Function at 0x4919c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
cmp ecx, 0x1d
jne 0x4919f5
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa2
call esi
test al, 0xf
je 0x4919f2
push 0xa5
call esi
test al, 0xf
jne 0x491c63
mov ecx, dword [ebp + 8]
cmp word [edi + 0xbee], 0
jne 0x491c63
mov edx, dword [edi + 0xbc8]
test edx, edx
je 0x491c63
add edx, 0x14
je 0x491c63
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x491c63
mov eax, dword [eax + 4]
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], eax
and ebx, 0xfff
mov byte [ebp - 3], 0
cmp ebx, 0x2a
je 0x491a5c
cmp ebx, 0x36
je 0x491a5c
cmp ebx, 0x1d
je 0x491a5c
cmp ebx, 0x38
je 0x491a5c
cmp ebx, 0x138
je 0x491a5c
movzx ebx, cl
jmp 0x491a60
mov byte [ebp - 3], 1
lea eax, [ebp - 1]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 2]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
mov byte [ebp + 0xb], 0
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 2], 0
push eax
lea eax, [ebp - 8]
mov byte [ebp - 1], 0
push eax
mov ecx, edx
call fcn.00520ac0
or esi, 0xffffffff
cmp byte [ebp - 3], 0
je 0x491bd3
cmp byte [ebp + 0xb], 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
jne 0x491ac6
cmp ebx, 0x2a
je 0x491ae4
cmp ebx, 0x36
je 0x491ae4
cmp byte [ebp - 1], 0
jne 0x491ad1
cmp ebx, 0x1d
je 0x491ae4
cmp byte [ebp - 2], 0
jne 0x491b09
cmp ebx, 0x38
je 0x491ae4
cmp ebx, 0x138
jne 0x491b09
test ecx, ecx
je 0x491aeb
push ecx
jmp 0x491af7
test edx, edx
je 0x491af2
push edx
jmp 0x491af7
test eax, eax
je 0x491b09
push eax
mov ecx, edi
call fcn.00492a90
mov ecx, dword [ebp - 8]
mov esi, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [ebp + 0xb], 0
je 0x491b26
cmp ebx, ecx
jne 0x491b26
push ecx
mov ecx, edi
call fcn.00492a20
pop ebx
mov esi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp byte [ebp - 1], 0
je 0x491b43
cmp ebx, edx
jne 0x491b43
push edx
mov ecx, edi
call fcn.00492a20
pop ebx
mov esi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov dl, byte [ebp - 2]
test dl, dl
je 0x491b61
cmp ebx, eax
jne 0x491b61
push eax
mov ecx, edi
call fcn.00492a20
pop ebx
mov esi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp byte [ebp + 0xb], 0
jne 0x491b75
cmp byte [ebp - 1], 0
jne 0x491b75
test dl, dl
je 0x491c58
test ecx, ecx
je 0x491b8e
call fcn.00515860
test eax, eax
jne 0x491b8e
push dword [ebp - 8]
mov ecx, edi
call fcn.00492a90
mov esi, eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x491ba8
call fcn.005158c0
test eax, eax
jne 0x491ba8
push ebx
mov ecx, edi
call fcn.00492a90
mov esi, eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x491c58
call fcn.00515890
test eax, eax
jne 0x491c58
push ebx
mov ecx, edi
call fcn.00492a90
pop ebx
mov esi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x14]
movzx eax, cl
cmp eax, ebx
jne 0x491c4e
mov esi, dword [ebp - 0x18]
lea ecx, [edi + 0x7e8]
or eax, 0xffffffff
mov esi, dword [esi + 0x30]
cmp esi, eax
cmove esi, eax
call fcn.00494af0
cmp esi, eax
je 0x491c1b
mov ecx, ebx
call fcn.00515fe0
cmp eax, 0x61
je 0x491c1b
push dword [ebp - 0x14]
mov ecx, edi
call fcn.00492a90
pop ebx
mov esi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 0x14]
mov ecx, edi
call fcn.00492a20
cmp dword [edi + 0x79c], 2
mov esi, eax
jne 0x491c58
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x491b8e
call fcn.00515860
test eax, eax
jne 0x491b8e
push ebx
jmp 0x491b85
push ecx
mov ecx, edi
call fcn.00492a90
mov esi, eax
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 8