Function at 0x50bd30
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push str.RunsSinceLastInstall
mov eax, str.Settings
call fcn.004811b0
test eax, eax
jle 0x50bd5f
mov esi, str.NotifyInstalledReminder
call fcn.004bac00
push edi
mov ecx, str.NCHSoftware_InstanceWindow
lea esi, [esp + 0x18]
call fcn.004977a0
mov eax, dword [0x734df4]
push ebx
push eax
call fcn.004f6720
test eax, eax
jne 0x50bd92
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebx + 4]
mov eax, dword [esp + 0x14]
push edx
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea ecx, [ebx + 0x2145]
push ecx
call fcn.00556520
mov eax, dword [ebx + 4]
lea edx, [esp + 0x54]
push edx
push eax
mov dword [esp + 0x5c], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp byte [ebp + 0xc], 0
mov dword [esp + 0x58], edi
je 0x50bdda
mov dword [esp + 0x5c], 2
jmp 0x50bdfe
push edi
push str.Maximized
mov eax, str.MainWindow
mov dword [esp + 0x64], 1
call fcn.00480fe0
test al, al
je 0x50bdfe
mov dword [esp + 0x5c], 3
call fcn.004a1e40
test al, al
je 0x50be0b
mov dword [esp + 0x5c], edi
mov edx, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_MapDialogRect]
lea ecx, [esp + 0x28]
xor esi, esi
push ecx
push edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 0x208
mov dword [esp + 0x3c], esi
call edi
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x38]
push eax
push ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 0x190
call edi
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x30]
push esi
mov dword [ebx + 0x46], eax
push str.Width
mov eax, str.MainWindow
mov dword [ebx + 0x42], edx
call fcn.004811b0
mov edi, eax
cmp edi, esi
sete al
test al, al
mov byte [esp + 0xf], al
je 0x50be8b
push ebx
mov ecx, 0x82
call fcn.004038e0
mov edi, eax
push esi
push str.Height
mov eax, str.MainWindow
call fcn.004811b0
cmp eax, esi
mov dword [esp + 0x10], eax
jne 0x50beaf
push 0x32
push ebx
call fcn.004038a0
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x30]
cmp edi, ecx
jge 0x50beb9
mov edi, ecx
mov ecx, dword [esp + 0x44]
cmp eax, ecx
jge 0x50bec5
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
sar eax, 1
mov edx, edi
sar edx, 1
sub eax, edx
push eax
sar ecx, 1
sar esi, 1
push 0x6bc2c0
mov eax, str.MainWindow
sub esi, ecx
call fcn.004811b0
push esi
mov dword [esp + 0x74], eax
push 0x6bc2c4
mov eax, str.MainWindow
call fcn.004811b0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x70]
mov dword [esp + 0x74], eax
add eax, ecx
add edx, edi
mov dword [esp + 0x7c], eax
push str.Height
mov eax, str.MainWindow
mov dword [esp + 0x7c], edx
call fcn.004a5500
test al, al
jne 0x50bfee
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x70]
mov esi, edx
sub esi, dword [esp + 0x18]
mov edi, ecx
sub edi, eax
cmp edi, esi
jle 0x50bf6a
mov ecx, eax
sub ecx, dword [esp + 0x18]
add ecx, edx
mov dword [esp + 0x78], ecx
mov eax, dword [esp + 0x7c]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov edi, eax
sub edi, dword [esp + 0x74]
sub esi, edx
cmp edi, esi
jle 0x50bf90
mov eax, dword [esp + 0x74]
sub eax, edx
add eax, dword [esp + 0x24]
mov dword [esp + 0x7c], eax
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x18]
cmp esi, edi
jge 0x50bfac
sub edi, esi
mov esi, dword [esp + 0x18]
add ecx, edi
mov dword [esp + 0x78], ecx
mov dword [esp + 0x70], esi
mov esi, dword [esp + 0x74]
cmp esi, edx
jge 0x50bfc4
mov edi, edx
sub edi, esi
add eax, edi
mov esi, edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x74], esi
mov edx, dword [esp + 0x20]
cmp ecx, edx
jle 0x50bfd8
mov edi, edx
sub edi, ecx
add dword [esp + 0x70], edi
mov dword [esp + 0x78], edx
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jle 0x50bfee
mov edx, ecx
sub edx, eax
add esi, edx
mov dword [esp + 0x74], esi
mov dword [esp + 0x7c], ecx
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowPlacement]
mov edi, 3
cmp dword [esp + 0x5c], edi
jne 0x50c026
mov edx, dword [ebx + 4]
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x1000000
push eax
mov eax, dword [ebx + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [ebp + 0xc], 0
mov byte [esp + 0xe], 0
je 0x50c049
mov ecx, dword [ebx + 4]
push 0
push 0
push 0x3e5
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x50c152
cmp dword [0x731ffc], 0xa
mov byte [esp + 0xd], 0
jne 0x50c05c
call fcn.004b23e0
cmp dword [0x731ffc], 9
setb al
test al, al
mov byte [esp + 0xf], al
jne 0x50c082
call fcn.004b4d20
test al, al
je 0x50c07e
mov byte [esp + 0xf], 1
jmp 0x50c086
mov al, byte [esp + 0xf]
mov byte [esp + 0xf], al
mov eax, dword [ebx + 4]
lea edx, [esp + 0xd]
push edx
push eax
call fcn.004b54e0
test al, al
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x50c0b7
call fcn.0050d760
mov ecx, dword [ebx + 4]
push 1
push 0
push 0x466
push ecx
call esi
mov byte [esp + 0xe], 1
call fcn.004af5a0
test al, al
je 0x50c0dc
cmp dword [esp + 0x5c], edi
jne 0x50c0dc
cmp byte [esp + 0xd], 0
je 0x50c0f9
mov eax, dword [ebx + 4]
lea edx, [esp + 0x54]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPlacement]
cmp byte [esp + 0xd], 0
je 0x50c0f9
call fcn.004b6470
cmp al, byte [esp + 0xf]
je 0x50c0f4
push ebx
call fcn.00422920
cmp byte [esp + 0xd], 0
sete al
test al, al
je 0x50c152
call fcn.004b6470
mov ecx, dword [ebx + 4]
push ecx
mov byte [esp + 0x13], al
call fcn.004a1300
test al, al
jne 0x50c12c
mov edx, dword [ebx + 4]
push 1
push 0
push 0x466
push edx
call esi
mov byte [esp + 0xe], 1
jmp 0x50c152
cmp byte [esp + 0xe], 0
jne 0x50c152
call fcn.004b6470
cmp byte [esp + 0xf], al
je 0x50c152
push ebx
call fcn.00422920
mov eax, dword [ebx + 0x53]
test eax, eax
je 0x50c152
push 0x61
call fcn.00522f70
push 0
push str.Thanks
mov eax, str.Settings
call fcn.00480fe0
test al, al
jne 0x50c17d
mov eax, dword [ebx + 4]
push 0
push 0x36ee800
push 0x3e4
push eax
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00401510
test al, al
je 0x50c19b
push ebx
call fcn.0051c3a0
push str.lluim
push str.UsageStatsChoice
call fcn.00480f20
cmp byte [esp + 0xe], 0
jne 0x50c1f9
cmp dword [0x731ff8], 2
jne 0x50c1d2
mov ecx, dword [0x735b94]
mov edx, dword [ecx + 4]
push edx
call fcn.00556350
test al, al
je 0x50c1d2
mov eax, dword [0x735b94]
mov eax, dword [eax + 4]
mov ecx, 0x736c44
call fcn.004bff00
jmp 0x50c1f9
call fcn.004b64d0
test al, al
jne 0x50c1e4
call fcn.004b6850
test al, al
je 0x50c1f9
mov ecx, dword [0x731ff8]
push ecx
mov ecx, dword [0x735b94]
lea edx, [ebx + 0x4a]
call fcn.0049ba80
mov eax, dword [0x736990]
test eax, eax
je 0x50c220
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [0x736990]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x736990], 0
mov esi, 0xa
cmp dword [0x731ffc], esi
jne 0x50c238
call fcn.004b23e0
cmp dword [0x731ffc], esi
setb al
test al, al
jne 0x50c248
call fcn.004b4d20
test al, al
je 0x50c25b
call fcn.004a1e40
test al, al
jne 0x50c25b
mov esi, str.LikeSurvey
call fcn.004bac00
cmp byte [ebp + 0xc], 0
mov dword [0x735b84], 5
jne 0x50c27e
mov eax, dword [ebx + 4]
push 0
push 0
push 0x806a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x50c3da
push 0
push 0
push 0
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 1
jne 0x50c3d0
mov eax, dword [ebx + 0x2e]
test eax, eax
je 0x50c2d0
sub esp, 0x1c
mov edi, esp
mov ecx, 7
lea esi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.0050e760
test al, al
jne 0x50c3bc
cmp dword [esp + 0x3c], 0x100
jne 0x50c309
cmp byte [esp + 0x40], 0x52
jne 0x50c309
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ax, ax
jns 0x50c309
push 0x10
call esi
test ax, ax
jns 0x50c309
push 0x12
call esi
test ax, ax
jns 0x50c309
mov eax, ebx
call fcn.00422b10
mov edi, dword [ebx + 0x53]
test edi, edi
je case.0x50c326.258
mov ecx, dword [esp + 0x3c]
lea eax, [ecx - 0x100]
cmp eax, 5
ja case.0x50c326.258
movzx eax, byte [eax + 0x50c448]
jmp dword [eax*4 + 0x50c440]
mov edx, dword [esp + 0x40]
push edx
mov eax, ecx
call fcn.00528600
test al, al
jne 0x50c3bc
mov edx, dword [esp + 0x44]
mov eax, dword [ebx + 0x36]
mov eax, dword [eax + 0x10]
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
lea ecx, [ebx + 0x36]
push edx
mov edx, dword [esp + 0x44]
push edx
call eax
test al, al
je 0x50c36f
mov edx, dword [ebx]
mov eax, dword [edx + 0x18]
mov ecx, ebx
call eax
jmp 0x50c3bc
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x50c39b
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebx + 0x32], 0
je 0x50c3bc
mov ecx, dword [ebx + 0x32]
test ecx, ecx
mov edx, dword [ecx + 4]
mov dword [ebx + 0x32], edx
je 0x50c3b6
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
cmp dword [ebx + 0x32], 0
jne 0x50c3a1
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x50c290
jmp 0x50c3da
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0
push 0
push 0
lea edx, [esp + 0x48]
push edx
call esi
test eax, eax
jne 0x50c3e0
mov eax, dword [ebx + 0x569]
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
call esi
mov ecx, dword [ebx + 0x592]
push ecx
mov dword [ebx + 0x5b2], 0
call esi
lea esi, [ebx + 0x560]
call fcn.004bf460
mov edx, dword [esp + 0x14]
push edx
mov dword [0x735b84], 4
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8