Function at 0x49bdc4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501fcb
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x5e0f00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x60752c]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc8], eax
test ecx, ecx
je case.0x49c2d7.527
mov edx, dword [ebp + 0xc]
lea edi, [ecx + 8]
mov esi, dword [ecx + 0x90]
mov dword [ebp - 0xc4], esi
cmp edx, 0x200
ja 0x49c2bf
je 0x49c24d
lea eax, [edx - 7]
cmp eax, 0xfe
ja case.0x49c2d7.527
movzx eax, byte [eax + 0x49c750]
jmp dword [eax*4 + 0x49c73c]
cmp edx, 0x100
je 0x49bddb
mov byte [ebp - 0xbc], 0
cmp edx, 0x104
jne 0x49bde2
mov byte [ebp - 0xbc], 1
mov esi, dword [ebp + 0x10]
cmp esi, 0x100
jae case.0x49c2d7.527
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [edi + 0x3799], 0
mov byte [ebp - 0xc0], al
je 0x49be36
test al, al
je 0x49be1b
movss xmm0, dword [0x538d18]
jmp 0x49be1e
xorps xmm0, xmm0
push ecx
movss dword [esp], xmm0
mov ecx, edi
push dword [ebp - 0xc0]
push 0x281
call fcn.00481af0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [edi + 0x3799], 0
mov byte [ebp - 0xc0], al
je 0x49be7b
test al, al
je 0x49be60
movss xmm0, dword [0x538d18]
jmp 0x49be63
xorps xmm0, xmm0
push ecx
movss dword [esp], xmm0
mov ecx, edi
push dword [ebp - 0xc0]
push 0x282
call fcn.00481af0
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [edi + 0x3799], 0
mov byte [ebp - 0xc0], al
je 0x49bec0
test al, al
je 0x49bea5
movss xmm0, dword [0x538d18]
jmp 0x49bea8
xorps xmm0, xmm0
push ecx
movss dword [esp], xmm0
mov ecx, edi
push dword [ebp - 0xc0]
push 0x283
call fcn.00481af0
push 0x5d
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [edi + 0x3799], 0
mov byte [ebp - 0xc0], al
je 0x49bf05
test al, al
je 0x49beea
movss xmm0, dword [0x538d18]
jmp 0x49beed
xorps xmm0, xmm0
push ecx
movss dword [esp], xmm0
mov ecx, edi
push dword [ebp - 0xc0]
push 0x284
call fcn.00481af0
mov ecx, dword [ebp + 0x14]
cmp esi, 0xd
jne 0x49bf1f
mov eax, ecx
shr eax, 0x10
test eax, 0x100
mov eax, 0x10d
cmovne esi, eax
push esi
call fcn.0049b790
shr ecx, 0x10
add esp, 4
movzx edi, cl
test eax, eax
je 0x49bf43
push edi
push esi
push dword [ebp - 0xbc]
push eax
call fcn.0049a830
add esp, 0x10
cmp esi, 0x10
jne 0x49bfb1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call esi
shr eax, 0xf
and al, 1
cmp al, byte [ebp - 0xbc]
jne 0x49bf7b
push edi
push 0xa0
push dword [ebp - 0xbc]
push 0x210
call fcn.0049a830
add esp, 0x10
push 0xa1
call esi
shr eax, 0xf
and al, 1
cmp al, byte [ebp - 0xbc]
jne case.0x49c2d7.527
push edi
push 0xa1
push dword [ebp - 0xbc]
push 0x214
call fcn.0049a830
add esp, 0x10
jmp case.0x49c2d7.527
cmp esi, 0x11
jne 0x49c01f
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa2
call esi
shr eax, 0xf
and al, 1
cmp al, byte [ebp - 0xbc]
jne 0x49bfe9
push edi
push 0xa2
push dword [ebp - 0xbc]
push 0x20f
call fcn.0049a830
add esp, 0x10
push 0xa3
call esi
shr eax, 0xf
and al, 1
cmp al, byte [ebp - 0xbc]
jne case.0x49c2d7.527
push edi
push 0xa3
push dword [ebp - 0xbc]
push 0x213
call fcn.0049a830
add esp, 0x10
jmp case.0x49c2d7.527
cmp esi, 0x12
jne case.0x49c2d7.527
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa4
call esi
shr eax, 0xf
and al, 1
cmp al, byte [ebp - 0xbc]
jne 0x49c05b
push edi
push 0xa4
push dword [ebp - 0xbc]
push 0x211
call fcn.0049a830
add esp, 0x10
push 0xa5
call esi
shr eax, 0xf
and al, 1
cmp al, byte [ebp - 0xbc]
jne case.0x49c2d7.527
push edi
push 0xa5
push dword [ebp - 0xbc]
push 0x215
call fcn.0049a830
add esp, 0x10
jmp case.0x49c2d7.527
mov edi, dword [ecx + 0x37bc]
lea esi, [ecx + 0x37b8]
mov ecx, dword [esi]
cmp edx, 7
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], 6
sete byte [ebp - 0x20]
cmp ecx, edi
jne 0x49c0da
inc ecx
test edi, edi
je 0x49c0c8
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x49c0cd
