Function at 0x4907d0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9b6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x188c
call fcn.004d3780
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.004ad6b0
mov dword [0x4fde48], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x6d9220], eax
mov eax, dword [ebp + 8]
push 0x104
push 0x68d7f0
push eax
mov dword [0x6dcf84], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x68d7f0
call fcn.004afda0
push str.Software360SE
call fcn.004b8550
add esp, 8
test eax, eax
jne 0x490863
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.2.2.0.4
lea ecx, [ebp - 0x48c]
call fcn.004aa600
lea ecx, [ebp - 0x48c]
mov dword [ebp - 4], ebx
call fcn.004aa290
mov eax, dword [ebp - 0x264]
mov cl, byte [0x4ffed8]
mov dword [0x6dcf80], eax
mov byte [ebp - 0x189c], cl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x189b]
mov edx, dword [ebp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xfff
jbe 0x4908c8
mov ecx, 0xfff
jmp 0x4908d4
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea edx, [ebp - 0x189c]
push edx
call dword [sym.imp.MSVCRT.dll_strncpy]
lea eax, [ebp - 0x189c]
push eax
call fcn.004afcf0
mov esi, dword [sym.imp.MSVCRT.dll_strncmp]
push 0xa
lea ecx, [ebp - 0x189c]
push str._uninstall
push ecx
call esi
add esp, 0x1c
test eax, eax
jne 0x49091b
call fcn.00490480
call fcn.004b85e0
jmp 0x491070
push 8
lea edx, [ebp - 0x189c]
push str._install
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x490946
lea eax, [ebp - 0x189c]
push eax
call fcn.00490330
add esp, 4
jmp 0x491070
push 7
lea ecx, [ebp - 0x189c]
push str._setdef
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x49096e
push 1
push 1
call fcn.004352a0
add esp, 8
jmp 0x491070
push 9
lea edx, [ebp - 0x189c]
push str._unsetdef
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x490995
push 1
push ebx
call fcn.004352a0
add esp, 8
jmp 0x491070
push 6
lea eax, [ebp - 0x189c]
push str._isdef
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x4909df
push 1
call fcn.00434e70
add esp, 4
lea ecx, [ebp - 0x48c]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004aa6a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0xd
lea ecx, [ebp - 0x189c]
push str._360StartSafe
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x490a05
mov eax, 1
mov dword [0x4fc630], eax
mov dword [0x6bf644], eax
mov ecx, 0x56469c
call fcn.00424bf0
mov ecx, 0x6b8dd4
call fcn.004730d0
mov ecx, 0x6b8dd4
call fcn.00476c80
push ebx
mov ecx, 0x6bfa78
call fcn.00487230
call fcn.00437de0
call fcn.0043c620
push 6
mov ecx, 0x6bfa78
call fcn.0048a1c0
mov edi, dword [0x6d8dc4]
xor edx, edx
cmp edi, ebx
mov ecx, 0x6dcfb0
sete dl
push edx
call fcn.004bc990
push 0x68d7f0
call fcn.004382f0
mov esi, eax
push esi
call fcn.00490680
add esp, 8
test eax, eax
jne 0x491070
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
xor ecx, ecx
add esp, 4
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [0x6d9224], edx
call fcn.00484200
mov ecx, 0x68e7e0
call fcn.004601d0
mov ecx, 0x68da80
call fcn.00482050
mov ecx, 0x6bf520
call fcn.004833f0
push ebx
call fcn.00434e70
add esp, 4
test eax, eax
je 0x490acb
push 1
call fcn.00417510
add esp, 4
cmp dword [0x6dbf24], ebx
je 0x490ade
push str.MFC42U.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 1
call fcn.004a6240
mov ecx, dword [0x6bf644]
add esp, 4
cmp ecx, ebx
mov eax, 0x66
je 0x490afc
mov eax, 0xb4
mov ecx, dword [0x6dcf84]
push 0x4eb864
push 0x33
push 0x32
push ecx
push eax
call fcn.004b85f0
mov edx, dword [0x6d8dc0]
push 0x6d8fd0
push 0x6d8dc8
push edx
call fcn.004b8630
mov eax, dword [0x6cca50]
add esp, 0x20
push eax
call fcn.004c4d80
mov ecx, eax
call fcn.004c5d60
push reloc.DSOUND.dll_DirectSoundCreate
push 0x4fc630
push str.SingleThread
push str.Main
call fcn.004ae0e0
mov esi, dword [0x4fc630]
mov edx, dword [0x6d9210]
add esp, 0x10
xor ecx, ecx
cmp esi, ebx
push ebx
push edx
sete cl
push 0x490260
push 0x4902c0
mov dword [0x6bfaf4], ecx
call fcn.00490320
mov edx, dword [0x4fc630]
push eax
xor eax, eax
cmp edx, ebx
sete al
push eax
mov ecx, 0x68eb10
call fcn.004b1c80
cmp dword [0x6bfb64], ebx
je 0x490bae
mov dword [0x68f37c], 0x6b96bc
mov ecx, dword [0x6c36b8]
push 0x6c36bc
push ecx
mov ecx, 0x68eb10
call fcn.004b2720
push 1
call fcn.00438050
mov eax, dword [0x6dcf84]
push str.Site.ini
lea edx, [ebp - 0x694]
push 0x104
push edx
push eax
call fcn.004a7ac0
add esp, 0x14
lea ecx, [ebp - 0x694]
push ecx
mov ecx, 0x68e5b8
call fcn.0048ecd0
mov ecx, 0x68ea48
call fcn.0047e130
mov edx, dword [0x6bfb5c]
mov dword [0x68eb08], 0x68ea48
push edx
call fcn.004b8660
mov ecx, eax
call fcn.004d1360
lea eax, [ebp - 0x48c]
push eax
push 0xf
call fcn.004ae820
add esp, 4
mov ecx, 0x68f388
push eax
call fcn.0044ace0
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x68f388
call fcn.004b8f00
call fcn.0043c740
call fcn.0043ca20
push str.BMP_GESTURE
push esi
mov ecx, 0x68e7e0
call fcn.0045ffc0
mov ecx, 0x68f388
call fcn.00453f30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push esi
mov dword [ebp - 0x30], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], ebx
jmp 0x490c92
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 4], 1
push ebx
push ebx
lea ecx, [ebp - 0x2c]
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x491062
mov eax, dword [ebp - 0x28]
cmp eax, 0x202
jne 0x490cc3
mov dword [ebp + 8], ebx
jmp 0x490dd4
cmp eax, 0x201
jne 0x490d0f
cmp dword [0x4fc630], ebx
jne 0x490d21
mov esi, dword [0x6b3e54]
cmp esi, ebx
je 0x490d21
mov edx, dword [ebp - 0x2c]
mov eax, dword [esi + 4]
push edx
push eax
call fcn.004d2790
add esp, 8
cmp eax, ebx
je 0x490d05
mov ecx, dword [esi + 4]
push 0x2398
push 0x2397
push 0x9419
push ecx
call edi
mov eax, dword [ebp - 0x28]
cmp eax, 0x201
je 0x490d21
cmp eax, 0x204
je 0x490d21
cmp eax, 0x207
jne 0x490dd4
mov esi, dword [0x6b3d74]
cmp esi, ebx
je 0x490dd4
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x490dd1
lea edx, [ebp - 0x50]
mov dword [ebp - 0x50], ebx
push edx
push esi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x50]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x490d7a
push ebx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
push 0x10
push esi
call edi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], ebx
cmp eax, 0x201
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
jne 0x490dd4
lea eax, [ebp - 0x40]
mov ecx, 0x69ebf0
push eax
push 0x51
call fcn.004cbe80
cmp eax, ebx
je 0x490dd1
mov eax, dword [0x69ebf4]
lea ecx, [ebp - 0x40]
push 2
push ecx
push ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x40]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x490c9c
mov eax, dword [ebp - 0x28]
cmp dword [0x4fc630], ebx
je 0x490e07
cmp dword [0x6c3ebc], ebx
je 0x490e07
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
push edx
mov edx, dword [ebp - 0x2c]
push ecx
push eax
push edx
mov ecx, 0x68e7e0
call fcn.0045f520
cmp eax, 1
je 0x490c9c
mov eax, dword [ebp - 0x28]
cmp eax, 0x113
je 0x490e13
cmp eax, 0xf
jne 0x490e27
cmp dword [0x68e820], ebx
je 0x490e27
cmp dword [0x6c3ec8], ebx
jne 0x490c9c
cmp eax, 0x201
jne 0x490e61
mov ecx, 0x696914
call fcn.004b7270
mov esi, eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp esi, eax
jne 0x490e5e
mov ecx, 0x696914
call fcn.004b8360
cmp eax, ebx
je 0x490e5e
push 1
mov ecx, 0x696914
call fcn.004b82c0
mov eax, dword [ebp - 0x28]
cmp eax, 0x100
jne 0x490ee1
mov eax, dword [ebp - 0x24]
cmp eax, 0xd
jne 0x490eb5
mov ecx, 0x696914
call fcn.004b7270
cmp dword [ebp - 0x2c], eax
jne 0x490ee1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
movsx eax, ax
shr eax, 0x10
jne 0x490e9d
push 0x11
call esi
movsx ecx, ax
shr ecx, 0x10
je 0x490ee1
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
push edx
push eax
push 0x8d5
push ecx
call edi
jmp 0x490c9c
cmp eax, 9
jne 0x490ee1
mov ecx, 0x696914
call fcn.004b8360
cmp eax, ebx
je 0x490ee1
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x490c9c
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, 0x68f388
call fcn.00457dc0
cmp eax, ebx
jne 0x490c9c
mov eax, dword [0x68f38c]
lea edx, [ebp - 0x2c]
push edx
push eax
mov ecx, 0x6da2b8
call fcn.004a1c30
cmp eax, ebx
jne 0x490c9c
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, 0x690934
call fcn.004c4b40
cmp eax, ebx
jne 0x490c9c
cmp dword [0x4fc630], ebx
je 0x490f49
lea edx, [ebp - 0x2c]
mov ecx, 0x68eb10
push edx
call fcn.004b2680
cmp eax, ebx
jne 0x490c9c
jmp 0x490f67
mov eax, dword [ebp - 0x28]
cmp eax, 0x200
jbe 0x490f67
cmp eax, 0x20d
ja 0x490f67
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.0040d850
add esp, 8
cmp dword [ebp - 0x28], 0x20a
jne 0x490f8c
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x30]
push ecx
lea eax, [ebp - 0x2c]
push edx
push eax
call fcn.004d20d0
add esp, 0xc
cmp eax, ebx
jne 0x490c9c
mov edx, dword [0x68f38c]
lea ecx, [ebp - 0x2c]
push ecx
push edx
mov ecx, 0x6da2b8
call fcn.004a1c50
cmp eax, ebx
jne 0x490c9c
cmp dword [ebp - 0x28], 0x100
jne 0x491015
cmp dword [ebp - 0x24], 0x1b
jne 0x491015
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x89c]
push 0x104
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x491015
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x68f3b8]
push edx
push eax
call fcn.004d2790
add esp, 8
cmp eax, ebx
jne 0x491001
lea eax, [ebp - 0x89c]
push str.edit
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x491015
mov ecx, dword [0x68f38c]
push ebx
push 0x800a
push 0x111
push ecx
call edi
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x490c9c
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x48c]
mov dword [ebp - 4], 0xffffffff
call fcn.004aa6a0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10