Function at 0x49912c
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49954a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0xd54], 0
je 0x49952f
mov eax, dword [0x49eea4]
cmp dword [eax], 2
je 0x49917b
cmp dword [ebx + 0x21cc], 0
je 0x49917b
push 0
lea eax, [ebx + 0xb94]
push eax
push 1
push 0x61
call sub.user32.dll_SystemParametersInfoA
mov eax, ebx
call fcn.0049911c
test al, al
je 0x499338
lea eax, [ebp - 8]
mov ecx, dword [ebx + 0xca4]
mov edx, 0x499560
call fcn.00403e7c
mov eax, dword [ebp - 8]
call fcn.00403ff4
push eax
push 0x30ec
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
mov esi, eax
mov dword [ebx + 0xb90], esi
test esi, esi
je 0x49952f
push 0x9dc
push 0
push 0
push 0xf001f
push esi
call sub.KERNEL32.DLL_MapViewOfFile
mov edi, eax
mov dword [ebx + 0xbb0], edi
test edi, edi
je 0x49952f
mov eax, edi
xor ecx, ecx
mov edx, 0x9dc
call fcn.00402c08
mov eax, dword [ebx + 0xbb0]
mov dword [eax + 0x60], 1
mov eax, dword [ebx + 0xd54]
call fcn.00403ff4
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov dword [ebx + 0xcac], esi
test esi, esi
jne 0x4992a2
lea eax, [ebp - 4]
call fcn.00403bb0
mov eax, dword [ebx + 0xd54]
call fcn.00408ab4
test al, al
je 0x499248
lea eax, [ebp - 4]
mov edx, 0x499580
call fcn.00403c48
push 0
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402994
mov eax, dword [ebp - 0xc]
call fcn.00403ff4
push eax
push 0x49959c
push dword [ebp - 4]
push 0x4995b0
call sub.KERNEL32.DLL_GetLastError
lea edx, [ebp - 0x14]
call fcn.0040a7c4
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403ef0
mov eax, dword [ebp - 0x10]
call fcn.00403ff4
push eax
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_MessageBoxA
jmp 0x49952f
cmp dword [ebx + 0x21bc], 0
jne 0x4992b4
cmp dword [ebx + 0x21cc], 0
je 0x4992f6
push 0x4995c0
mov eax, dword [ebx + 0xcac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [ebx + 0xcb0], esi
test esi, esi
je 0x49952f
push 0x4995c8
mov eax, dword [ebx + 0xcac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [ebx + 0xcb4], esi
test esi, esi
je 0x49952f
push 0x4995d0
mov eax, dword [ebx + 0xcac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [ebx + 0xcbc], esi
test esi, esi
je 0x49952f
push 0x4995d8
mov eax, dword [ebx + 0xcac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [ebx + 0xcb8], esi
test esi, esi
je 0x49952f
cmp dword [ebx + 0x21c8], 0
je 0x499367
push 0x2c
push 0
push 0xfffffffffffffffe
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
push 0x2c
push 1
push 0xffffffffffffffff
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
cmp dword [ebx + 0x21cc], 0
je 0x499383
push 9
push 1
push 1
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
cmp dword [ebx + 0x21bc], 0
jne 0x499399
cmp dword [ebx + 0x21cc], 0
je 0x499422
push 0x2c
push 5
push 2
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
push 0x90
push 5
push 3
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
push 0x54
push 3
push 4
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
push 0x55
push 8
push 5
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
push 0
mov eax, dword [ebx + 0xcac]
push eax
mov eax, dword [ebx + 0xcb4]
push eax
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0xcc0], eax
push 0
mov eax, dword [ebx + 0xcac]
push eax
mov eax, dword [ebx + 0xcb0]
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0xcc4], eax
cmp dword [ebx + 0x21e4], 0
je 0x499448
push 0
mov eax, dword [ebx + 0xcac]
push eax
mov eax, dword [ebx + 0xcb8]
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0xccc], eax
mov esi, dword [ebx + 0xcac]
test esi, esi
je 0x499469
push 0
push esi
mov eax, dword [ebx + 0xcbc]
push eax
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0xcc8], eax
mov eax, ebx
call fcn.0049911c
test al, al
je 0x49952f
mov esi, dword [ebx + 0xbb0]
cmp dword [ebx + 0x21cc], 0
setne al
mov byte [esi + 0x949], al
cmp dword [ebx + 0x21e4], 0
setne al
mov byte [esi + 0x52], al
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 0x550], eax
cmp dword [ebx + 0x21bc], 0
setne al
mov byte [esi + 0x51], al
mov eax, ebx
call fcn.0043afa4
mov dword [esi + 0x40], eax
mov eax, ebx
call fcn.0043afa4
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 0xcc4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0xcc0]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xcc8]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0xccc]
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x24], eax
mov byte [esi + 0x481], 1
mov byte [esi + 0x4d], 0
mov byte [esi + 0x50], 0
mov byte [esi + 0x4f], 0
mov byte [esi + 0x4e], 0
mov byte [esi + 0x4c], 1
mov byte [esi + 0x58], 0
mov byte [esi + 0x8c1], 1
mov byte [esi + 0x44], 0
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 0x54], eax
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [esi + 0x74], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499551
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403bd4
ret