Function at 0x49a6a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, ebx
cmp eax, 0x206
jg 0x49a717
je 0x49a790
cmp eax, 0x100
jg 0x49a6f1
je 0x49a7db
sub eax, 2
je 0x49a76c
sub eax, 0xd
je 0x49acc2
sub eax, 0x38
je case.0x49a725.1126
jmp case.0x49a725.1127
sub eax, 0x104
je 0x49a7c2
add eax, 0xfffffff1
sub eax, 3
jb 0x49a790
add eax, 0xffffff16
sub eax, 5
jb 0x49a790
jmp case.0x49a725.1127
add eax, 0xfffffb9b
cmp eax, 0xf
ja case.0x49a725.1127
jmp dword [eax*4 + 0x49a72c]
push str.Call_stack
push edi
call sub.USER32.DLL_SetWindowTextA
mov edx, dword [ebp + 0x14]
push edx
push esi
push ebx
push edi
push 0x4dcc54
call sym.Cari___.exe__Tablefunction
add esp, 0x14
jmp case.0x49a725.1127
mov ecx, dword [ebp + 0x14]
push ecx
push esi
push ebx
push edi
push 0x4dcc54
call sym.Cari___.exe__Tablefunction
add esp, 0x14
jmp case.0x49a725.1127
mov eax, dword [ebp + 0x14]
push eax
push esi
push ebx
push edi
push 0x4dcc54
call sym.Cari___.exe__Tablefunction
add esp, 0x14
jmp 0x49ad31
mov edx, dword [ebp + 0x14]
push edx
push esi
push ebx
push edi
push 0x4dcc54
call sym.Cari___.exe__Tablefunction
add esp, 0x14
jmp case.0x49a725.1127
push 0x10
call sub.USER32.DLL_GetKeyState
movsx ecx, ax
and ecx, 0x8000
mov dword [ebp - 4], ecx
push 0x11
call sub.USER32.DLL_GetKeyState
movsx eax, ax
and eax, 0x8000
mov edx, dword [0x4dcd64]
mov dword [ebp - 8], eax
push edx
push 0x4dcc58
call sym.Cari___.exe__Getsortedbyselection
add esp, 8
mov dword [ebp - 0x10], eax
cmp esi, 0x73
jne 0x49a859
cmp dword [ebp - 4], 0
jne 0x49a859
cmp dword [ebp - 8], 0
jne 0x49a859
cmp dword [ebp - 0x10], 0
je 0x49a859
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x10], 0
jge 0x49a859
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1c], 0
je 0x49a859
push 1
push 0
push 1
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0xc]
push ecx
push 0
call sym.Cari___.exe__Go
add esp, 0x14
jmp 0x49a8cb
cmp esi, 0xd
jne 0x49a89b
cmp dword [ebp - 4], 0
jne 0x49a89b
cmp dword [ebp - 8], 0
jne 0x49a89b
cmp dword [ebp - 0x10], 0
je 0x49a89b
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10], 0
jge 0x49a89b
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x14], 0
je 0x49a89b
push 0xd
push 0
push 0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x14]
push eax
push 0
call sym.Cari___.exe__Setcpu
add esp, 0x14
jmp 0x49a8cb
cmp esi, 0x20
jne 0x49a8b7
cmp dword [ebp - 8], 0
jne 0x49a8b7
push 0
push 2
push 0x46e
push edi
call fcn.0049a6a0
jmp 0x49a8cb
mov edx, dword [ebp + 0x14]
push edx
push esi
push ebx
push edi
push 0x4dcc54
call sym.Cari___.exe__Tablefunction
add esp, 0x14
xor eax, eax
jmp 0x49ad31
mov edx, dword [0x4dcd64]
push edx
push 0x4dcc58
call sym.Cari___.exe__Getsortedbyselection
add esp, 8
mov dword [ebp - 0x10], eax
call sub.USER32.DLL_CreatePopupMenu
mov esi, eax
xor eax, eax
mov dword [ebp - 0x14], eax
test esi, esi
je 0x49aa43
push 0x4c9606
push 1
push 0
push esi
call sub.USER32.DLL_AppendMenuA
cmp dword [0x4dcea4], 0
je 0x49a926
push 0x4c9611
push 2
push 0
push esi
call sub.USER32.DLL_AppendMenuA
jmp 0x49a935
push 0x4c9627
push 2
push 0
push esi
call sub.USER32.DLL_AppendMenuA
cmp dword [0x4d7d98], 1
jle 0x49a9cb
call sub.USER32.DLL_CreatePopupMenu
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49a9cb
xor ebx, ebx
jmp 0x49a9b2
lea eax, [ebx + ebx*2]
lea eax, [ebx + eax*4]
shl eax, 3
sub eax, ebx
shl eax, 2
sub eax, ebx
mov edx, dword [0x4d7db0]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0xc], ecx
push 0x400
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x114]
push edx
call sym.Cari___.exe__Decodethreadname
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
lea eax, [ebx + 0x300]
push eax
call sym.Cari___.exe__Getcputhreadid
cmp eax, dword [ebp - 0xc]
jne 0x49a9a5
mov edx, 8
jmp 0x49a9a7
xor edx, edx
push edx
mov eax, dword [ebp - 0x14]
push eax
call sub.USER32.DLL_AppendMenuA
inc ebx
cmp ebx, dword [0x4d7d98]
jl 0x49a952
push 0x4c963d
mov ecx, dword [ebp - 0x14]
push ecx
push 0x10
push esi
call sub.USER32.DLL_AppendMenuA
cmp dword [ebp - 0x10], 0
je 0x49aa43
push 0x4c95d1
push 0
push 0x800
push esi
call sub.USER32.DLL_AppendMenuA
push 0x4c9644
push 0xa
push 0
push esi
call sub.USER32.DLL_AppendMenuA
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10], 0
jge 0x49aa13
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x14], 0
