Function at 0x490b40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov bl, byte [ebp + 8]
cmp bl, 0x41
jb 0x490b54
cmp bl, 0x5a
jbe 0x490b5b
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x490b62
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x509e1c], 0
je 0x490b83
lea ecx, [ebx - 0x70]
cmp cl, 0xf
ja 0x490b83
mov edx, dword [ebp + 8]
push edx
call fcn.0041c5d0
add esp, 4
test eax, eax
jne 0x490b5b
mov eax, dword [0x513238]
mov ecx, dword [0x51323c]
push esi
lea edx, [ebx - 0x70]
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp dl, 0x17
ja 0x490be3
push 0x10
call edi
cwde
test eax, eax
js 0x490be3
push 0x11
call edi
test ax, ax
js 0x490be3
mov eax, dword [0x5096e4]
movzx ecx, bl
sub ecx, 0x70
test eax, eax
je 0x490be3
mov edx, 1
shl edx, cl
test dword [eax + 0x60], edx
je 0x490be3
lea esi, [ecx + 1]
mov byte [ebp + 8], 0
mov bl, byte [ebp + 8]
or esi, 0xffff8000
jmp 0x490be5
xor esi, esi
movzx eax, bl
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
add eax, 0xfffffffd
cmp eax, 0x78
ja case.0x490c01.4
movzx eax, byte [eax + 0x490f58]
jmp dword [eax*4 + 0x490ef0]
cmp dword [ebp + 0xc], 3
je case.0x490c01.4
mov esi, 0xfffffffe
jmp case.0x490c01.4
cmp dword [ebp + 0xc], 3
je case.0x490c01.4
mov esi, 0xfffffffc
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
push 0x10
call edi
test ax, ax
jns 0x490c52
push 0xfffffffffffffffb
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
push 0x11
call edi
test ax, ax
jns 0x490c6c
push 0xffffffffffffffe2
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
push 0xfffffffffffffff1
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
push 0xfffffffffffffffb
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
push 0xfffffffffffffffa
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
cmp dword [ebp + 0xc], 3
je case.0x490c01.4
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x490cd0
cmp byte [0x5096f1], 0
jne case.0x490c01.4
jmp 0x490cd4
test eax, eax
je 0x490ce1
push 0x10
call edi
cwde
test eax, eax
js case.0x490c01.4
movzx esi, byte [0x5096f1]
neg esi
sbb esi, esi
and esi, 0x22
add esi, 0xffffffdb
jmp case.0x490c01.4
mov esi, 0xfffffffd
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
push 0xfffffffffffffff5
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
mov ecx, 0x50a900
call fcn.0043f950
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
push 0xffffffffffffffe1
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
push 0xffffffffffffffe5
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
push 0xfffffffffffffff2
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
push 0xffffffffffffffd6
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
push 0xffffffffffffffdf
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
test ebx, ebx
jne case.0x490c01.4
push 0xffffffffffffffee
call fcn.004930a0
add esp, 4
mov esi, eax
jmp case.0x490c01.4
cmp dword [ebp + 0xc], 0
je 0x490dda
push 0x10
call edi
test ax, ax
js case.0x490c01.4
movzx esi, byte [0x5096f1]
neg esi
sbb esi, esi
and esi, 0x23
add esi, 0xffffffdc
jmp case.0x490c01.4
or esi, 0xffffffff
jmp case.0x490c01.4
cmp dword [ebp + 0xc], 1
je case.0x490c01.4
cmp dword [ebp + 0xc], 3
je case.0x490c01.4
cmp dword [ebp + 0xc], 2
jne 0x490e1b
push 0x10
call edi
test ax, ax
js case.0x490c01.4
mov esi, 0xfffffff6
jmp case.0x490c01.4
cmp dword [ebp + 0xc], 1
je case.0x490c01.4
cmp dword [ebp + 0xc], 3
je case.0x490c01.4
cmp dword [ebp + 0xc], 2
jne 0x490e3d
push 0x10
call edi
cwde
test eax, eax
js case.0x490c01.4
mov esi, 0xfffffff7
jmp case.0x490c01.4
cmp dword [ebp + 0xc], 3
je case.0x490c01.4
mov esi, 0xfffffff9
jmp case.0x490c01.4
cmp dword [ebp + 0xc], 3
je case.0x490c01.4
mov esi, 0xfffffff8
jmp case.0x490c01.4
cmp dword [ebp + 0xc], 0
jne case.0x490c01.4
mov esi, 3
jmp case.0x490c01.4
cmp dword [ebp + 0xc], 0
jne case.0x490c01.4
push 0x10
call edi
movsx esi, ax
shr esi, 0x1f
or esi, 4
jmp case.0x490c01.4
mov esi, 0xffffffdc
jmp case.0x490c01.4
mov esi, 0xffffffdb
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [0x513238], ecx
mov dword [0x51323c], edx
test esi, esi
je 0x490ee7
test ebx, ebx
je 0x490eb5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x490eca
push ebx
push esi
call fcn.004909d0
add esp, 8
test eax, eax
je 0x490eca
or dword [0x51323c], 8
cmp dword [ebp + 0xc], 0
je 0x490edb
mov al, byte [ebp + 8]
cmp al, 0x26
je 0x490ee7
cmp al, 0x28
je 0x490ee7
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret