe__Findmodule
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49eed5
mov eax, dword [ebp - 0x14]
add eax, 0x48
push eax
push 8
push 0x4ca363
lea edx, [ebp - 0x11c]
push edx
call fcn.004a6c2c
add esp, 0x10
lea ecx, [ebp - 0x11c]
push ecx
push 0xe
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.USER32.DLL_AppendMenuA
cmp dword [0x4d36d8], 2
je 0x49eee6
cmp dword [ebx], 0x80000000
jae 0x49ef31
push 0x4ca29e
push 0
push 0x800
mov edx, dword [ebp - 0x1c]
push edx
call sub.USER32.DLL_AppendMenuA
push 0x4ca385
push 0x1f
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.USER32.DLL_AppendMenuA
push 0x4ca39b
push 0x20
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.USER32.DLL_AppendMenuA
push 0x4ca3bc
push 0x21
push 0
mov edx, dword [ebp - 0x1c]
push edx
call sub.USER32.DLL_AppendMenuA
push ebx
push 0x14
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004964e8
add esp, 0xc
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0x465
mov edx, dword [ebp + 8]
push edx
push 0x4e3168
call sym.Cari___.exe__Tablefunction
add esp, 0x14
mov esi, eax
call fcn.0049659c
cmp dword [ebp - 0x1c], 0
je 0x49ef72
mov eax, dword [ebp - 0x1c]
push eax
call sub.USER32.DLL_DestroyMenu
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 3
push 0x4e3168
call sym.Cari___.exe__Gettableselectionxy
add esp, 0x10
cmp esi, 1
jne 0x49efb9
mov eax, dword [0x4d7218]
xor esi, esi
mov dword [ebp - 0x14], eax
jmp 0x49efac
mov eax, dword [ebp - 0x14]
push eax
call fcn.0049e214
pop ecx
inc esi
add dword [ebp - 0x14], 0x465
cmp esi, dword [0x4d7200]
jl 0x49ef9a
jmp 0x49f185
cmp esi, 2
jne 0x49efd4
push 0xd
mov edx, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push ecx
call sym.Cari___.exe__Setdisasm
add esp, 0xc
jmp 0x49f185
cmp esi, 3
jne 0x49eff0
push 0
push 0x2d
push 0x102
mov eax, dword [ebp + 8]
push eax
call fcn.0049e7e8
jmp 0x49f185
cmp esi, 4
jne 0x49f00c
push 0
push 0x2b
push 0x102
mov edx, dword [ebp + 8]
push edx
call fcn.0049e7e8
jmp 0x49f185
cmp esi, 0xb
je 0x49f01a
cmp esi, 0xc
jne 0x49f0a4
push 0x1000c
mov ecx, dword [ebx + 4]
push ecx
mov eax, dword [ebx]
push eax
call sym.Cari___.exe__Setdisasm
add esp, 0xc
push 0x35
call fcn.0041d0c8
pop ecx
test eax, eax
je 0x49f069
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x24], 0
jne 0x49f069
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
cmp edx, dword [eax + 0x375]
jne 0x49f069
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
cmp edx, dword [eax + 0x379]
jne 0x49f069
push 1
push eax
call sym.Cari___.exe__Dumpbackup
add esp, 8
push 5
cmp esi, 0xb
mov eax, dword [ebx + 4]
push eax
mov ecx, dword [ebx]
push ecx
jne 0x49f07f
lea eax, [ebx + 0x10c]
jmp 0x49f082
lea eax, [ebx + 0xc]
push eax
call sym.Cari___.exe__Writememory
add esp, 0x10
push 0x1800c
mov edx, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push ecx
call sym.Cari___.exe__Setdisasm
add esp, 0xc
jmp 0x49f185
cmp esi, 0xd
jne 0x49f0be
mov eax, dword [ebx]
push eax
push 0x4e316c
call sym.Cari___.exe__Deletesorteddata
add esp, 8
jmp 0x49f185
cmp esi, 0xe
jne 0x49f0fa
mov edx, dword [ebx]
push edx
call sym.Cari___.exe__Findmodule
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49f185
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov edx, eax
add edx, dword [ecx + 4]
push edx
push eax
push 0x4e316c
call sym.Cari___.exe__Deletesorteddatarange
add esp, 0xc
jmp 0x49f185
cmp esi, 0x1f
jne 0x49f121
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [0x4e33a1]
push ecx
push 0
push 0
push 0x71
mov eax, dword [ebx]
push eax
call fcn.00419974
add esp, 0x1c
jmp 0x49f185
cmp esi, 0x20
jne 0x49f147
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [0x4e33a1]
push eax
push 0
push 1
push 0x71
mov edx, dword [ebx]
push edx
call fcn.00419974
add esp, 0x1c
jmp 0x49f185
cmp esi, 0x21
jne 0x49f16e
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ebp - 4]
push eax
mov edx, dword [0x4e33a1]
push edx
push 0
push 1
push 0x73
mov ecx, dword [ebx]
push ecx
call fcn.00419974
add esp, 0x1c
jmp 0x49f185
push ebx
push esi
push 0x14
call fcn.004965e4
add esp, 0xc
test eax, eax
jne 0x49f185
xor eax, eax
jmp 0x49f256
test esi, esi
je case.0x49e872.1127
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call sub.USER32.DLL_InvalidateRect
jmp case.0x49e872.1127
mov esi, dword [0x4e33a9]
add esi, dword [ebp + 0x14]
test esi, esi
jl 0x49f1d9
cmp esi, dword [0x4e3270]
jge 0x49f1d9
push esi
push 0x4e316c
call sym.Cari___.exe__Getsortedbyselection
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x49f1d9
push 0xd
mov eax, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push edx
call sym.Cari___.exe__Setdisasm
add esp, 0xc
mov eax, 1
jmp 0x49f256
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call sub.USER32.DLL_InvalidateRect
xor eax, eax
jmp 0x49f256
mov edx, dword [0x4d7218]
xor esi, esi
mov dword [ebp - 0x14], edx
jmp 0x49f210
mov eax, dword [ebp - 0x14]
push eax
call fcn.0049e214
pop ecx
inc esi
add dword [ebp - 0x14], 0x465
cmp esi, dword [0x4d7200]
jl 0x49f1fe
xor eax, eax
jmp 0x49f256
or dword [0x4d54cc], 0x10000
xor eax, eax
jmp 0x49f256
push 0x49e4ec
push 0x4e3168
mov edx, dword [ebp + 8]
push edx
call sym.Cari___.exe__Painttable
add esp, 0xc
xor eax, eax
jmp 0x49f256
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
mov eax, dword [ebp + 8]
push eax
call sub.USER32.DLL_DefMDIChildProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10