Function at 0x491a90
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db10b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x188c
call fcn.004d4ce0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.004aea00
mov dword [0x4fed68], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x73c1b8], eax
mov eax, dword [ebp + 8]
push 0x104
push 0x68e238
push eax
mov dword [0x73ff2c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x68e238
call fcn.004b10f0
push str.SoftwareTheWorld2
call fcn.004b9900
add esp, 8
test eax, eax
jne 0x491b15
mov eax, 1
jmp 0x4923b8
push 0x4ee294
lea ecx, [ebp - 0x48c]
call fcn.004ab940
lea ecx, [ebp - 0x48c]
mov dword [ebp - 4], ebx
call fcn.004ab5d0
mov eax, dword [ebp - 0x264]
mov cl, byte [0x500e04]
mov dword [0x73ff28], eax
mov byte [ebp - 0x148c], cl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x148b]
mov edx, dword [ebp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xfff
jbe 0x491b7a
mov ecx, 0xfff
jmp 0x491b86
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea edx, [ebp - 0x148c]
push edx
call dword [sym.imp.MSVCRT.dll_strncpy]
lea eax, [ebp - 0x148c]
push eax
call fcn.004b1040
mov esi, dword [sym.imp.MSVCRT.dll_strncmp]
push 0xa
lea ecx, [ebp - 0x148c]
push str._uninstall
push ecx
call esi
add esp, 0x1c
test eax, eax
jne 0x491bcd
call fcn.004910e0
call fcn.004b9990
jmp 0x4923a4
push 0xd
lea edx, [ebp - 0x148c]
push str._updateplugin
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x491c62
lea eax, [ebp - 0x148c]
test eax, eax
jne 0x491bf2
xor edi, edi
jmp 0x491c27
lea ecx, [ebp - 0x148c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.004d4ce0
mov edi, esp
push esi
push edi
lea edx, [ebp - 0x148c]
push 0xffffffffffffffff
push edx
push ebx
push ebx
mov word [edi], bx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x4f43f4
push edi
call dword [sym.imp.MSVCRT.dll_wcsstr]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4923a4
push 0x4f43f4
call dword [sym.imp.MSVCRT.dll_wcslen]
lea esi, [esi + eax*2]
push esi
call fcn.004b0f70
push esi
call fcn.00438fd0
add esp, 0xc
jmp 0x4923a4
push 8
lea eax, [ebp - 0x148c]
push str._install
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x491c8d
lea ecx, [ebp - 0x148c]
push ecx
call fcn.00491020
add esp, 4
jmp 0x4923a4
push 7
lea edx, [ebp - 0x148c]
push str._update
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x491cc5
lea eax, [ebp - 0x48c]
lea ecx, [ebp - 0x1484]
push eax
push ecx
push ebx
call fcn.004911d0
add esp, 0xc
call fcn.004b9990
jmp 0x4923a4
push 9
lea edx, [ebp - 0x148c]
push str._setstyle
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x491cfe
lea eax, [ebp - 0x48c]
lea ecx, [ebp - 0x1482]
push eax
push ecx
push 1
call fcn.004911d0
add esp, 0xc
call fcn.004b9990
jmp 0x4923a4
push 7
lea edx, [ebp - 0x148c]
push str._setdef
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x491d26
push 1
push 1
call fcn.00435660
add esp, 8
jmp 0x4923a4
push 9
lea eax, [ebp - 0x148c]
push str._unsetdef
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x491d4d
push 1
push ebx
call fcn.00435660
add esp, 8
jmp 0x4923a4
call fcn.0043d8b0
mov ecx, 0x56517c
call fcn.004257d0
mov ecx, 0x71c2c4
call fcn.00474b50
mov ecx, 0x71c2c4
call fcn.00478750
push ebx
mov ecx, 0x722a10
call fcn.00487d10
call fcn.004383f0
call fcn.0043d570
push 6
mov ecx, 0x722a10
call fcn.0048ac80
mov edi, dword [0x73bd5c]
xor ecx, ecx
cmp edi, ebx
sete cl
push ecx
mov ecx, 0x73ff58
call fcn.004bddb0
