Function at 0x49bb98
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, 0x5549d4
cmp dword [ebp + 8], 0
jl 0x49d13a
cmp dword [ebp + 8], 3
je 0x49d13a
call sub.USER32.dll_GetCapture
test eax, eax
jne 0x49d13a
cmp dword [0x5321ec], 0
je 0x49bbfa
push dword [0x537420]
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x49d13a
push dword [0x537420]
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x49d13a
mov eax, edi
sar eax, 0x1f
test al, 1
je 0x49bd21
cmp ebx, 0x12
jne 0x49bc1e
mov edx, edi
sar edx, 0x18
test dl, 1
je 0x49bc1e
xor ecx, ecx
mov dword [0x531f00], ecx
cmp dword [0x531efc], 0
jne 0x49bc34
cmp dword [0x534d3c], 0
je 0x49bd05
call sub.USER32.dll_GetFocus
mov dword [0x5549d8], eax
cmp dword [0x5549d8], 0
je 0x49bcab
mov eax, dword [0x5549d8]
cmp eax, dword [0x537424]
jne 0x49bc60
mov edx, dword [0x537430]
mov dword [0x5549d8], edx
push dword [0x5549d8]
call fcn.004f9c59
mov dword [esi], eax
cmp dword [esi], 0
je 0x49bc80
mov ecx, dword [0x5549d8]
mov dword [0x5549e0], ecx
jmp 0x49bcb7
push dword [0x5549d8]
call sub.USER32.dll_GetParent
mov dword [0x5549e0], eax
push dword [0x5549e0]
call fcn.004f9c59
mov dword [esi], eax
cmp dword [esi], 0
jne 0x49bcb7
xor eax, eax
mov dword [0x5549e0], eax
jmp 0x49bcb7
xor edx, edx
mov dword [esi], edx
xor ecx, ecx
mov dword [0x5549e0], ecx
cmp dword [0x531efc], 0
je 0x49bcdc
cmp dword [0x5549e0], 0
je 0x49bcdc
push 0
push ebx
push 0x440
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
cmp dword [0x534d3c], 0
je 0x49bd05
cmp dword [esi], 0
je 0x49bd05
mov eax, dword [esi]
cmp byte [eax + 0x638], 9
jne 0x49bd05
push edi
push ebx
push 0x44b
mov edx, dword [esi]
push dword [edx]
call sub.USER32.dll_PostMessageA
xor ecx, ecx
mov dword [0x5549e4], ecx
xor eax, eax
mov dword [0x531f04], eax
xor edx, edx
mov dword [0x531efc], edx
jmp 0x49d13a
cmp ebx, 0x12
jne 0x49bd3f
mov ecx, edi
sar ecx, 0x18
test cl, 1
je 0x49bd3f
mov dword [0x531f00], 1
jmp 0x49d13a
mov eax, edi
shr eax, 0x10
and ax, 0xffff
movzx edx, ax
sar edx, 8
and dl, 0xff
xor ecx, ecx
mov cl, dl
cmp ecx, 0x28
jg 0x49bd70
je 0x49bd82
sub ecx, 2
jb 0x49bd82
add ecx, 0xfffffffa
sub ecx, 2
jb 0x49bd82
sub ecx, 0x16
je 0x49bd82
jmp 0x49bda3
add ecx, 0xffffffc0
sub ecx, 2
jb 0x49bd82
add ecx, 0xfffffffa
sub ecx, 2
jb 0x49bd82
jmp 0x49bda3
cmp ebx, dword [0x531f04]
sete al
and eax, 1
mov dword [0x5549e4], eax
mov dword [0x531f04], ebx
xor edx, edx
mov dword [0x531efc], edx
jmp 0x49bdbf
xor ecx, ecx
mov dword [0x5549e4], ecx
xor eax, eax
mov dword [0x531f04], eax
xor edx, edx
mov dword [0x531efc], edx
jmp 0x49d13a
cmp dword [0x52a40c], 0
je 0x49bdf9
cmp ebx, 0x30
jb 0x49bdd2
cmp ebx, 0x39
jbe 0x49bdf9
cmp ebx, 0x4b
jne 0x49bde3
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x49bdf9
cmp ebx, 0xbc
je 0x49bdf9
call fcn.00425fe1
cmp ebx, 0x1b
je 0x49d14c
call sub.USER32.dll_GetFocus
mov dword [0x5549d8], eax
cmp dword [0x5549d8], 0
je 0x49be70
mov ecx, dword [0x5549d8]
cmp ecx, dword [0x537424]
jne 0x49be24
mov eax, dword [0x537430]
mov dword [0x5549d8], eax
push dword [0x5549d8]
call fcn.004f9c59
mov dword [esi], eax
cmp dword [esi], 0
je 0x49be44
mov edx, dword [0x5549d8]
mov dword [0x5549e0], edx
jmp 0x49be7c
push dword [0x5549d8]
call sub.USER32.dll_GetParent
mov dword [0x5549e0], eax
