Function at 0x55edb2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
push str.RunsSinceLastInstall
push str.Settings
call fcn.00401828
test eax, eax
jle 0x55edde
push str.NotifyInstalledReminder
call fcn.0053f6a7
push str.NCHSoftware_InstanceWindow
push esi
lea eax, [ebp - 0x10]
push eax
call fcn.004ccb2e
push ebx
push fcn.005684cf
push esi
xor edi, edi
inc edi
push edi
push dword [0x6a9b40]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
test eax, eax
je 0x55f2f7
push dword [ebx + 4]
push 0xffffffffffffffeb
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebx + 0x19f8]
call fcn.005986e0
lea eax, [ebp - 0x70]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x70], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp byte [ebp + 0xc], 0
mov dword [ebp - 0x6c], esi
mov esi, str.MainWindow
je 0x55ee50
mov dword [ebp - 0x68], 2
jmp 0x55ee6a
push edi
push str.Maximized
push esi
mov dword [ebp - 0x68], edi
call fcn.004017ea
test al, al
je 0x55ee6a
mov dword [ebp - 0x68], 3
push dword [ebx + 4]
mov edi, 0x214
mov ecx, edi
call fcn.00565716
mov dword [ebp - 0x14], eax
push 0xe0
mov eax, ebx
call fcn.00565707
mov ecx, dword [ebp - 0x14]
push 0
push 0x631ba8
push esi
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x42], ecx
mov dword [ebx + 0x46], eax
call fcn.00401828
test eax, eax
sete byte [ebp + 0xb]
cmp byte [ebp + 0xb], 0
mov dword [ebp - 8], eax
je 0x55eebd
push dword [ebx + 4]
mov ecx, edi
call fcn.00565716
mov dword [ebp - 8], eax
push 0
push 0x631bb4
push esi
call fcn.00401828
cmp byte [ebp + 0xb], 0
mov dword [ebp - 0xc], eax
je 0x55eed7
test eax, eax
jne 0x55eeea
test eax, eax
jne 0x55eeea
push 0x150
mov eax, ebx
call fcn.00565707
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
jge 0x55eef5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xc], eax
jge 0x55ef00
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
sar ecx, 1
sar eax, 1
sub eax, ecx
mov ecx, dword [ebp - 0xc]
push eax
push 0x631bc4
sar ecx, 1
sar edi, 1
push esi
sub edi, ecx
call fcn.00401828
push edi
push 0x631bc8
push esi
mov dword [ebp - 0x54], eax
call fcn.00401828
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 8]
add ecx, edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x50], eax
push 0x631bb4
add eax, ecx
push esi
mov dword [ebp - 0x48], eax
call fcn.00531fb3
test al, al
jne 0x55eff3
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov edx, ecx
sub edx, dword [ebp - 0x54]
cmp edx, eax
jle 0x55ef8b
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x48]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov edi, eax
sub edi, dword [ebp - 0x50]
sub esi, edx
cmp edi, esi
jle 0x55efaa
mov eax, dword [ebp - 0x50]
sub eax, edx
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov esi, dword [ebp - 0x28]
cmp dword [ebp - 0x54], esi
jge 0x55efbf
mov edi, esi
sub edi, dword [ebp - 0x54]
mov dword [ebp - 0x54], esi
add ecx, edi
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x50], edx
jge 0x55efd1
mov esi, edx
sub esi, dword [ebp - 0x50]
mov dword [ebp - 0x50], edx
add eax, esi
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x20]
cmp ecx, edx
jle 0x55efe2
mov esi, edx
sub esi, ecx
add dword [ebp - 0x54], esi
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jle 0x55eff3
mov edx, ecx
sub edx, eax
add dword [ebp - 0x50], edx
mov dword [ebp - 0x48], ecx
lea eax, [ebp - 0x70]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowPlacement]
cmp dword [ebp - 0x68], 3
jne 0x55f022
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x1000000
push eax
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [ebp + 0xc], 0