je 0x49aa13
push 0x4c965d
push 0xb
push 0
push esi
call sub.USER32.DLL_AppendMenuA
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x10], 0
jge 0x49aa43
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1c], 0
je 0x49aa43
push 0x4c9673
push 0xc
push 0
push esi
call sub.USER32.DLL_AppendMenuA
push 0x4c967e
push 0xd
push 0
push esi
call sub.USER32.DLL_AppendMenuA
push esi
push 0
push 0x465
push edi
push 0x4dcc54
call sym.Cari___.exe__Tablefunction
add esp, 0x14
mov ebx, eax
cmp dword [ebp - 0x14], 0
je 0x49aa6a
mov eax, dword [ebp - 0x14]
push eax
call sub.USER32.DLL_DestroyMenu
test esi, esi
je 0x49aa74
push esi
call sub.USER32.DLL_DestroyMenu
cmp ebx, 1
jne 0x49aa8b
mov edx, dword [0x4f55c8]
push edx
call fcn.0049a1f0
pop ecx
jmp 0x49ab6f
cmp ebx, 2
jne 0x49aaa4
push 0
push 2
push 0x46e
push edi
call fcn.0049a6a0
jmp 0x49ab6f
cmp ebx, 0xa
jne 0x49aac7
push 0x800
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
push eax
push 0
push 0
push 0
call sym.Cari___.exe__Setcpu
add esp, 0x14
jmp 0x49ab6f
cmp ebx, 0xb
jne 0x49aae8
push 0xd
push 0
push 0
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x14]
push ecx
push 0
call sym.Cari___.exe__Setcpu
add esp, 0x14
jmp 0x49ab6f
cmp ebx, 0xc
jne 0x49ab06
push 0xd
push 0
push 0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x1c]
push edx
push 0
call sym.Cari___.exe__Setcpu
add esp, 0x14
jmp 0x49ab6f
cmp ebx, 0xd
jne 0x49ab24
push 1
push 0
push 1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0xc]
push eax
push 0
call sym.Cari___.exe__Go
add esp, 0x14
jmp 0x49ab6f
cmp ebx, 0x300
jl 0x49ab6f
mov edx, dword [0x4d7d98]
add edx, 0x300
cmp ebx, edx
jge 0x49ab6f
lea eax, [ebx - 0x300]
push 0x4001
push 0
push 0
push 0
lea edx, [eax + eax*2]
lea edx, [eax + edx*4]
shl edx, 3
sub edx, eax
shl edx, 2
sub edx, eax
mov ecx, dword [0x4d7db0]
mov eax, dword [ecx + edx*4]
push eax
call sym.Cari___.exe__Setcpu
add esp, 0x14
xor eax, eax
jmp 0x49ad31
mov edx, dword [0x4dcd64]
push edx
push 0x4dcc58
call sym.Cari___.exe__Getsortedbyselection
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x49ab9a
xor eax, eax
jmp 0x49ad31
mov eax, esi
shr eax, 0x10
test ax, ax
jne 0x49abc2
push 0x800
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx]
push ecx
push 0
push 0
push 0
call sym.Cari___.exe__Setcpu
add esp, 0x14
jmp 0x49ac57
cmp ax, 3
jne 0x49abf7
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10], 0
jge 0x49ac57
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x1c], 0
je 0x49ac57
push 0xd
push 0
push 0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x1c]
push eax
push 0
call sym.Cari___.exe__Setcpu
add esp, 0x14
jmp 0x49ac57
shr esi, 0x10
cmp si, 4
jne 0x49ac2e
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x10], 0
jge 0x49ac57
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x18], 0
je 0x49ac57
push 0x800
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x18]
push edx
push 0
push 0
push 0
call sym.Cari___.exe__Setcpu
add esp, 0x14
jmp 0x49ac57
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x10], 0
jge 0x49ac57
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x14], 0
je 0x49ac57
push 0xd
push 0
push 0
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x14]
push ecx
push 0
call sym.Cari___.exe__Setcpu
add esp, 0x14
mov eax, 1
jmp 0x49ad31
cmp esi, 2
jne 0x49ac9f
cmp dword [0x4dcea4], 0
sete al
and eax, 1
mov dword [0x4dcea4], eax
test eax, eax
je 0x49ac88
mov dword [0x4dce28], 0x4c9693
jmp 0x49ac92
mov dword [0x4dce28], 0x4c96a9
mov edx, dword [0x4f55c8]
push edx
call fcn.0049a1f0
pop ecx
xor eax, eax
jmp 0x49ad31
push 0
push 0
push edi
call sub.USER32.DLL_InvalidateRect
xor eax, eax
jmp 0x49ad31
or dword [0x4d54cc], 0x1000
xor eax, eax
jmp 0x49ad31
push edi
mov esi, 0x4c96b3
lea edi, [ebp - 0x114]
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push 0x804
mov edx, dword [0x4f55c8]
push edx
lea ecx, [ebp - 0x106]
push ecx
call sym.Cari___.exe__Decodethreadname
add esp, 0xc
test eax, eax
jne 0x49ad01
mov byte [ebp - 0x10a], 0
lea eax, [ebp - 0x114]
push eax
push edi
call sub.USER32.DLL_SetWindowTextA
push 0x49a40c
push 0x4dcc54
push edi
call sym.Cari___.exe__Painttable
add esp, 0xc
xor eax, eax
jmp 0x49ad31
mov edx, dword [ebp + 0x14]
push edx
push esi
push ebx
push edi
call sub.USER32.DLL_DefMDIChildProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10