Function at 0x4913fa
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x49146a
cmp dword [ebp + 0x1c], 0x6a
jne 0x4917d2
cmp dword [ebp + 0xc], 0x100
jne 0x4917d2
xor ebx, ebx
cmp dword [ebp + 0x10], 0x61
mov dword [edi + 0x5b4], ebx
je 0x491437
cmp dword [ebp + 0x10], 0x41
jne 0x491451
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x491451
sub esp, 0xc
lea ecx, [edi + 0x588]
call fcn.00494d55
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x5b4], ebx
je 0x4917d2
xor eax, eax
inc eax
jmp 0x4917d4
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
inc ebx
cmp ecx, 0x113
jne 0x4914a3
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.0049299f
mov ecx, dword [ebp + 0x18]
mov dword [ecx], esi
cmp dword [edi + 0x5b4], esi
je 0x4917a8
mov eax, ebx
jmp 0x4917d4
cmp ecx, 0x4e
jne 0x4914ca
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 0xffffffff
jne 0x4917a5
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491291
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x491490
cmp ecx, 0x110
jne 0x4914f6
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491e70
mov esi, dword [ebp + 0x18]
mov dword [esi], eax
cmp dword [edi + 0x5b4], 0
jne 0x49149c
mov ecx, esi
jmp 0x4917a8
cmp ecx, 0x10
jne 0x491517
push esi
push 2
push 0x111
push dword [edi + 4]
mov dword [edi + 0x5b4], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x49148b
push 2
pop edx
cmp ecx, edx
jne 0x49153e
lea eax, [edi + 0x63c]
mov dword [edi + 0x5b4], ebx
push eax
push edx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, edi
call fcn.0044e254
jmp 0x49148b
cmp ecx, 0x112
jne 0x491571
mov eax, dword [ebp + 0x10]
and eax, 0xfff0
mov dword [edi + 0x5b4], esi
cmp eax, 0xf060
jne 0x49148b
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004927da
jmp 0x49148b
cmp ecx, 0x111
jne 0x49159b
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
mov dword [edi + 0x5b4], ebx
push ecx
mov dword [eax], ecx
mov ecx, edi
mov eax, dword [ebp + 0x10]
shr eax, 0x10
push eax
call fcn.0049399f
jmp 0x49148b
cmp ecx, 0x133
jne 0x4915c5
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
push ecx
mov dword [edi + 0x5b4], ebx
mov dword [eax], ecx
mov eax, esp
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov ecx, edi
call fcn.0049381a
jmp 0x4914c3
cmp ecx, 0x467
jne 0x4915ef
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00492f89
push dword [ebp + 0x10]
mov ecx, edi
push ebx
call fcn.00492d06
jmp 0x49148b
cmp ecx, 0x46b
jne 0x49160e
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.004921d7
jmp 0x4914c3
cmp ecx, 0x46e
jne 0x491648
mov dword [edi + 0x5b4], ebx
mov dword [edi + 0x618], 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.005f2c37
pop ecx
push esi
push 0x96
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x49148b
cmp ecx, 0x46d
jne 0x491669
push esi
push 0xc8
lea ecx, [edi + 0x28]
mov dword [edi + 0x5b4], ebx
call fcn.004486fc
jmp 0x49148b
cmp ecx, 0x470
jne 0x491686
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.0049226f
jmp 0x4914c3
cmp ecx, 0x471
jne 0x4916a3
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.004922e6
jmp 0x4914c3
cmp ecx, 0x46c
jne 0x4916c2
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.00492467
jmp 0x4914c3
cmp ecx, 0x468
jne 0x491711
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x10], edx
jne 0x491707
cmp dword [ebp + 0x14], 0x204
je 0x4916e4
cmp dword [ebp + 0x14], 0x201
jne 0x491707
cmp byte [edi + 0x5f0], 0
jne 0x4916f3
mov byte [edi + 0x5f0], bl
push 9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], esi
jmp 0x49149c
cmp ecx, 0x46a
jne 0x49172c
push edx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00448883
jmp 0x49148b
cmp ecx, 0x472
jne 0x491746
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004928f8
jmp 0x49148b
cmp ecx, 0x474
jne 0x491763
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.004924c8
jmp 0x4914c3
cmp ecx, 0x476
jne 0x491785
mov ecx, dword [ebp + 0x14]
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.0049254a
jmp 0x4914c3
cmp ecx, 0x479
jne 0x4917a5
mov ecx, dword [ebp + 0x14]
push ecx
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00492766
jmp 0x4914c3
mov ecx, dword [ebp + 0x18]
mov esi, dword [edi + 0x578]
push 0
push ecx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044b52f
mov dword [edi + 0x578], esi
test eax, eax
jne 0x49149c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18