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp + 0xb], 0
mov edi, 0x466
je 0x55f04d
push 0
push 0
push 0x3e5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
xor al, al
jmp 0x55f0a0
mov byte [ebp - 1], 0
call fcn.0053c966
mov byte [ebp - 2], al
lea eax, [ebp - 1]
push eax
push dword [ebx + 4]
call fcn.0053c108
test al, al
jne 0x55f07c
call fcn.0055ffce
push 1
push 0
push edi
push dword [ebx + 4]
call esi
mov byte [ebp + 0xb], 1
cmp byte [ebp - 1], 0
je 0x55f09d
call fcn.0053c966
cmp al, byte [ebp - 2]
je 0x55f099
push 0
push ebx
mov ecx, 0x631a7c
call fcn.00422223
cmp byte [ebp - 1], 0
sete al
cmp byte [ebp + 0xc], 0
jne 0x55f0ec
test al, al
je 0x55f0ec
call fcn.0053c966
push dword [ebx + 4]
mov byte [ebp - 2], al
call fcn.0052f8ae
test al, al
jne 0x55f0cc
push 1
push 0
push edi
push dword [ebx + 4]
call esi
mov byte [ebp + 0xb], 1
cmp byte [ebp + 0xb], 0
jne 0x55f0ec
call fcn.0053c966
cmp byte [ebp - 2], al
je 0x55f0ec
xor edi, edi
push edi
push ebx
mov ecx, 0x631a7c
call fcn.00422223
jmp 0x55f0ee
xor edi, edi
push edi
push str.Thanks
push str.Settings
call fcn.004017ea
test al, al
jne 0x55f116
push edi
push 0x36ee800
push 0x3e4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0040132a
test al, al
je 0x55f135
push ebx
call fcn.00567cac
push eax
push str.lluim
push str.UsageStatsChoice
call fcn.0040177b
cmp byte [ebp + 0xb], 0
jne 0x55f162
call fcn.0053c9c0
test al, al
jne 0x55f14d
call fcn.0053cbb0
test al, al
je 0x55f162
push dword [0x6a53b8]
mov edx, dword [0x6a9b2c]
lea eax, [ebx + 0x4a]
push eax
call fcn.0052e6f5
mov eax, 0x6ac018
call fcn.00539622
lea eax, [ebx + 0x53]
cmp dword [eax + 8], edi
je 0x55f17a
push eax
call fcn.00569553
call fcn.0053c9c0
test al, al
je 0x55f18d
push str.LikeSurvey
call fcn.0053f6a7
cmp byte [ebp + 0xc], 0
mov dword [0x6a9b1c], 5
jne 0x55f297
push edi
push edi
push 0x806a
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x55f297
push edi
push edi
push edi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 1
jne 0x55f2aa
mov eax, dword [ebx + 0x2d]
cmp eax, edi
je 0x55f1f1
sub esp, 0x1c
push 7
pop ecx
mov edi, esp
lea esi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.00560578
xor edi, edi
test al, al
jne 0x55f297
cmp dword [ebp - 0x40], 0x100
jne 0x55f245
cmp byte [ebp - 0x3c], 0x52
jne 0x55f245
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov edi, 0x8000
test di, ax
je 0x55f243
push 0x10
call esi
test di, ax
je 0x55f243
push 0x12
call esi
test di, ax
je 0x55f243
push dword [ebx + 4]
call fcn.0053cba2
call fcn.0053c966
test al, al
je 0x55f243
mov esi, dword [ebx + 0x5f]
test esi, esi
je 0x55f243
call fcn.005712eb
xor edi, edi
push dword [ebp - 0x38]
lea ecx, [ebx + 0x35]
push dword [ebp - 0x3c]
mov eax, dword [ecx]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call dword [eax + 0x18]
test al, al
je 0x55f266
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
jmp 0x55f297
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [ebp - 0x44]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x55f28f
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
lea esi, [ebx + 0x31]
call fcn.0059f737
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x55f1b6
jmp 0x55f2b3
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x55f2b3
push dword [ebx + 0x484]
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
call esi
push dword [ebx + 0x4ad]
mov dword [ebx + 0x4cd], edi
call esi
lea esi, [ebx + 0x47b]
call fcn.00401a38
mov dword [0x6a9b1c], 4
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebx
leave
ret 8