Function at 0x495a20
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x556b22], 0
jne 0x495a5c
mov dword [0x563c50], 0
mov dword [0x563c54], 0
mov dword [0x563c58], 0
mov dword [0x563c5c], 0
mov dword [0x563c60], 0
ret
cmp dword [0x563c84], 0
push ebx
push esi
push edi
mov edi, dword [0x563c50]
mov dword [0x563c50], 0
jne 0x495b71
push 0x5638e4
push dword [0x56391c]
call dword [sym.imp.WINMM.dll_joyGetPosEx]
test eax, eax
jne 0x495b71
mov esi, dword [0x56390c]
mov eax, 0xe90452d5
lea ecx, [esi + 0x8ca]
mul ecx
shr edx, 0xc
cmp esi, 0xffff
je 0x495ac6
cmp edx, 8
ja 0x495ac6
mov eax, dword [edx*4 + 0x53f768]
mov dword [0x563c50], eax
jmp 0x495acb
mov eax, dword [0x563c50]
mov ecx, dword [0x5638ec]
cmp ecx, dword [0x563c64]
jae 0x495ae1
or eax, 2
mov dword [0x563c50], eax
cmp ecx, dword [0x563c68]
jbe 0x495af1
or eax, 4
mov dword [0x563c50], eax
mov ecx, dword [0x5638f0]
cmp ecx, dword [0x563c6c]
jae 0x495b07
or eax, 8
mov dword [0x563c50], eax
cmp ecx, dword [0x563c70]
jbe 0x495b17
or eax, 1
mov dword [0x563c50], eax
mov ecx, dword [0x563904]
test cl, 1
je 0x495b2a
or eax, 0x10
mov dword [0x563c50], eax
test cl, 2
je 0x495b37
or eax, 0x20
mov dword [0x563c50], eax
test cl, 4
je 0x495b44
or eax, 0x10
mov dword [0x563c50], eax
test cl, 8
je 0x495b53
or eax, 0x100
mov dword [0x563c50], eax
test cl, 0x10
je 0x495b62
or eax, 0x100
mov dword [0x563c50], eax
test cl, 0x20
je 0x495b71
or eax, 0x100
mov dword [0x563c50], eax
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call esi
bt ax, 0xf
jb 0x495e1b
push 0x28
call esi
bt ax, 0xf
jb 0x495b9c
push 0x4a
call esi
bt ax, 0xf
jae 0x495ba3
or dword [0x563c50], 1
push 0x25
call esi
bt ax, 0xf
jb 0x495bb9
push 0x48
call esi
bt ax, 0xf
jae 0x495bc0
or dword [0x563c50], 2
push 0x27
call esi
bt ax, 0xf
jb 0x495bd6
push 0x4c
call esi
bt ax, 0xf
jae 0x495bdd
or dword [0x563c50], 4
push 0x26
call esi
bt ax, 0xf
jb 0x495bf3
push 0x4b
call esi
bt ax, 0xf
jae 0x495bfa
or dword [0x563c50], 8
push 0x20
call esi
bt ax, 0xf
jb 0x495c26
push 0xd
call esi
bt ax, 0xf
jb 0x495c26
push 0x59
call esi
bt ax, 0xf
jb 0x495c26
push 0x5a
call esi
bt ax, 0xf
jae 0x495c2d
or dword [0x563c50], 0x10
push 0x1b
call esi
bt ax, 0xf
jb 0x495c85
push 0x60
call esi
bt ax, 0xf
jb 0x495c85
push 0x2d
call esi
bt ax, 0xf
jb 0x495c85
push 0x58
call esi
bt ax, 0xf
jb 0x495c85
push 0x43
call esi
bt ax, 0xf
jb 0x495c85
push 0x56
call esi
bt ax, 0xf
jb 0x495c85
push 0x42
call esi
bt ax, 0xf
jb 0x495c85
push 0x4e
call esi
bt ax, 0xf
jae 0x495c8c
or dword [0x563c50], 0x20
push 0x62
call esi
bt ax, 0xf
jae 0x495ca1
or dword [0x563c50], 0x1001
push 0x64
call esi
bt ax, 0xf
jae 0x495cb6
or dword [0x563c50], 0x4002
push 0x66
call esi
bt ax, 0xf
jae 0x495ccb
or dword [0x563c50], 0x10004
push 0x68
call esi
bt ax, 0xf
jae 0x495ce0
or dword [0x563c50], 0x40008
push 0x30
call esi
bt ax, 0xf
jae 0x495cf5
or dword [0x563c50], 0x400
push 0x31
call esi
bt ax, 0xf
jae 0x495d0a
or dword [0x563c50], 0x800
push 0x32
call esi
bt ax, 0xf
jae 0x495d1f
or dword [0x563c50], 0x1000
push 0x33
call esi
bt ax, 0xf
jae 0x495d34
or dword [0x563c50], 0x2000
push 0x34
call esi
bt ax, 0xf
jae 0x495d49
or dword [0x563c50], 0x4000
push 0x35
call esi
bt ax, 0xf
jae 0x495d5e
or dword [0x563c50], 0x8000
push 0x36
call esi
bt ax, 0xf
jae 0x495d73
or dword [0x563c50], 0x10000
push 0x37
call esi
bt ax, 0xf
jae 0x495d88
or dword [0x563c50], 0x20000
push 0x38
call esi
bt ax, 0xf
jae 0x495d9d
or dword [0x563c50], 0x40000
push 0x39
call esi
bt ax, 0xf
jae 0x495db2
or dword [0x563c50], 0x80000
push 0x6b
call esi
bt ax, 0xf
jae 0x495dc7
or dword [0x563c50], 0x100000
push 0x6d
call esi
bt ax, 0xf
jae 0x495ddc
or dword [0x563c50], 0x200000
push 0x6a
call esi
bt ax, 0xf
jae 0x495df1
or dword [0x563c50], 0x400000
push 0x6f
call esi
bt ax, 0xf
jae 0x495e06
or dword [0x563c50], 0x800000
push 0x6e
call esi
bt ax, 0xf
jae 0x495e1b
or dword [0x563c50], 0x1000000
push 1
call esi
bt ax, 0xf
jae 0x495e2d
or dword [0x563c50], 0x40
push 2
call esi
bt ax, 0xf
jae 0x495e42
or dword [0x563c50], 0x80
push 0x10
call esi
bt ax, 0xf
jae 0x495e57
or dword [0x563c50], 0x100
push 0x11
call esi
bt ax, 0xf
jae 0x495e6c
or dword [0x563c50], 0x200
push 4
call esi
bt ax, 0xf
mov eax, dword [0x563c50]
jae 0x495e86
or eax, 0x2000000
mov dword [0x563c50], eax
cmp byte [0x5602c0], 0
je 0x495ea0
or eax, 0x4000000
mov byte [0x5602c0], 0
mov dword [0x563c50], eax
cmp byte [0x5602c1], 0
je 0x495eba
or eax, 0x8000000
mov byte [0x5602c1], 0
mov dword [0x563c50], eax
not edi
and edi, eax
or dword [0x563c54], edi
pop edi
pop esi
pop ebx
ret