Function at 0x49089a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x49090a
cmp dword [ebp + 0x1c], 0x6a
jne 0x490c72
cmp dword [ebp + 0xc], 0x100
jne 0x490c72
xor ebx, ebx
cmp dword [ebp + 0x10], 0x61
mov dword [edi + 0x5b4], ebx
je 0x4908d7
cmp dword [ebp + 0x10], 0x41
jne 0x4908f1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x4908f1
sub esp, 0xc
lea ecx, [edi + 0x588]
call fcn.0049418b
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x5b4], ebx
je 0x490c72
xor eax, eax
inc eax
jmp 0x490c74
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
inc ebx
cmp ecx, 0x113
jne 0x490943
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491e34
mov ecx, dword [ebp + 0x18]
mov dword [ecx], esi
cmp dword [edi + 0x5b4], esi
je 0x490c48
mov eax, ebx
jmp 0x490c74
cmp ecx, 0x4e
jne 0x49096a
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 0xffffffff
jne 0x490c45
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00490731
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x490930
cmp ecx, 0x110
jne 0x490996
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.0049130d
mov esi, dword [ebp + 0x18]
mov dword [esi], eax
cmp dword [edi + 0x5b4], 0
jne 0x49093c
mov ecx, esi
jmp 0x490c48
cmp ecx, 0x10
jne 0x4909b7
push esi
push 2
push 0x111
push dword [edi + 4]
mov dword [edi + 0x5b4], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x49092b
push 2
pop edx
cmp ecx, edx
jne 0x4909de
lea eax, [edi + 0x63c]
mov dword [edi + 0x5b4], ebx
push eax
push edx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, edi
call fcn.0044d0b3
jmp 0x49092b
cmp ecx, 0x112
jne 0x490a11
mov eax, dword [ebp + 0x10]
and eax, 0xfff0
mov dword [edi + 0x5b4], esi
cmp eax, 0xf060
jne 0x49092b
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491c6f
jmp 0x49092b
cmp ecx, 0x111
jne 0x490a3b
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
mov dword [edi + 0x5b4], ebx
push ecx
mov dword [eax], ecx
mov ecx, edi
mov eax, dword [ebp + 0x10]
shr eax, 0x10
push eax
call fcn.00492dd5
jmp 0x49092b
cmp ecx, 0x133
jne 0x490a65
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
push ecx
mov dword [edi + 0x5b4], ebx
mov dword [eax], ecx
mov eax, esp
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov ecx, edi
call fcn.00492c50
jmp 0x490963
cmp ecx, 0x467
jne 0x490a8f
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.0049241e
push dword [ebp + 0x10]
mov ecx, edi
push ebx
call fcn.0049219b
jmp 0x49092b
cmp ecx, 0x46b
jne 0x490aae
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.00491674
jmp 0x490963
cmp ecx, 0x46e
jne 0x490ae8
mov dword [edi + 0x5b4], ebx
mov dword [edi + 0x618], 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.005f1cd7
pop ecx
push esi
push 0x96
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x49092b
cmp ecx, 0x46d
jne 0x490b09
push esi
push 0xc8
lea ecx, [edi + 0x28]
mov dword [edi + 0x5b4], ebx
call fcn.0044755b
jmp 0x49092b
cmp ecx, 0x470
jne 0x490b26
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.0049170c
jmp 0x490963
cmp ecx, 0x471
jne 0x490b43
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.00491783
jmp 0x490963
cmp ecx, 0x46c
jne 0x490b62
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.00491904
jmp 0x490963
cmp ecx, 0x468
jne 0x490bb1
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x10], edx
jne 0x490ba7
cmp dword [ebp + 0x14], 0x204
je 0x490b84
cmp dword [ebp + 0x14], 0x201
jne 0x490ba7
cmp byte [edi + 0x5f0], 0
jne 0x490b93
mov byte [edi + 0x5f0], bl
push 9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], esi
jmp 0x49093c
cmp ecx, 0x46a
jne 0x490bcc
push edx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004476e2
jmp 0x49092b
cmp ecx, 0x472
jne 0x490be6
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491d8d
jmp 0x49092b
cmp ecx, 0x474
jne 0x490c03
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.00491965
jmp 0x490963
cmp ecx, 0x476
jne 0x490c25
mov ecx, dword [ebp + 0x14]
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.004919df
jmp 0x490963
cmp ecx, 0x479
jne 0x490c45
mov ecx, dword [ebp + 0x14]
push ecx
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491bfb
jmp 0x490963
mov ecx, dword [ebp + 0x18]
mov esi, dword [edi + 0x578]
push 0
push ecx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044a38e
mov dword [edi + 0x578], esi
test eax, eax
jne 0x49093c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18