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.004c78f0
mov eax, dword [esi]
movups xmm0, xmmword [ebp - 0x28]
lea ecx, [eax + eax*2]
mov eax, dword [esi + 8]
movups xmmword [eax + ecx*8], xmm0
xorps xmm0, xmm0
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [esi]
jmp case.0x49c2d7.527
mov eax, dword [ebp + 0x10]
test eax, eax
je case.0x49c2d7.527
cmp eax, 0x10000
jae case.0x49c2d7.527
movzx esi, ax
test si, si
jne 0x49c125
cmp word [edi + 0x379c], si
je case.0x49c2d7.527
cmp byte [edi + 0x3799], 0
je case.0x49c2d7.527
movzx edx, word [edi + 0x379c]
mov eax, esi
and eax, 0xfc00
mov dword [ebp - 0xc0], 0xd800
cmp ax, word [ebp - 0xc0]
jne 0x49c1a9
test dx, dx
je 0x49c19d
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xa4], 0
xorps xmm0, xmm0
mov dword [ebp - 0xb8], 5
push eax
add ecx, 0x37b8
movlpd qword [ebp - 0xac], xmm0
mov dword [ebp - 0xb4], 2
mov dword [ebp - 0xb0], 0xfffd
call fcn.004c7310
mov word [edi + 0x379c], si
jmp case.0x49c2d7.527
test dx, dx
je 0x49c21e
mov dword [ebp - 0xc0], 0xdc00
cmp ax, word [ebp - 0xc0]
je 0x49c208
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xa4], 0
xorps xmm0, xmm0
mov dword [ebp - 0xb8], 5
push eax
add ecx, 0x37b8
movlpd qword [ebp - 0xac], xmm0
mov dword [ebp - 0xb4], 2
mov dword [ebp - 0xb0], 0xfffd
call fcn.004c7310
jmp 0x49c215
mov eax, edx
add esi, 0xfca02400
shl eax, 0xa
add esi, eax
xor eax, eax
mov word [edi + 0x379c], ax
push esi
mov ecx, edi
call fcn.00481a90
jmp case.0x49c2d7.527
cmp word [ebp + 0x14], 1
jne case.0x49c2d7.527
call fcn.0049b660
test al, al
je case.0x49c2d7.527
mov eax, 1
jmp 0x49c71e
cmp byte [esi + 8], 0
mov dword [esi + 4], eax
jne 0x49c28b
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 0xb0], 0x10
mov dword [ebp - 0xac], 2
mov dword [ebp - 0xa4], 0
call dword [sym.imp.USER32.dll_TrackMouseEvent]
mov byte [esi + 8], 1
mov ecx, dword [ebp + 0x14]
sub esp, 8
mov eax, ecx
shr eax, 0x10
cwde
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movsx eax, cx
mov ecx, edi
movss dword [esp + 4], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
call fcn.00481e20
jmp case.0x49c2d7.527
lea eax, [edx - 0x201]
cmp eax, 0xa2
ja case.0x49c2d7.527
movzx eax, byte [eax + 0x49c86c]
jmp dword [eax*4 + 0x49c850]
mov ecx, dword [ebp - 0xc8]
cmp dword [esi + 4], ecx
jne 0x49c2f0
mov dword [esi + 4], 0
sub esp, 8
mov byte [esi + 8], 0
mov ecx, edi
mov dword [esp + 4], 0xff7fffff
mov dword [esp], 0xff7fffff
call fcn.00481e20
jmp case.0x49c2d7.527
cmp edx, 0x204
jne 0x49c5b9
push 0x7f01
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, eax
call dword [sym.imp.USER32.dll_GetCursor]
cmp eax, esi
jne 0x49c5c5
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0xbc], eax
test eax, eax
je 0x49c5c5
cmp byte [edi + 0xa9], 0
jne 0x49c36e
push 1
push 0
mov ecx, edi
call fcn.00481dd0
push 0
push 0
mov ecx, edi
call fcn.00481dd0
mov ecx, dword [0x60752c]
xor esi, esi
mov eax, dword [ecx + 0x42a8]
lea edx, [ecx + 0x42a8]
mov dword [ebp - 0xc0], 1
cmp eax, dword [ecx + 0x3e88]
cmovne edx, esi
xor eax, eax
mov dword [ebp - 0xc4], eax
mov esi, 1
test edx, edx
je 0x49c3ec
mov esi, dword [edx + 0x40]
mov ecx, dword [edx + 0x44]
test esi, esi
jne 0x49c3c1
cmp ecx, dword [edx + 4]
jne 0x49c3c1
mov dword [ebp - 0xc4], 1
jmp 0x49c3c9
xor eax, eax
mov dword [ebp - 0xc4], eax
xor eax, eax
cmp esi, ecx
sete al
xor ecx, ecx
mov dword [ebp - 0xc0], eax
xor eax, eax
cmp cx, word [edx + 0x17b4]
sete al
mov dword [ebp - 0xcc], eax
mov esi, eax
push 0xffffffffffffffff
push dword [edi + 0x64]
lea eax, [ebp - 0x28]
push eax
call fcn.00493f50
push 0xffffffffffffffff
push dword [edi + 0x68]
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0
push eax
call fcn.00493f50
push 0xffffffffffffffff
push dword [edi + 0x6c]
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 1
push eax
call fcn.00493f50
push 0xffffffffffffffff
push dword [edi + 0x70]
