Function at 0x5497a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x549c80
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [edi + 0x30]
mov eax, ebx
mov edx, dword [0x4a7254]
call fcn.00403be8
test al, al
je 0x5497e6
mov edx, dword [ebp - 4]
mov eax, ebx
mov si, 0xffba
call fcn.00403c58
mov eax, dword [ebp - 4]
cmp byte [eax], 9
jne 0x5497f9
mov eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x549c62
mov eax, dword [ebp - 4]
mov al, byte [eax]
add al, 0xe0
sub al, 0xe0
jb 0x549826
mov eax, dword [ebp - 4]
mov al, byte [eax]
cmp al, 8
je 0x549826
mov eax, dword [ebp - 4]
cmp byte [eax], 0xd
jne 0x54994e
cmp byte [edi + 0x251], 0
je 0x54994e
mov eax, edi
call fcn.0054a084
test eax, eax
je 0x549859
mov eax, edi
call fcn.0054a084
cmp byte [eax + 0x39], 0
jne 0x549859
mov eax, edi
call fcn.0054a084
mov al, byte [eax + 0x3a]
add al, 0xfe
sub al, 2
jb 0x549859
mov eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x549c62
mov eax, edi
call fcn.0054a084
test eax, eax
jne 0x549881
mov eax, edi
call fcn.0054a10c
test al, al
jne 0x549c62
xor edx, edx
mov eax, edi
call fcn.0054a118
jmp 0x54994e
mov eax, edi
call fcn.0054a10c
test al, al
jne 0x54994e
mov eax, dword [edi + 0x270]
cmp dword [eax + 0x1c], 0
je 0x54994e
mov eax, dword [edi + 0x270]
mov eax, dword [eax + 0x1c]
call fcn.0054ef4c
test al, al
je 0x54994e
mov ebx, dword [edi + 0x270]
mov eax, dword [ebx + 0x1c]
cmp byte [eax + 0x41], 0
jne 0x549c62
mov eax, ebx
call fcn.00489004
mov edx, dword [eax]
call dword [edx + 0x124]
test al, al
je 0x549c62
mov eax, dword [edi + 0x270]
mov eax, dword [eax + 0x1c]
call fcn.0054ef4c
test al, al
je 0x54993c
mov ebx, dword [edi + 0x30]
test ebx, ebx
je 0x54992c
mov eax, ebx
call fcn.004039a4
mov edx, 0x549c98
call fcn.005535f8
test al, al
je 0x54992c
mov eax, dword [edi + 0x30]
call fcn.00554ec8
test al, al
je 0x54992c
mov eax, dword [edi + 0x270]
call fcn.00489004
call fcn.0048e93c
jmp 0x54993c
mov eax, dword [edi + 0x270]
call fcn.00489004
call fcn.0048e93c
cmp byte [edi + 0x20e], 0
je 0x54994e
xor edx, edx
mov eax, edi
call fcn.004377b0
mov eax, dword [edi + 0x240]
call fcn.0054c7c8
test al, al
je 0x549968
mov eax, edi
call fcn.00548374
test al, al
jne 0x5499c6
cmp byte [edi + 0x284], 0
je 0x5499c6
mov eax, dword [ebp - 4]
mov al, byte [eax]
cmp al, 0x20
jne 0x5499c6
mov eax, edi
mov si, 0xffb2
call fcn.00403c58
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x5499c6
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00549184
test al, al
je 0x5499c6
cmp word [edi + 0x24a], 0
je 0x549c62
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.004a52d4
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.0054b950
jmp 0x549c62
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov byte [ebp - 9], al
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0054bc50
xor ebx, ebx
mov eax, dword [ebp - 4]
cmp byte [eax], 0
jne 0x5499f6
cmp byte [edi + 0x259], 0
je 0x5499f6
mov dl, 1
mov eax, edi
call fcn.0054c8ec
jmp 0x549a19
mov eax, edi
call fcn.004a5588
test al, al
je 0x549a19
mov eax, dword [ebp - 4]
cmp byte [eax], 0
jne 0x549a19
cmp byte [ebp - 9], 0
je 0x549a19
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 9]
mov byte [eax], dl
mov bl, 1
lea ecx, [ebp - 8]
xor edx, edx
mov eax, edi
mov esi, dword [eax]
call dword [esi + 0x138]
test al, al
jne 0x549b3f
mov eax, dword [edi + 0x270]
mov esi, dword [eax + 0x1c]
mov eax, esi
mov edx, dword [0x47bcac]
call fcn.00403be8
test al, al
jne 0x549a5f
mov eax, esi
mov edx, dword [0x47c410]
call fcn.00403be8
test al, al
je 0x549b01
cmp dword [esi + 0xe0], 0
je 0x549b01
mov eax, dword [ebp - 4]
mov al, byte [eax]
add al, 0xe0
sub al, 0xe0
jae 0x549b3f
mov eax, dword [edi + 0x270]
mov eax, dword [eax + 0x1c]
mov edx, dword [0x47bcac]
call fcn.00403be8
test al, al
je 0x549ac1
mov eax, dword [ebp - 4]
mov al, byte [eax]
sub al, 0x2b
je 0x549b3f
sub al, 2
je 0x549b3f
add al, 0xfd
sub al, 0xa
jb 0x549b3f
push 0
call sub.user32.dll_MessageBeep
mov eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x549b3f
push edi
mov esi, 0x549ca8
lea edi, [ebp - 0x30]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [0x6221cc]
mov al, byte [eax]
and eax, 0xff
bts dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov al, byte [eax]
and eax, 0xff
bt dword [ebp - 0x30], eax
jb 0x549b3f
push 0
call sub.user32.dll_MessageBeep
mov eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x549b3f
mov eax, dword [ebp - 4]
mov al, byte [eax]
add al, 0xe0
sub al, 0xe0
jae 0x549b3f
mov eax, dword [edi + 0x270]
cmp dword [eax + 0x1c], 0
je 0x549b3f
mov edx, dword [ebp - 4]
mov dl, byte [edx]
mov eax, dword [edi + 0x270]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0xd8]
test al, al
jne 0x549b3f
push 0
call sub.user32.dll_MessageBeep
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
cmp eax, 0x16
jg 0x549b66
je 0x549b7e
sub eax, 8
je 0x549b7e
dec eax
je 0x549c36
sub eax, 4
je 0x549bf3
jmp 0x549c58
sub eax, 0x18
je 0x549b7e
sub eax, 3
je 0x549baf
add eax, 0xfffffffb
sub eax, 0xe0
jae 0x549c58
mov eax, dword [edi + 0x270]
call fcn.004de798
mov dl, 1
mov eax, edi
call fcn.0054c8ec
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x10c]
test al, al
jne 0x549c58
mov eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x549c58
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xe8]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x7c]
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov esi, dword [edi + 0x30]
test esi, esi
je 0x549c58
mov eax, esi
call fcn.004039a4
mov edx, 0x549c98
call fcn.005535f8
test al, al
je 0x549c58
mov eax, dword [edi + 0x30]
mov edx, dword [eax]
call dword [edx + 0xc0]
jmp 0x549c58
cmp byte [edi + 0x251], 0
je 0x549c12
mov eax, dword [edi + 0x270]
call fcn.004de798
mov dl, 1
mov eax, edi
call fcn.0054c8ec
jmp 0x549c58
mov esi, dword [edi + 0x30]
test esi, esi
je 0x549c58
mov eax, esi
call fcn.004039a4
mov edx, 0x549c98
call fcn.005535f8
test al, al
je 0x549c58
mov eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x549c58
mov esi, dword [edi + 0x30]
test esi, esi
je 0x549c58
mov eax, esi
call fcn.004039a4
mov edx, 0x549c98
call fcn.005535f8
test al, al
je 0x549c58
mov eax, dword [ebp - 4]
mov byte [eax], 0
test bl, bl
je 0x549c62
mov eax, dword [ebp - 4]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549c87
lea eax, [ebp - 0x10]
call fcn.004048a8
lea eax, [ebp - 8]
call fcn.004048a8
ret