Function at 0x489825
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x20
mov eax, 0x5a6adc
call fcn.0057bb80
mov ebx, dword [ebp + 8]
xor edi, edi
test ebx, ebx
jne 0x48983f
mov dword [ebp - 0x20], edi
jmp 0x489845
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
mov dword [ebp - 0x28], eax
call fcn.0043504b
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], esi
cmp eax, 0x100
jb 0x489873
cmp eax, 0x109
jbe 0x489881
add eax, 0xfffffe00
cmp eax, 9
ja 0x48994e
test esi, esi
je 0x48994e
mov eax, esi
mov dword [ebp - 0x18], esi
cmp dword [eax + 0x74], edi
jne 0x4898c3
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0043504b
cmp eax, ebx
mov eax, dword [ebp - 0x18]
je 0x4898bf
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0043504b
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x48988e
test eax, eax
je 0x4898f4
mov ecx, dword [eax + 0x74]
test ecx, ecx
je 0x4898f4
mov ecx, dword [ecx + 0x58]
test ecx, ecx
je 0x4898f4
mov eax, dword [ecx]
push dword [ebp + 0xc]
push ecx
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x5b2a2c]
call esi
test eax, eax
jne 0x4898ee
inc eax
jmp 0x489a4f
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x101
je 0x48990f
cmp ecx, 0x100
je 0x48990f
cmp ecx, 0x102
jne 0x48994e
test eax, eax
je 0x48994e
mov edx, dword [eax + 0x74]
test edx, edx
je 0x48994e
mov eax, dword [ebp + 0xc]
push 0xd
movzx ecx, word [eax + 8]
mov dword [ebp - 0x18], ecx
pop ecx
cmp word [ebp - 0x18], cx
jne 0x48993c
test byte [edx + 0x84], 1
jne 0x4899dc
jmp 0x489951
push 0x1b
pop ecx
cmp word [ebp - 0x18], cx
jne 0x489951
test byte [edx + 0x84], 2
jmp 0x489934
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.0043504b
mov ecx, dword [ebp - 0x1c]
mov edx, eax
mov dword [ebp - 0x18], edx
sub ecx, 0x100
je 0x489a57
dec ecx
sub ecx, 1
je 0x4899a5
sub ecx, 4
jne 0x489a9e
test esi, esi
jne 0x489993
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x489a9e
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp + 0xc]
push 0x20
pop eax
cmp word [esi + 8], ax
je 0x489aa1
jmp 0x4899a8
mov esi, dword [ebp + 0xc]
push esi
push edx
call fcn.0048a2bc
cmp dword [ebp - 0x1c], 0x102
jne 0x4899c0
test al, 0x84
jne 0x489aa1
movzx ecx, word [esi + 8]
push 9
pop edx
cmp cx, dx
jne 0x4899d4
test al, 2
jne 0x489aa1
push 0x20
pop eax
cmp cx, ax
jne 0x4899e0
xor eax, eax
jmp 0x489a4f
mov eax, dword [ebp - 0x18]
push esi
push eax
push ebx
call fcn.0048a2ec
test eax, eax
je 0x489aa1
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x489aa1
push esi
call fcn.00488232
xor edi, edi
inc edi
mov esi, dword [ebp - 0x14]
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x489a4d
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.0043504b
push eax
push esi
call fcn.00489e9d
pop ecx
pop ecx
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x489a4d
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.0043504b
push eax
push esi
push ebx
call fcn.00489f2a
mov eax, edi
call fcn.0057bade
ret 8
push dword [ebp + 0xc]
push edx
call fcn.0048a2bc
mov edx, eax
mov eax, dword [ebp + 0xc]
push 0x1b
movzx ecx, word [eax + 8]
movzx esi, cx
mov dword [ebp - 0x24], ecx
pop ecx
cmp si, cx
ja 0x489b8c
je 0x489be1
cmp esi, 3
je 0x489be1
push 9
pop eax
cmp si, ax
je 0x489af1
push 0xd
pop eax
cmp si, ax
je 0x489bb5
mov esi, dword [ebp + 0xc]
test dword [ebx + 0x60], 0x1000
jne 0x489a07
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
mov edi, eax
test edi, edi
je 0x489a07
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.0043504b
mov esi, dword [ebp - 0x14]
cmp eax, esi
je 0x489a0a
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.0043504b
push eax
call fcn.00489e22
pop ecx
jmp 0x489a0a
test dl, 2
jne 0x489a9e
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
sets cl
push ecx
mov dword [ebp - 0x24], ecx
mov ecx, ebx
push edi
call fcn.0043d2dc
mov ecx, eax
test ecx, ecx
je 0x489a9e
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x489b3f
mov eax, dword [eax]
push dword [ebp + 0xc]
mov esi, dword [eax + 0xac]
mov ecx, esi
call dword [0x5b2a2c]
mov ecx, dword [ebp - 0x1c]
call esi
jmp 0x489a04
mov eax, dword [ecx]
test eax, eax
jne 0x489b60
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x489b50
mov eax, edi
jmp 0x489b53
mov eax, dword [eax + 0x20]
push dword [ebp - 0x24]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
push eax
call fcn.0043504b
mov esi, eax
test esi, esi
je 0x489a04
mov ecx, dword [ebx + 0x70]
push esi
mov dword [ecx + 0x70], edi
call fcn.0048a008
push esi
push dword [ebp - 0x14]
call fcn.00489e9d
pop ecx
pop ecx
jmp 0x489a04
cmp esi, 0x25
jb 0x489d4b
push 0x26
pop ecx
cmp cx, si
jae 0x489c4f
cmp esi, 0x28
jbe 0x489c4c
cmp word [ebp - 0x24], 0x2b
jne 0x489d4b
test dl, 4
jne 0x489a9e
mov esi, dword [ebp - 0x14]
push esi
call fcn.004897ff
pop ecx
test al, 0x10
je 0x489bd9
mov ecx, esi
call fcn.0043d0e3
test esi, esi
jne 0x489bf5
jmp 0x489be4
push ebx
call fcn.0048a4da
jmp 0x489be4
push 2
pop eax
push eax
push ebx
call fcn.0048a039
mov esi, eax
test esi, esi
je 0x489a9e
mov ecx, esi
call fcn.0043d6af
test eax, eax
jne 0x489c0c
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x489a9e
cmp dword [esi + 0x74], edi
je 0x489a9e
push edi
push edi
push edi
mov dword [ebp - 4], edi
xor edi, edi
inc edi
push edi
push 0xfffffdd9
push esi
call fcn.0043d5f9
add esp, 0x18
jmp 0x489c43
or dword [ebp - 4], 0xffffffff
jmp 0x489a07
cmp cx, si
sbb ecx, ecx
push eax
push dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x1c], ecx
call fcn.0048a2bc
test al, 1
jne 0x489a9e
push 0x26
pop eax
mov ecx, ebx
push edi
cmp si, ax
ja 0x489c78
call fcn.0043d4a1
jmp 0x489c7d
call fcn.0043d28c
mov esi, eax
test esi, esi
je 0x489a9e
cmp dword [esi + 8], edi
je 0x489c94
push esi
mov ecx, ebx
call fcn.0043d8f9
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x489cb9
mov eax, dword [eax]
push dword [ebp + 0xc]
mov esi, dword [eax + 0xac]
mov ecx, esi
call dword [0x5b2a2c]
mov ecx, dword [ebp - 0x24]
jmp 0x489b38
mov eax, dword [esi]
test eax, eax
jne 0x489cda
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x489cca
mov eax, edi
jmp 0x489ccd
mov eax, dword [eax + 0x20]
push dword [ebp - 0x1c]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetNextDlgGroupItem]
push eax
call fcn.0043504b
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x489a9e
mov ecx, dword [ebx + 0x70]
push eax
mov dword [ecx + 0x70], edi
call fcn.0048a008
cmp dword [esi + 8], edi
je 0x489a04
mov eax, dword [ebp - 0x1c]
push 0xfffffffffffffff4
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push edi
xor edi, edi
mov esi, eax
mov eax, dword [ebp - 0x1c]
inc edi
push edi
push 0xf1
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x20]
movzx eax, si
push eax
push 0x111
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x1c]
call fcn.0048a008
jmp 0x489a07
mov esi, eax
jmp 0x489aa1