push dword [0x5549e0]
call fcn.004f9c59
mov dword [esi], eax
cmp dword [esi], 0
jne 0x49be7c
xor ecx, ecx
mov dword [0x5549e0], ecx
jmp 0x49be7c
xor eax, eax
mov dword [esi], eax
xor edx, edx
mov dword [0x5549e0], edx
cmp dword [0x534d3c], 0
je 0x49bea5
cmp dword [esi], 0
je 0x49bea5
mov ecx, dword [esi]
cmp byte [ecx + 0x638], 9
jne 0x49bea5
push edi
push ebx
push 0x44a
mov eax, dword [esi]
push dword [eax]
call sub.USER32.dll_PostMessageA
mov edx, edi
sar edx, 0x1d
test dl, 1
jne 0x49ce72
mov ecx, ebx
add ecx, 0xfffffff7
cmp ecx, 0x4e
ja case.0x49bec7.9
mov cl, byte [ecx + 0x49bece]
jmp dword [ecx*4 + 0x49bf1d]
cmp dword [esi], 0
je 0x49d13a
mov eax, dword [esi]
mov edx, dword [eax + 0x748]
cmp edx, dword [0x5549d8]
jne 0x49bfbb
cmp dword [0x5549e4], 0
jne 0x49d14c
push 0
push 0x20425
push 0x111
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
mov ecx, dword [esi]
mov eax, dword [ecx + 0x744]
cmp eax, dword [0x5549d8]
jne 0x49d13a
mov dword [0x52d13c], 1
jmp 0x49d13a
call sub.USER32.dll_GetActiveWindow
mov dword [0x5549dc], eax
cmp dword [0x535730], 0
je 0x49c036
mov edx, dword [0x535730]
cmp edx, dword [0x5549dc]
jne 0x49c036
push 0x12c
push dword [0x5549dc]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_GetFocus
pop ecx
cmp ecx, eax
jne 0x49c036
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49c036
push dword [0x5549dc]
call fcn.004d9d66
jmp 0x49d14c
cmp dword [esi], 0
je 0x49d13a
mov eax, dword [esi]
mov edx, dword [eax + 0x744]
cmp edx, dword [0x5549d8]
jne 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49c088
push 0
push 0
push 0x302
push dword [0x5549d8]
call sub.USER32.dll_PostMessageA
jmp 0x49d13a
push 0
push 0x2d
push 0x440
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d13a
call sub.USER32.dll_GetActiveWindow
mov dword [0x5549dc], eax
cmp dword [0x535730], 0
je 0x49c0f9
mov ecx, dword [0x535730]
cmp ecx, dword [0x5549dc]
jne 0x49c0f9
push 0x12c
push dword [0x5549dc]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_GetFocus
pop edx
cmp edx, eax
jne 0x49c0f9
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49c0f9
push dword [0x5549dc]
call fcn.004d9d66
jmp 0x49d14c
cmp dword [esi], 0
je 0x49d13a
mov eax, dword [0x5549e0]
cmp eax, dword [0x537438]
jne 0x49c152
mov ecx, dword [esi]
mov eax, dword [ecx + 0x748]
cmp eax, dword [0x5549d8]
jne 0x49c152
cmp dword [0x5549e4], 0
jne 0x49d14c
mov dword [0x5325bc], 6
push 0
push 0x514
push 0x111
push dword [0x537420]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
mov edx, dword [esi]
mov ecx, dword [edx + 0x744]
cmp ecx, dword [0x5549d8]
jne 0x49d13a
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49c19b
push 0
push 0
push 0x302
push dword [0x5549d8]
call sub.USER32.dll_PostMessageA
jmp 0x49d13a
push 0
push 0x2d
push 0x440
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d13a
cmp dword [esi], 0
je 0x49d13a
mov eax, dword [0x5549e0]
cmp eax, dword [0x537438]
jne 0x49d13a
mov edx, dword [esi]
mov ecx, dword [edx + 0x748]
cmp ecx, dword [0x5549d8]
jne 0x49d13a
cmp dword [0x5549e4], 0
jne 0x49d14c
mov dword [0x5325bc], 6
push 0
push 0x517
push 0x111
push dword [0x537420]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp dword [esi], 0
je 0x49d13a
cmp dword [0x533f90], 0
je 0x49d13a
mov dword [0x531efc], 1
jmp 0x49d13a
cmp dword [esi], 0
je 0x49c275
mov eax, dword [esi]
mov edx, dword [eax + 0x748]
cmp edx, dword [0x5549d8]
jne 0x49c275
cmp dword [0x5549e4], 0
jne 0x49d14c
push 0
push 0
push 0x204
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp dword [0x532a54], 0
jne 0x49d13a
cmp dword [0x533a2c], 0
je 0x49d13a
push 0x68
push dword [0x533a2c]
call sub.USER32.dll_GetDlgItem
mov esi, eax
call sub.USER32.dll_GetFocus
cmp esi, eax
jne 0x49d13a
push 0
push 0
push 0x188
push 0x68
push dword [0x533a2c]
call sub.USER32.dll_SendDlgItemMessageA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x49d13a
imul eax, dword [ebp - 4], 0x17
test byte [eax*4 + 0x55711c], 4
jne 0x49c2ee
imul edx, dword [ebp - 4], 0x17
test byte [edx*4 + 0x55711c], 8
je 0x49d13a
push 0
push dword [ebp - 4]
push 0x446
push dword [0x533a2c]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp dword [esi], 0
je 0x49d13a
mov ecx, dword [esi]
mov eax, dword [ecx + 0x748]
cmp eax, dword [0x5549d8]
je 0x49d13a
mov edx, dword [esi]
mov ecx, dword [edx + 0x744]
cmp ecx, dword [0x5549d8]
jne 0x49d13a
mov eax, dword [esi]
cmp byte [eax + 0x653], 0
je 0x49c359
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
push 0
push ebx
push 0x440
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
cmp dword [esi], 0
je 0x49d13a
mov edx, dword [esi]
mov ecx, dword [edx + 0x748]
cmp ecx, dword [0x5549d8]
jne 0x49c3bf
mov eax, dword [esi]
push dword [eax + 0x748]
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x49d13a
push 0
push ebx
push 0x440
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x49d13a
cmp dword [esi], 0
je 0x49d13a
mov edx, dword [esi]
mov ecx, dword [edx + 0x748]
cmp ecx, dword [0x5549d8]
jne 0x49c415
mov eax, dword [esi]
push dword [eax + 0x748]
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x49d13a
push 0
push ebx
push 0x440
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d13a
cmp dword [0x533a2c], 0
je 0x49d13a
push 0x68
push dword [0x533a2c]
call sub.USER32.dll_GetDlgItem
mov esi, eax
call sub.USER32.dll_GetFocus
cmp esi, eax
jne 0x49d13a
push 0
push 0
push 0x188
push 0x68
push dword [0x533a2c]
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x49d13a
cmp ebx, 0x25
jne 0x49c569
imul edx, eax, 0x17
test byte [edx*4 + 0x55711c], 4
je 0x49c4a3
push 0
push eax
push 0x446
push dword [0x533a2c]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
imul ecx, eax, 0x17
test byte [ecx*4 + 0x55711c], 8
je 0x49c50b
dec eax
imul edx, eax, 0x17
lea edx, [edx*4 + 0x55711c]
test eax, eax
jl 0x49d14c
test byte [edx], 4
jne 0x49c4cd
test byte [edx], 8
je 0x49c4fe
push 0
push eax
push 0x186
push 0x68
push dword [0x533a2c]
call sub.USER32.dll_SendDlgItemMessageA
push 0x533fbc
push 0x5570d8
push 0
push dword [0x533a2c]
call fcn.004ea625
jmp 0x49d14c
dec eax
add edx, 0xffffffa4
test eax, eax
jge 0x49c4c3
jmp 0x49d14c
imul ecx, eax, 0x17
lea edx, [ecx*4 + 0x55711c]
test eax, eax
jl 0x49d13a
test byte [edx], 0x10
jne 0x49c55c
test byte [edx], 4
je 0x49d13a
push 0
push eax
push 0x186
push 0x68
push dword [0x533a2c]
call sub.USER32.dll_SendDlgItemMessageA
push 0x533fbc
push 0x5570d8
push 0
push dword [0x533a2c]
call fcn.004ea625
jmp 0x49d14c
dec eax
add edx, 0xffffffa4
test eax, eax
jge 0x49c51d
jmp 0x49d13a
imul ecx, eax, 0x17
test byte [ecx*4 + 0x55711c], 8
