Function at 0x49fc80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4a03a2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x49fce8
inc ebx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov edx, esi
call fcn.0041b330
mov edi, eax
mov edx, dword [ebp - 8]
mov eax, dword [edi + 4]
call dword [edi]
test al, al
je 0x49fce4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a03b7
inc esi
dec ebx
jne 0x49fcb9
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049faf4
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
mov eax, ebx
cmp eax, 0x53
jg 0x49fdaa
je 0x4a027d
cmp eax, 0x11
jg 0x49fd68
je 0x4a008f
cmp eax, 0x10
ja case.0x49fd1d.1
jmp dword [eax*4 + 0x49fd24]
cmp eax, 0x1c
jg 0x49fd93
je 0x49ff2a
sub eax, 0x14
je 0x49fede
sub eax, 2
je 0x4a006f
sub eax, 4
je 0x4a0301
jmp case.0x49fd1d.1
sub eax, 0x1d
je 0x4a0327
sub eax, 0x1a
je 0x49fef3
jmp case.0x49fd1d.1
cmp eax, 0xb017
jg 0x49fe00
je 0x4a00e1
cmp eax, 0xb000
jg 0x49fde7
je 0x4a017a
sub eax, 0x112
je 0x49fe42
add eax, 0xffffffe0
sub eax, 7
jb 0x4a0043
sub eax, 0x1e1
je 0x4a033a
jmp case.0x49fd1d.1
sub eax, 0xb001
je 0x4a01f9
sub eax, 0x15
je 0x4a00bf
jmp case.0x49fd1d.1
cmp eax, 0xb020
jg 0x49fe26
je 0x4a0297
sub eax, 0xb01a
je 0x4a0239
sub eax, 5
je 0x4a027d
jmp case.0x49fd1d.1
sub eax, 0xb031
je 0x4a02d0
add eax, 0xfffffff2
sub eax, 2
jb 0x4a009e
jmp case.0x49fd1d.1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
and eax, 0xfff0
sub eax, 0xf020
je 0x49fe5d
sub eax, 0x100
je 0x49fe6a
jmp 0x49fe77
mov eax, dword [ebp - 4]
call fcn.004a03dc
jmp 0x4a0398
mov eax, dword [ebp - 4]
call fcn.004a04e0
jmp 0x4a0398
push ebp
call fcn.0049fbf0
pop ecx
jmp 0x4a0398
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 1
jne 0x4a0398
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 1
jmp 0x4a0398
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4a0398
call fcn.0049c6e4
jmp 0x4a0398
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
call fcn.004953bc
test eax, eax
je 0x49fed2
push ebp
call fcn.0049fc30
pop ecx
jmp 0x4a0398
push ebp
call fcn.0049fbf0
pop ecx
jmp 0x4a0398
mov eax, dword [ebp - 8]
mov dword [eax], 0x27
push ebp
call fcn.0049fbf0
pop ecx
jmp 0x4a0398
mov eax, dword [ebp - 4]
call fcn.004a03c0
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x4a0398
push 0
push 0
push 0xb01a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_GetPropW
push ebp
call fcn.0049fbf0
pop ecx
jmp 0x4a0398
push ebp
call fcn.0049fbf0
pop ecx
mov eax, dword [ebp - 8]
mov esi, eax
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x24], 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 0xa1], al
test al, al
je 0x49ff92
mov eax, dword [ebp - 4]
cmp byte [eax + 0xcf], 0
je 0x49ff6d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
je 0x49ff6d
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 0
mov eax, dword [ebp - 4]
call fcn.0049f7f8
push 0
push 0
push 0xb000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_GetPropW
jmp 0x4a0398
mov eax, dword [ebp - 4]
call fcn.0049f798
push 0
push 0
push 0xb001
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_GetPropW
jmp 0x4a0398
mov eax, dword [ebp - 8]
mov esi, eax
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x34], 0
je 0x4a0003
cmp byte [0x4a6ce8], 0
jne 0x49fff7
mov eax, dword [ebp - 4]
call fcn.0049f7f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb0]
test eax, eax
je 0x49fff7
call fcn.00495650
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xb0], edx
push ebp
call fcn.0049fbf0
pop ecx
jmp 0x4a0398
push ebp
call fcn.0049fbf0
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], 0
jne 0x4a0036
cmp byte [0x4a6ce8], 0
jne 0x4a0036
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
call fcn.0049558c
mov edx, dword [ebp - 4]
mov dword [edx + 0xb0], eax
mov eax, dword [ebp - 4]
call fcn.0049f7a0
jmp 0x4a0398
mov esi, dword [ebp - 8]
mov esi, dword [esi + 8]
push esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 8]
add ebx, 0xbc00
push ebx
mov eax, dword [ebp - 8]
push esi
call sub.user32.dll_GetWindowPlacement
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x4a0398
mov eax, dword [ebp - 8]
mov esi, eax
lea edi, [ebp - 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x44], 0
je 0x4a0398
call fcn.00404b50
jmp 0x4a0398
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 1
jmp 0x4a0398
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 8]
mov eax, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a2250
and eax, 0x7f
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x4a0398
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a08c0
test al, al
je 0x4a0398
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 1
jmp 0x4a0398
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4a0398
mov ebx, eax
mov eax, ebx
call fcn.0048890c
test eax, eax
je 0x4a0398
mov eax, ebx
call fcn.0048890c
push eax
call sub.user32.dll_GetForegroundWindow
test eax, eax
je 0x4a0398
mov eax, ebx
call fcn.0048890c
push eax
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x4a0398
mov byte [0x4a6cd4], 0
call sub.user32.dll_CharUpperBuffW
mov esi, eax
mov eax, ebx
call fcn.0048890c
push eax
call sub.user32.dll_InsertMenuItemW
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
mov edx, 0x112
mov eax, ebx
call fcn.00481454
push esi
call sub.user32.dll_InsertMenuItemW
mov byte [0x4a6cd4], 1
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 1
jmp 0x4a0398
mov eax, dword [ebp - 4]
cmp word [eax + 0x142], 0
je 0x4a0199
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x144]
call dword [ebx + 0x140]
mov eax, dword [0x4adef0]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4a01e9
mov eax, dword [0x4adef0]
cmp byte [eax + 0xcf], 0
je 0x4a01e9
mov eax, ebx
call fcn.0048890c
push eax
call sub.user32.dll_GetForegroundWindow
test eax, eax
jne 0x4a01e9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.0048890c
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0xd0]
je 0x4a01e9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
push eax
call sub.user32.dll_InsertMenuItemW
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xd0], edx
jmp 0x4a0398
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_DeleteMenu
mov edx, dword [ebp - 4]
mov dword [edx + 0xd0], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x13a], 0
je 0x4a0398
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x13c]
call dword [ebx + 0x138]
jmp 0x4a0398
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
call fcn.004953bc
test eax, eax
jne 0x4a0398
call sub.user32.dll_CharUpperBuffW
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x170]
jne 0x4a0398
xor eax, eax
call fcn.004956e8
test eax, eax
je 0x4a0398
push eax
call sub.user32.dll_InsertMenuItemW
jmp 0x4a0398
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 8]
movzx edx, word [edx + 4]
mov eax, dword [ebp - 4]
call fcn.004a0fac
jmp 0x4a0398
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x4a02b8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp - 4]
call fcn.004a0b18
jmp 0x4a0398
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp - 4]
call fcn.004a0b78
jmp 0x4a0398
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 1
jne 0x4a02ed
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x4a0398
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xb4], eax
jmp 0x4a0398
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
mov eax, dword [0x4a7568]
mov eax, dword [eax]
call fcn.0048dcb8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049fb74
push ebp
call fcn.0049fbf0
pop ecx
jmp 0x4a0398
mov eax, dword [0x4adef4]
call fcn.0049ec40
push ebp
call fcn.0049fbf0
pop ecx
jmp 0x4a0398
call fcn.0048fab8
call fcn.0048fc20
mov dword [ebp - 0x18], 0xb051
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [0x4adef4]
call fcn.0049df84
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4a0398
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x4adef4]
call fcn.0049df70
lea edx, [ebp - 0x18]
call fcn.00484664
inc esi
dec ebx
jne 0x4a036e
jmp 0x4a0398
xor eax, eax
call fcn.00422954
jmp 0x4a0398
push ebp
call fcn.0049fbf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a03b7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret