Function at 0x499020
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49943e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0xd54], 0
je 0x499423
mov eax, dword [0x49eea4]
cmp dword [eax], 2
je 0x49906f
cmp dword [ebx + 0x21cc], 0
je 0x49906f
push 0
lea eax, [ebx + 0xb94]
push eax
push 1
push 0x61
call sub.user32.dll_SystemParametersInfoA
mov eax, ebx
call fcn.00499010
test al, al
je 0x49922c
lea eax, [ebp - 8]
mov ecx, dword [ebx + 0xca4]
mov edx, 0x499454
call fcn.00403e7c
mov eax, dword [ebp - 8]
call fcn.00403ff4
push eax
push 0x30ec
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
mov esi, eax
mov dword [ebx + 0xb90], esi
test esi, esi
je 0x499423
push 0x9dc
push 0
push 0
push 0xf001f
push esi
call sub.KERNEL32.DLL_MapViewOfFile
mov edi, eax
mov dword [ebx + 0xbb0], edi
test edi, edi
je 0x499423
mov eax, edi
xor ecx, ecx
mov edx, 0x9dc
call fcn.00402c08
mov eax, dword [ebx + 0xbb0]
mov dword [eax + 0x60], 1
mov eax, dword [ebx + 0xd54]
call fcn.00403ff4
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov dword [ebx + 0xcac], esi
test esi, esi
jne 0x499196
lea eax, [ebp - 4]
call fcn.00403bb0
mov eax, dword [ebx + 0xd54]
call fcn.00408ab4
test al, al
je 0x49913c
lea eax, [ebp - 4]
mov edx, 0x499474
call fcn.00403c48
push 0
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402994
mov eax, dword [ebp - 0xc]
call fcn.00403ff4
push eax
push 0x499490
push dword [ebp - 4]
push 0x4994a4
call sub.KERNEL32.DLL_GetLastError
lea edx, [ebp - 0x14]
call fcn.0040a7c4
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403ef0
mov eax, dword [ebp - 0x10]
call fcn.00403ff4
push eax
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_MessageBoxA
jmp 0x499423
cmp dword [ebx + 0x21bc], 0
jne 0x4991a8
cmp dword [ebx + 0x21cc], 0
je 0x4991ea
push 0x4994b4
mov eax, dword [ebx + 0xcac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [ebx + 0xcb0], esi
test esi, esi
je 0x499423
push 0x4994bc
mov eax, dword [ebx + 0xcac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [ebx + 0xcb4], esi
test esi, esi
je 0x499423
push 0x4994c4
mov eax, dword [ebx + 0xcac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [ebx + 0xcbc], esi
test esi, esi
je 0x499423
push 0x4994cc
mov eax, dword [ebx + 0xcac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [ebx + 0xcb8], esi
test esi, esi
je 0x499423
cmp dword [ebx + 0x21c8], 0
je 0x49925b
push 0x2c
push 0
push 0xfffffffffffffffe
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
push 0x2c
push 1
push 0xffffffffffffffff
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
cmp dword [ebx + 0x21cc], 0
je 0x499277
push 9
push 1
push 1
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
cmp dword [ebx + 0x21bc], 0
jne 0x49928d
cmp dword [ebx + 0x21cc], 0
je 0x499316
push 0x2c
push 5
push 2
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
push 0x90
push 5
push 3
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
push 0x54
push 3
push 4
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
push 0x55
push 8
push 5
mov eax, ebx
call fcn.0043afa4
push eax
call sub.user32.dll_RegisterHotKey
push 0
mov eax, dword [ebx + 0xcac]
push eax
mov eax, dword [ebx + 0xcb4]
push eax
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0xcc0], eax
push 0
mov eax, dword [ebx + 0xcac]
push eax
mov eax, dword [ebx + 0xcb0]
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0xcc4], eax
cmp dword [ebx + 0x21e4], 0
je 0x49933c
push 0
mov eax, dword [ebx + 0xcac]
push eax
mov eax, dword [ebx + 0xcb8]
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0xccc], eax
mov esi, dword [ebx + 0xcac]
test esi, esi
je 0x49935d
push 0
push esi
mov eax, dword [ebx + 0xcbc]
push eax
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0xcc8], eax
mov eax, ebx
call fcn.00499010
test al, al
je 0x499423
mov esi, dword [ebx + 0xbb0]
cmp dword [ebx + 0x21cc], 0
setne al
mov byte [esi + 0x949], al
cmp dword [ebx + 0x21e4], 0
setne al
mov byte [esi + 0x52], al
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 0x550], eax
cmp dword [ebx + 0x21bc], 0
setne al
mov byte [esi + 0x51], al
mov eax, ebx
call fcn.0043afa4
mov dword [esi + 0x40], eax
mov eax, ebx
call fcn.0043afa4
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 0xcc4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0xcc0]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xcc8]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0xccc]
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x24], eax
mov byte [esi + 0x481], 1
mov byte [esi + 0x4d], 0
mov byte [esi + 0x50], 0
mov byte [esi + 0x4f], 0
mov byte [esi + 0x4e], 0
mov byte [esi + 0x4c], 1
mov byte [esi + 0x58], 0
mov byte [esi + 0x8c1], 1
mov byte [esi + 0x44], 0
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 0x54], eax
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [esi + 0x74], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499445
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403bd4
ret