je 0x49d13a
push 0
push eax
push 0x446
push dword [0x533a2c]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49c6a4
call sub.USER32.dll_GetActiveWindow
mov dword [0x5549dc], eax
push 0x68
push dword [0x5549dc]
call sub.USER32.dll_GetDlgItem
mov dword [0x5549d8], eax
cmp dword [0x5549dc], 0
je 0x49d13a
cmp dword [0x5549d8], 0
je 0x49d13a
cmp dword [0x5549e4], 0
jne 0x49d14c
push 0
push 0
push 0x188
push dword [0x5549d8]
call sub.USER32.dll_SendMessageA
mov dword [0x5549e8], eax
cmp dword [0x5549e8], 0xffffffff
jne 0x49c613
xor eax, eax
mov dword [0x5549e8], eax
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49c666
dec dword [0x5549e8]
cmp dword [0x5549e8], 0
jge 0x49c68e
mov dword [0x5549e8], 0x32
jmp 0x49c649
dec dword [0x5549e8]
cmp dword [0x5549e8], 0
jle 0x49c68e
push 0
push dword [0x5549e8]
push 0x187
push dword [0x5549d8]
call sub.USER32.dll_SendMessageA
inc eax
je 0x49c63a
jmp 0x49c68e
inc dword [0x5549e8]
push 0
push dword [0x5549e8]
push 0x187
push dword [0x5549d8]
call sub.USER32.dll_SendMessageA
inc eax
jne 0x49c68e
xor eax, eax
mov dword [0x5549e8], eax
push dword [0x5549e8]
push dword [0x5549d8]
call fcn.004ea9cd
jmp 0x49d14c
cmp dword [esi], 0
je 0x49d13a
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49c76b
mov edx, dword [esi]
cmp byte [edx + 0x638], 1
jne 0x49c6fc
mov ecx, dword [esi]
mov eax, dword [ecx + 0x748]
cmp eax, dword [0x5549d8]
jne 0x49c6ea
mov edx, dword [esi]
push dword [edx + 0x744]
call sub.USER32.dll_SetFocus
jmp 0x49d14c
mov ecx, dword [esi]
push dword [ecx + 0x748]
call sub.USER32.dll_SetFocus
jmp 0x49d14c
mov eax, dword [esi]
cmp byte [eax + 0x638], 9
jne 0x49d13a
mov edx, dword [esi]
cmp dword [edx + 0x748], 0
je 0x49d13a
mov ecx, dword [esi]
mov eax, dword [ecx + 0x748]
cmp eax, dword [0x5549d8]
jne 0x49c759
mov edx, dword [esi]
cmp dword [edx + 0x744], 0
je 0x49c747
mov ecx, dword [esi]
push dword [ecx + 0x744]
call sub.USER32.dll_SetFocus
jmp 0x49d14c
mov eax, dword [esi]
push dword [eax + 0x748]
call sub.USER32.dll_SetFocus
jmp 0x49d14c
mov edx, dword [esi]
push dword [edx + 0x748]
call sub.USER32.dll_SetFocus
jmp 0x49d14c
cmp dword [0x5549e0], 0
je 0x49d13a
mov ecx, dword [esi]
mov eax, dword [ecx + 0x744]
cmp eax, dword [0x5549d8]
jne 0x49d13a
push 0
push 9
push 0x440
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
cmp dword [0x5549e0], 0
je 0x49d13a
push 0
push dword [0x5549e0]
call fcn.004e8392
test eax, eax
jne 0x49d14c
jmp 0x49d13a
call sub.USER32.dll_GetActiveWindow
mov dword [0x5549dc], eax
cmp dword [0x535730], 0
je 0x49d13a
mov edx, dword [0x535730]
cmp edx, dword [0x5549dc]
jne 0x49d13a
call sub.USER32.dll_GetFocus
push eax
call sub.USER32.dll_GetParent
cmp eax, dword [0x535730]
jne 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
or eax, 0xffffffff
cmp ebx, 0x48
jne 0x49c850
push 0
push 0x132
push 0x111
push dword [0x535730]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp ebx, 0x4c
jne 0x49c8a5
cmp dword [0x535734], 0
jne 0x49c865
mov eax, 0x191
jmp 0x49c8aa
cmp dword [0x535734], 1
jne 0x49c875
mov eax, 0x191
jmp 0x49c8aa
cmp dword [0x535734], 2
jne 0x49c885
mov eax, 0x191
jmp 0x49c8aa
cmp dword [0x535734], 3
jne 0x49c895
mov eax, 0x192
jmp 0x49c8aa
cmp dword [0x535734], 4
jne 0x49c8aa
mov eax, 0x193
jmp 0x49c8aa