push 0x68e238
call fcn.00438900
mov esi, eax
push esi
call fcn.00491940
add esp, 8
test eax, eax
jne 0x4923a4
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
xor edx, edx
add esp, 4
cmp edx, eax
sbb eax, eax
neg eax
mov dword [0x73c1bc], eax
call fcn.00484ce0
mov ecx, 0x6f1cd0
call fcn.00461700
mov ecx, 0x6f0f70
call fcn.00483ba0
push ebx
call fcn.00435240
add esp, 4
test eax, eax
je 0x491e0d
push 1
call fcn.004180f0
add esp, 4
cmp dword [0x73eec4], ebx
je 0x491e20
push str.MFC42U.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 1
call fcn.004a77b0
mov ecx, dword [0x73ff2c]
push str.TheWorld__Default_
push 0x33
push 0x32
push ecx
push 0x66
call fcn.004b99a0
mov edx, dword [0x73bd58]
push 0x73bf68
push 0x73bd60
push edx
call fcn.004b99e0
mov eax, dword [0x72f9e8]
add esp, 0x24
push eax
call fcn.004c61a0
mov ecx, eax
call fcn.004c7180
push reloc.DSOUND.dll_DirectSoundCreate
push 0x73c1c0
push str.SingleThread
push str.Main
call fcn.004af430
mov esi, dword [0x73c1c0]
mov edx, dword [0x73c1a8]
add esp, 0x10
xor ecx, ecx
cmp esi, ebx
push ebx
push edx
sete cl
push 0x490f50
push 0x490fb0
mov dword [0x722a8c], ecx
call fcn.00491010
mov edx, dword [0x73c1c0]
push eax
xor eax, eax
cmp edx, ebx
sete al
push eax
mov ecx, 0x6f2000
call fcn.004b2ff0
cmp dword [0x722afc], ebx
je 0x491eda
mov dword [0x6f286c], 0x71cba8
mov ecx, dword [0x726650]
push 0x726654
push ecx
mov ecx, 0x6f2000
call fcn.004b3aa0
push 1
call fcn.00438660
mov eax, dword [0x73ff2c]
push str.Site.ini
lea edx, [ebp - 0x1694]
push 0x104
push edx
push eax
call fcn.004a8e10
add esp, 0x14
lea ecx, [ebp - 0x1694]
push ecx
mov ecx, 0x6f1aa8
call fcn.0048fa00
mov ecx, 0x6f1f38
call fcn.0047fc20
mov edx, dword [0x722af4]
mov dword [0x6f1ff8], 0x6f1f38
push edx
call fcn.004b9a10
mov ecx, eax
call fcn.004d2790
lea eax, [ebp - 0x48c]
push eax
push 0xf
call fcn.004afb70
add esp, 4
mov ecx, 0x6f2878
push eax
call fcn.0044bf90
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x6f2878
call fcn.004ba2b0
call fcn.0043d690
call fcn.0043db80
push str.BMP_GESTURE
push esi
mov ecx, 0x6f1cd0
call fcn.004614f0
mov ecx, 0x6f2878
call fcn.00455130
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push esi
mov dword [ebp - 0x30], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], ebx
jmp 0x491fbe
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 4], 1
push ebx
push ebx
lea ecx, [ebp - 0x2c]
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x49238e
mov eax, dword [ebp - 0x28]
cmp eax, 0x202
jne 0x491fef
mov dword [ebp + 8], ebx
jmp 0x492100
cmp eax, 0x201
jne 0x49203b
cmp dword [0x73c1c0], ebx
jne 0x49204d
mov esi, dword [0x717344]
cmp esi, ebx
je 0x49204d
mov edx, dword [ebp - 0x2c]
mov eax, dword [esi + 4]
push edx
push eax
call fcn.004d3bf0
add esp, 8
cmp eax, ebx
je 0x492031
mov ecx, dword [esi + 4]
push 0x2398
push 0x2397
push 0x9419
push ecx
call edi
mov eax, dword [ebp - 0x28]
cmp eax, 0x201
je 0x49204d
cmp eax, 0x204
je 0x49204d
cmp eax, 0x207
jne 0x492100
mov esi, dword [0x717264]
cmp esi, ebx
je 0x492100
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4920fd
lea edx, [ebp - 0x50]
mov dword [ebp - 0x50], ebx
push edx
push esi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x50]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4920a6
push ebx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
push 0x10
push esi
call edi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], ebx
cmp eax, 0x201
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
jne 0x492100
lea eax, [ebp - 0x40]
mov ecx, 0x7020e0
push eax
push 0x51
call fcn.004cd2a0
cmp eax, ebx
je 0x4920fd
mov eax, dword [0x7020e4]
lea ecx, [ebp - 0x40]
push 2
push ecx
push ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x40]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x491fc8
mov eax, dword [ebp - 0x28]
cmp dword [0x73c1c0], ebx
je 0x492133
cmp dword [0x726e54], ebx
je 0x492133
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
push edx
mov edx, dword [ebp - 0x2c]
push ecx
push eax
push edx
mov ecx, 0x6f1cd0
call fcn.00460a50
cmp eax, 1
je 0x491fc8
mov eax, dword [ebp - 0x28]
cmp eax, 0x113
je 0x49213f
cmp eax, 0xf
jne 0x492153
cmp dword [0x6f1d10], ebx
je 0x492153
cmp dword [0x726e60], ebx
jne 0x491fc8
cmp eax, 0x201
jne 0x49218d
mov ecx, 0x6f9e04
call fcn.004b8620
mov esi, eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp esi, eax
jne 0x49218a
mov ecx, 0x6f9e04
call fcn.004b9710
cmp eax, ebx
je 0x49218a
push 1
mov ecx, 0x6f9e04
call fcn.004b9670
mov eax, dword [ebp - 0x28]
cmp eax, 0x100
jne 0x49220d
mov eax, dword [ebp - 0x24]
cmp eax, 0xd
jne 0x4921e1
mov ecx, 0x6f9e04
call fcn.004b8620
cmp dword [ebp - 0x2c], eax
jne 0x49220d
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
movsx eax, ax
shr eax, 0x10
jne 0x4921c9
push 0x11
call esi
movsx ecx, ax
shr ecx, 0x10
je 0x49220d
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
push edx
push eax
push 0x8d5
push ecx
call edi
jmp 0x491fc8
cmp eax, 9
jne 0x49220d
mov ecx, 0x6f9e04
call fcn.004b9710
cmp eax, ebx
je 0x49220d
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x491fc8
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, 0x6f2878
call fcn.004590d0
cmp eax, ebx
jne 0x491fc8
mov eax, dword [0x6f287c]
lea edx, [ebp - 0x2c]
push edx
push eax
mov ecx, 0x73d258
call fcn.004a3180
cmp eax, ebx
jne 0x491fc8
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, 0x6f3e24
call fcn.004c5f60
cmp eax, ebx
jne 0x491fc8
cmp dword [0x73c1c0], ebx
je 0x492275
lea edx, [ebp - 0x2c]
mov ecx, 0x6f2000
push edx
call fcn.004b3a00
cmp eax, ebx
jne 0x491fc8
jmp 0x492293
mov eax, dword [ebp - 0x28]
cmp eax, 0x200
jbe 0x492293
cmp eax, 0x20d
ja 0x492293
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.0040c930
add esp, 8
cmp dword [ebp - 0x28], 0x20a
jne 0x4922b8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x30]
push ecx
lea eax, [ebp - 0x2c]
push edx
push eax
call fcn.004d3510
add esp, 0xc
cmp eax, ebx
jne 0x491fc8
mov edx, dword [0x6f287c]
lea ecx, [ebp - 0x2c]
push ecx
push edx
mov ecx, 0x73d258
call fcn.004a31a0
cmp eax, ebx
jne 0x491fc8
cmp dword [ebp - 0x28], 0x100
jne 0x492341
cmp dword [ebp - 0x24], 0x1b
jne 0x492341
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x189c]
push 0x104
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x492341
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x6f28a8]
push edx
push eax
call fcn.004d3bf0
add esp, 8
cmp eax, ebx
jne 0x49232d
lea eax, [ebp - 0x189c]
push str.edit
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x492341
mov ecx, dword [0x6f287c]
push ebx
push 0x800a
push 0x111
push ecx
call edi
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x491fc8
mov dword [ebp - 4], ebx
call fcn.0043d930
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x48c]
mov dword [ebp - 4], 0xffffffff
call fcn.004ab9e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18a8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10