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 2
push eax
call fcn.00493f50
push 0xffffffffffffffff
push dword [edi + 0x74]
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
call fcn.00493f50
push 0xffffffffffffffff
push dword [edi + 0x78]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
call fcn.00493f50
add esp, 0x48
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
cmovae eax, dword [ebp - 0x28]
or esi, 0x400
push eax
push 1
push esi
mov esi, dword [sym.imp.USER32.dll_InsertMenuW]
push 0xffffffffffffffff
push dword [ebp - 0xbc]
call esi
cmp dword [ebp - 0x8c], 8
lea eax, [ebp - 0xa0]
mov edi, dword [ebp - 0xc0]
cmovae eax, dword [ebp - 0xa0]
or edi, 0x400
push eax
push 2
push edi
push 0xffffffffffffffff
push dword [ebp - 0xbc]
call esi
cmp dword [ebp - 0x74], 8
lea eax, [ebp - 0x88]
cmovae eax, dword [ebp - 0x88]
push eax
push 3
push edi
push 0xffffffffffffffff
push dword [ebp - 0xbc]
call esi
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
push 4
push 0x400
push 0xffffffffffffffff
push dword [ebp - 0xbc]
call esi
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
push 5
push edi
mov edi, dword [ebp - 0xbc]
push 0xffffffffffffffff
push edi
call esi
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0xc4]
push 6
or eax, 0x400
push eax
push 0xffffffffffffffff
push edi
call esi
lea eax, [ebp - 0xa8]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0xa8], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [ebp - 0xc8]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push esi
push 0
push dword [ebp - 0xa4]
push dword [ebp - 0xa8]
push 0x180
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push eax
call fcn.0049cef0
add esp, 4
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
lea ecx, [ebp - 0x40]
call fcn.00421b80
lea ecx, [ebp - 0x58]
call fcn.00421b80
lea ecx, [ebp - 0x70]
call fcn.00421b80
lea ecx, [ebp - 0x88]
call fcn.00421b80
lea ecx, [ebp - 0xa0]
call fcn.00421b80
lea ecx, [ebp - 0x28]
call fcn.00421b80
jmp case.0x49c2d7.527
xor esi, esi
cmp edx, 0x206
jne 0x49c5cd
jmp 0x49c5c8
mov edx, dword [ebp + 0xc]
mov esi, 1
cmp edx, 0x207
je 0x49c5dd
cmp edx, 0x209
jne 0x49c5e2
mov esi, 2
cmp edx, 0x20b
je 0x49c5f2
cmp edx, 0x20d
jne 0x49c602
mov esi, dword [ebp + 0x10]
shr esi, 0x10
dec esi
neg esi
sbb esi, esi
neg esi
add esi, 3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xc], 0
jne 0x49c62b
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x49c625
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.USER32.dll_SetCapture]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ecx + 0xc]
bts eax, esi
push 1
mov dword [ecx + 0xc], eax
mov ecx, edi
push esi
call fcn.00481dd0
jmp case.0x49c2d7.527
xor ecx, ecx
cmp edx, 0x205
sete cl
mov dword [ebp - 0xbc], ecx
cmp edx, 0x208
jne 0x49c663
mov ecx, 2
jmp 0x49c67b
cmp edx, 0x20c
jne 0x49c681
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
add ecx, 3
mov dword [ebp - 0xbc], ecx
mov eax, dword [esi + 0xc]
btr eax, ecx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x49c6a8
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp - 0xc8]
jne 0x49c6a2
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp - 0xbc]
push 0
push ecx
mov ecx, edi
call fcn.00481dd0
jmp case.0x49c2d7.527
mov eax, dword [ebp + 0x10]
sub esp, 8
shr eax, 0x10
mov ecx, edi
cwde
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x5b70c4]
movss dword [esp + 4], xmm0
mov dword [esp], 0
call fcn.00481e80
jmp case.0x49c2d7.527
mov eax, dword [ebp + 0x10]
sub esp, 8
shr eax, 0x10
mov ecx, edi
cwde
mov dword [esp + 4], 0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x5b70c4]
movss dword [esp], xmm0
call fcn.00481e80
jmp case.0x49c2d7.527
cmp dword [ebp + 0x10], 7
jne case.0x49c2d7.527
mov byte [esi + 0x25], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d3b35
mov esp, ebp
pop ebp
ret