mov eax, 0x195
test eax, eax
jl 0x49d13a
push 0
push eax
push 0x111
push dword [0x535730]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp dword [esi], 0
je 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
mov edx, dword [esi]
mov dword [0x5549ec], edx
mov ecx, dword [0x5549ec]
mov eax, dword [ecx + 0x9a8]
mov dword [0x5549ec], eax
test eax, eax
jne 0x49c911
mov edx, dword [0x537418]
mov dword [0x5549ec], edx
mov eax, dword [0x5549ec]
cmp eax, dword [esi]
je 0x49c965
cmp byte [eax + 0x638], 1
jne 0x49c8f0
mov edx, dword [0x5549ec]
push dword [edx]
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x49c945
mov ecx, dword [0x5549ec]
push dword [ecx]
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x49c953
push 1
mov eax, dword [0x5549ec]
push dword [eax]
call sub.USER32.dll_ShowWindow
mov edx, dword [0x5549ec]
push dword [edx]
call sub.USER32.dll_SetFocus
jmp 0x49d14c
push 0
call fcn.00415bea
jmp 0x49d14c
cmp dword [esi], 0
je 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
mov ecx, dword [esi]
mov dword [0x5549f0], ecx
mov eax, dword [0x5549f0]
mov eax, dword [eax + 0x9a8]
mov dword [0x5549f0], eax
test eax, eax
jne 0x49c9b7
mov edx, dword [0x537418]
mov dword [0x5549f0], edx
mov ecx, dword [0x5549f0]
cmp ecx, dword [esi]
je 0x49ca1a
mov eax, dword [0x5549f0]
cmp byte [eax + 0x638], 2
jne 0x49c997
cmp byte [eax + 0x639], 2
ja 0x49c997
mov edx, dword [0x5549f0]
push dword [edx]
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x49c9fa
mov ecx, dword [0x5549f0]
push dword [ecx]
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x49ca08
push 1
mov eax, dword [0x5549f0]
push dword [eax]
call sub.USER32.dll_ShowWindow
mov edx, dword [0x5549f0]
push dword [edx]
call sub.USER32.dll_SetFocus
jmp 0x49d14c
push 0
call fcn.00415bea
jmp 0x49d14c
cmp dword [0x5549e4], 0
jne 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
push 2
call fcn.0045a14b
test eax, eax
jne 0x49d14c
jmp 0x49d13a
cmp dword [0x5549e4], 0
jne 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
push 3
call fcn.0045a14b
test eax, eax
jne 0x49d14c
jmp 0x49d13a
cmp dword [0x5549e4], 0
jne 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
push 0xf
call fcn.0045a14b
test eax, eax
jne 0x49d14c
jmp 0x49d13a
cmp dword [0x5549e4], 0
jne 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
push 0x1f
call fcn.0045a14b
test eax, eax
jne 0x49d14c
jmp 0x49d13a
cmp dword [0x5549e4], 0
jne 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
push 0x16
call fcn.0045a14b
test eax, eax
jne 0x49d14c
jmp 0x49d13a
cmp dword [0x5549e4], 0
jne 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
call sub.USER32.dll_GetActiveWindow
mov dword [0x5549dc], eax
cmp dword [0x535730], 0
je 0x49cb7a
mov ecx, dword [0x535730]
cmp ecx, dword [0x5549dc]
jne 0x49cb7a
push 0
push 0x1a8
push 0x111
push dword [0x535730]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp dword [esi], 0
je 0x49d13a
mov eax, dword [0x5549e0]
cmp eax, dword [0x537440]
jne 0x49cb9d
cmp dword [0x532190], 0
jne 0x49d13a
mov edx, dword [0x5549e0]
cmp edx, dword [0x537434]
jne 0x49cbc4
push 0
push 0x6a
push 0x111
push dword [0x537420]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
mov ecx, dword [0x5549e0]
cmp ecx, dword [0x537438]
jne 0x49cc15
mov eax, dword [esi]
mov edx, dword [eax + 0x748]
cmp edx, dword [0x5549d8]
jne 0x49cc15
cmp dword [0x5549e4], 0
jne 0x49d14c
mov dword [0x5325bc], 6
push 0
push 0x518
push 0x111
push dword [0x537420]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
push 0
push ebx
push 0x440
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp dword [0x5549e4], 0
jne 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49d13a
call sub.USER32.dll_GetActiveWindow
mov dword [0x5549dc], eax
cmp dword [0x535730], 0
je 0x49d13a
mov ecx, dword [0x535730]
cmp ecx, dword [0x5549dc]
jne 0x49d13a
push 0
push 0x1a7
push 0x111
push dword [0x535730]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp ebx, 0x70
jb 0x49d13a
cmp ebx, 0x7b
ja 0x49d13a
cmp ebx, 0x70
jne 0x49cd63
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x49cdc4
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x49cd42
push 0
push 0x543bd3
push 0x531f08
call fcn.0040f83a
test eax, eax
jne 0x49cdc4
cmp dword [0x5549e4], 0
jne 0x49d14c
push 0x52feac
push str._smirc.hlp
push 0x543bd3
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [0x531ef8], 0
jne 0x49cd25
push 0
push 3
push 0x543bd3
push dword [0x537420]
call sub.USER32.dll_WinHelpA
jmp 0x49d14c
push dword [0x531ef8]
push 1
push 0x543bd3
push dword [0x537420]
call sub.USER32.dll_WinHelpA
jmp 0x49d14c
push 0
push 0x543bd3
push str.sF1
call fcn.0040f83a
test eax, eax
jne 0x49cdc4
push 0
call fcn.0041675f
jmp 0x49d14c
cmp ebx, 0x72
jne 0x49cd8e
call sub.USER32.dll_GetActiveWindow
mov dword [0x5549dc], eax
mov eax, dword [0x535730]
test eax, eax
je 0x49cdc4
cmp eax, dword [0x5549dc]
jne 0x49cdc4
push eax
call fcn.00463f78
jmp 0x49d14c
cmp ebx, 0x73
jne 0x49cdc4
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49cdc4
mov eax, dword [esi]
test eax, eax
je 0x49cdc4
push dword [eax]
call fcn.004f7e1e
test eax, eax
jne 0x49cdc4
push 0
push 0
push 0x10
mov edx, dword [esi]
push dword [edx]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp dword [esi], 0
je 0x49d13a
mov ecx, ebx
sub ecx, 0x6f
mov dword [0x5549e8], ecx
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49cdfe
push dword [0x5549e8]
push 0x531f1f
push 0x5549f4
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x49ce3c
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49ce24
push dword [0x5549e8]
push 0x531f26
push 0x5549f4
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x49ce3c
push dword [0x5549e8]
push 0x531f2d
push 0x5549f4
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x555704
push 0x5549f4
call fcn.0040f83a
test eax, eax
je 0x49d13a
push 0
push ebx
push 0x440
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp ebx, 0xd
jne 0x49cec7
mov eax, dword [esi]
test eax, eax
je 0x49d13a
mov edx, dword [eax + 0x744]
cmp edx, dword [0x5549d8]
jne 0x49d13a
push 2
push dword [0x5549e0]
call fcn.0045999c
mov esi, eax
mov dword [0x5549e8], esi
dec esi
jne 0x49d13a
push 0
push ebx
push 0x440
push dword [0x5549e0]
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
cmp dword [0x531f00], 0
jne 0x49d13a
cmp dword [0x5549e4], 0
jne 0x49d13a
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x49d13a
mov eax, ebx
sub eax, 0x30
je 0x49d133
dec eax
sub eax, 9
jb 0x49cf07
jmp 0x49d13a
call sub.USER32.dll_GetActiveWindow
mov dword [0x5549dc], eax
mov eax, dword [0x535730]
test eax, eax
je 0x49cf40
cmp eax, dword [0x5549dc]
jne 0x49cf40
push 0
mov edx, ebx
sub edx, 0x31
add edx, 0x1f4
push edx
push 0x111
push eax
call sub.USER32.dll_PostMessageA
jmp 0x49d14c
mov eax, dword [esi]
test eax, eax
je 0x49cf50
mov edx, dword [eax]
mov dword [0x5549d8], edx
jmp 0x49cf58
xor ecx, ecx
mov dword [0x5549d8], ecx
cmp dword [0x536414], 0
je 0x49cff3
mov eax, dword [0x537418]
mov dword [esi], eax
mov edx, ebx
sub edx, 0x31
mov dword [0x5549e8], edx
jmp 0x49cfa7
mov eax, dword [esi]
cmp byte [eax + 0x650], 0
je 0x49cf9d
push eax
call fcn.004e6b79
test eax, eax
je 0x49cf9d
dec dword [0x5549e8]
cmp dword [0x5549e8], 0
jl 0x49cfac
mov edx, dword [esi]
mov ecx, dword [edx + 0x9a8]
mov dword [esi], ecx
cmp dword [esi], 0
jne 0x49cf79
cmp dword [0x5549e8], 0
jl 0x49d024
mov eax, dword [0x537418]
mov dword [esi], eax
jmp 0x49cfec
mov eax, dword [esi]
cmp byte [eax + 0x650], 0
je 0x49cfd3
push eax
call fcn.004e6b79
test eax, eax
jne 0x49cfe2
dec dword [0x5549e8]
cmp dword [0x5549e8], 0
jl 0x49d024
mov edx, dword [esi]
mov ecx, dword [edx + 0x9a8]
mov dword [esi], ecx
cmp dword [esi], 0
jne 0x49cfbe
jmp 0x49d024
mov eax, dword [0x537418]
mov dword [esi], eax
mov edx, ebx
sub edx, 0x31
mov dword [0x5549e8], edx
jmp 0x49d01e
dec dword [0x5549e8]
cmp dword [0x5549e8], 0
jl 0x49d024
mov ecx, dword [eax + 0x9a8]
mov dword [esi], ecx
mov eax, dword [esi]
test eax, eax
jne 0x49d007
cmp dword [esi], 0
je 0x49d13a
mov edx, dword [esi]
mov ecx, dword [edx]
cmp ecx, dword [0x5549d8]
jne 0x49d06d
mov eax, dword [esi]
push dword [eax]
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x49d06d
mov edx, dword [esi]
push dword [edx]
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x49d06d
push 0
push 0xf020
push 0x112
mov ecx, dword [esi]
push dword [ecx]
call sub.USER32.dll_SendMessageA
jmp 0x49d14c
mov eax, dword [esi]
push dword [eax]
call fcn.004f7e1e
test eax, eax
je 0x49d0f2
cmp dword [0x536ca8], 0
je 0x49d097
push 2
call fcn.004f181f
push 5
push dword [0x537420]
call sub.USER32.dll_ShowWindow
push dword [0x537420]
call sub.USER32.dll_IsIconic
test eax, eax
je 0x49d0b5
push 9
push dword [0x537420]
call sub.USER32.dll_ShowWindow
jmp 0x49d0d1
push dword [0x537420]
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x49d0d1
push 5
push dword [0x537420]
call sub.USER32.dll_ShowWindow
push dword [0x537420]
call sub.USER32.dll_BringWindowToTop
push dword [0x537420]
call sub.USER32.dll_SetActiveWindow
push dword [0x537420]
call sub.USER32.dll_SetForegroundWindow
push 0
mov edx, dword [esi]
push dword [edx]
call fcn.004fa2a2
mov ecx, dword [esi]
push dword [ecx]
call sub.USER32.dll_BringWindowToTop
mov eax, dword [esi]
push dword [eax]
call sub.USER32.dll_SetActiveWindow
mov edx, dword [esi]
push dword [edx]
call sub.USER32.dll_SetForegroundWindow
mov ecx, dword [esi]
push dword [ecx]
call sub.USER32.dll_UpdateWindow
cmp dword [0x536414], 0
je 0x49d14c
push dword [esi]
call fcn.004e6fbd
jmp 0x49d14c
call fcn.004f1171
jmp 0x49d14c
push edi
push ebx
push dword [ebp + 8]
push dword [0x531ef4]
call sub.USER32.dll_CallNextHookEx
jmp 0x49d161
push edi
push ebx
push dword [ebp + 8]
push dword [0x531ef4]
call sub.USER32.dll_CallNextHookEx
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc