Function at 0x490850
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x4908c0
cmp dword [ebp + 0x1c], 0x6a
jne 0x490c28
cmp dword [ebp + 0xc], 0x100
jne 0x490c28
xor ebx, ebx
cmp dword [ebp + 0x10], 0x61
mov dword [edi + 0x5b4], ebx
je 0x49088d
cmp dword [ebp + 0x10], 0x41
jne 0x4908a7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x4908a7
sub esp, 0xc
lea ecx, [edi + 0x588]
call fcn.00494141
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x5b4], ebx
je 0x490c28
xor eax, eax
inc eax
jmp 0x490c2a
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
inc ebx
cmp ecx, 0x113
jne 0x4908f9
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491dea
mov ecx, dword [ebp + 0x18]
mov dword [ecx], esi
cmp dword [edi + 0x5b4], esi
je 0x490bfe
mov eax, ebx
jmp 0x490c2a
cmp ecx, 0x4e
jne 0x490920
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 0xffffffff
jne 0x490bfb
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004906e7
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x4908e6
cmp ecx, 0x110
jne 0x49094c
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004912c3
mov esi, dword [ebp + 0x18]
mov dword [esi], eax
cmp dword [edi + 0x5b4], 0
jne 0x4908f2
mov ecx, esi
jmp 0x490bfe
cmp ecx, 0x10
jne 0x49096d
push esi
push 2
push 0x111
push dword [edi + 4]
mov dword [edi + 0x5b4], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4908e1
push 2
pop edx
cmp ecx, edx
jne 0x490994
lea eax, [edi + 0x63c]
mov dword [edi + 0x5b4], ebx
push eax
push edx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, edi
call fcn.0044d0b3
jmp 0x4908e1
cmp ecx, 0x112
jne 0x4909c7
mov eax, dword [ebp + 0x10]
and eax, 0xfff0
mov dword [edi + 0x5b4], esi
cmp eax, 0xf060
jne 0x4908e1
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491c25
jmp 0x4908e1
cmp ecx, 0x111
jne 0x4909f1
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
mov dword [edi + 0x5b4], ebx
push ecx
mov dword [eax], ecx
mov ecx, edi
mov eax, dword [ebp + 0x10]
shr eax, 0x10
push eax
call fcn.00492d8b
jmp 0x4908e1
cmp ecx, 0x133
jne 0x490a1b
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
push ecx
mov dword [edi + 0x5b4], ebx
mov dword [eax], ecx
mov eax, esp
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov ecx, edi
call fcn.00492c06
jmp 0x490919
cmp ecx, 0x467
jne 0x490a45
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004923d4
push dword [ebp + 0x10]
mov ecx, edi
push ebx
call fcn.00492151
jmp 0x4908e1
cmp ecx, 0x46b
jne 0x490a64
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.0049162a
jmp 0x490919
cmp ecx, 0x46e
jne 0x490a9e
mov dword [edi + 0x5b4], ebx
mov dword [edi + 0x618], 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.005f1d07
pop ecx
push esi
push 0x96
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4908e1
cmp ecx, 0x46d
jne 0x490abf
push esi
push 0xc8
lea ecx, [edi + 0x28]
mov dword [edi + 0x5b4], ebx
call fcn.0044755b
jmp 0x4908e1
cmp ecx, 0x470
jne 0x490adc
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.004916c2
jmp 0x490919
cmp ecx, 0x471
jne 0x490af9
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.00491739
jmp 0x490919
cmp ecx, 0x46c
jne 0x490b18
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.004918ba
jmp 0x490919
cmp ecx, 0x468
jne 0x490b67
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x10], edx
jne 0x490b5d
cmp dword [ebp + 0x14], 0x204
je 0x490b3a
cmp dword [ebp + 0x14], 0x201
jne 0x490b5d
cmp byte [edi + 0x5f0], 0
jne 0x490b49
mov byte [edi + 0x5f0], bl
push 9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], esi
jmp 0x4908f2
cmp ecx, 0x46a
jne 0x490b82
push edx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004476e2
jmp 0x4908e1
cmp ecx, 0x472
jne 0x490b9c
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491d43
jmp 0x4908e1
cmp ecx, 0x474
jne 0x490bb9
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.0049191b
jmp 0x490919
cmp ecx, 0x476
jne 0x490bdb
mov ecx, dword [ebp + 0x14]
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.00491995
jmp 0x490919
cmp ecx, 0x479
jne 0x490bfb
mov ecx, dword [ebp + 0x14]
push ecx
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491bb1
jmp 0x490919
mov ecx, dword [ebp + 0x18]
mov esi, dword [edi + 0x578]
push 0
push ecx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044a38e
mov dword [edi + 0x578], esi
test eax, eax
jne 0x4908f2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18