Function at 0x49028f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x4902ff
cmp dword [ebp + 0x1c], 0x6a
jne 0x490667
cmp dword [ebp + 0xc], 0x100
jne 0x490667
xor ebx, ebx
cmp dword [ebp + 0x10], 0x61
mov dword [edi + 0x5b4], ebx
je 0x4902cc
cmp dword [ebp + 0x10], 0x41
jne 0x4902e6
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x4902e6
sub esp, 0xc
lea ecx, [edi + 0x588]
call fcn.00493b82
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x5b4], ebx
je 0x490667
xor eax, eax
inc eax
jmp 0x490669
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
inc ebx
cmp ecx, 0x113
jne 0x490338
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.0049182b
mov ecx, dword [ebp + 0x18]
mov dword [ecx], esi
cmp dword [edi + 0x5b4], esi
je 0x49063d
mov eax, ebx
jmp 0x490669
cmp ecx, 0x4e
jne 0x49035f
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 0xffffffff
jne 0x49063a
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00490126
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x490325
cmp ecx, 0x110
jne 0x49038b
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00490d02
mov esi, dword [ebp + 0x18]
mov dword [esi], eax
cmp dword [edi + 0x5b4], 0
jne 0x490331
mov ecx, esi
jmp 0x49063d
cmp ecx, 0x10
jne 0x4903ac
push esi
push 2
push 0x111
push dword [edi + 4]
mov dword [edi + 0x5b4], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x490320
push 2
pop edx
cmp ecx, edx
jne 0x4903d3
lea eax, [edi + 0x63c]
mov dword [edi + 0x5b4], ebx
push eax
push edx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, edi
call fcn.0044d0a3
jmp 0x490320
cmp ecx, 0x112
jne 0x490406
mov eax, dword [ebp + 0x10]
and eax, 0xfff0
mov dword [edi + 0x5b4], esi
cmp eax, 0xf060
jne 0x490320
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491666
jmp 0x490320
cmp ecx, 0x111
jne 0x490430
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
mov dword [edi + 0x5b4], ebx
push ecx
mov dword [eax], ecx
mov ecx, edi
mov eax, dword [ebp + 0x10]
shr eax, 0x10
push eax
call fcn.004927cc
jmp 0x490320
cmp ecx, 0x133
jne 0x49045a
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
push ecx
mov dword [edi + 0x5b4], ebx
mov dword [eax], ecx
mov eax, esp
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov ecx, edi
call fcn.00492647
jmp 0x490358
cmp ecx, 0x467
jne 0x490484
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491e15
push dword [ebp + 0x10]
mov ecx, edi
push ebx
call fcn.00491b92
jmp 0x490320
cmp ecx, 0x46b
jne 0x4904a3
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.0049106b
jmp 0x490358
cmp ecx, 0x46e
jne 0x4904dd
mov dword [edi + 0x5b4], ebx
mov dword [edi + 0x618], 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.005f1777
pop ecx
push esi
push 0x96
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x490320
cmp ecx, 0x46d
jne 0x4904fe
push esi
push 0xc8
lea ecx, [edi + 0x28]
mov dword [edi + 0x5b4], ebx
call fcn.0044754b
jmp 0x490320
cmp ecx, 0x470
jne 0x49051b
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.00491103
jmp 0x490358
cmp ecx, 0x471
jne 0x490538
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.0049117a
jmp 0x490358
cmp ecx, 0x46c
jne 0x490557
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.004912fb
jmp 0x490358
cmp ecx, 0x468
jne 0x4905a6
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x10], edx
jne 0x49059c
cmp dword [ebp + 0x14], 0x204
je 0x490579
cmp dword [ebp + 0x14], 0x201
jne 0x49059c
cmp byte [edi + 0x5f0], 0
jne 0x490588
mov byte [edi + 0x5f0], bl
push 9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], esi
jmp 0x490331
cmp ecx, 0x46a
jne 0x4905c1
push edx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004476d2
jmp 0x490320
cmp ecx, 0x472
jne 0x4905db
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.00491784
jmp 0x490320
cmp ecx, 0x474
jne 0x4905f8
sub esp, 0xc
mov dword [edi + 0x5b4], ebx
mov ecx, edi
call fcn.0049135c
jmp 0x490358
cmp ecx, 0x476
jne 0x49061a
mov ecx, dword [ebp + 0x14]
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x5b4], ebx
push ecx
mov ecx, edi
call fcn.004913d6
jmp 0x490358
cmp ecx, 0x479
jne 0x49063a
mov ecx, dword [ebp + 0x14]
push ecx
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x5b4], ebx
call fcn.004915f2
jmp 0x490358
mov ecx, dword [ebp + 0x18]
mov esi, dword [edi + 0x578]
push 0
push ecx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044a37e
mov dword [edi + 0x578], esi
test eax, eax
jne 0x490331
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18