Function at 0x4903a0
Capabilities:
Log keystrokes via polling
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
test eax, eax
push 0x26
je 0x490801
call esi
mov edi, dword [esp + 0x10]
push 0x28
test eax, 0x8001
setne al
mov byte [edi], al
call esi
test eax, 0x8001
setne cl
push 0x25
mov byte [edi + 1], cl
call esi
test eax, 0x8001
setne dl
push 0x27
mov byte [edi + 2], dl
call esi
test eax, 0x8001
setne al
push 0xd
mov byte [edi + 3], al
call esi
test eax, 0x8001
setne cl
push 0x20
mov byte [edi + 4], cl
call esi
test eax, 0x8001
setne dl
push 0x11
mov byte [edi + 5], dl
call esi
test eax, 0x8001
setne al
push 0x10
mov byte [edi + 6], al
call esi
test eax, 0x8001
setne cl
push 0x12
mov byte [edi + 7], cl
call esi
test eax, 0x8001
setne dl
push 9
mov byte [edi + 8], dl
call esi
test eax, 0x8001
setne al
push 0x1b
mov byte [edi + 9], al
call esi
test eax, 0x8001
setne cl
push 0x21
mov byte [edi + 0xa], cl
call esi
test eax, 0x8001
setne dl
push 0x22
mov byte [edi + 0xb], dl
call esi
test eax, 0x8001
setne al
push 0x23
mov byte [edi + 0xc], al
call esi
test eax, 0x8001
setne cl
push 0x24
mov byte [edi + 0xd], cl
call esi
test eax, 0x8001
setne dl
push 0x70
mov byte [edi + 0xe], dl
call esi
test eax, 0x8001
setne al
mov byte [edi + 0xf], al
push 0x71
call esi
test eax, 0x8001
setne cl
push 0x72
mov byte [edi + 0x10], cl
call esi
test eax, 0x8001
setne dl
push 0x73
mov byte [edi + 0x11], dl
call esi
test eax, 0x8001
setne al
push 0x74
mov byte [edi + 0x12], al
call esi
test eax, 0x8001
setne cl
push 0x75
mov byte [edi + 0x13], cl
call esi
test eax, 0x8001
setne dl
push 0x76
mov byte [edi + 0x14], dl
call esi
test eax, 0x8001
setne al
push 0x77
mov byte [edi + 0x15], al
call esi
test eax, 0x8001
setne cl
push 0x78
mov byte [edi + 0x16], cl
call esi
test eax, 0x8001
setne dl
push 0x79
mov byte [edi + 0x17], dl
call esi
test eax, 0x8001
setne al
push 0x7a
mov byte [edi + 0x18], al
call esi
test eax, 0x8001
setne cl
push 0x7b
mov byte [edi + 0x19], cl
call esi
test eax, 0x8001
setne dl
push 0x30
mov byte [edi + 0x1a], dl
call esi
test eax, 0x8001
setne al
push 0x31
mov byte [edi + 0x1b], al
call esi
test eax, 0x8001
setne cl
push 0x32
mov byte [edi + 0x1c], cl
call esi
test eax, 0x8001
setne dl
push 0x33
mov byte [edi + 0x1d], dl
call esi
test eax, 0x8001
setne al
push 0x34
mov byte [edi + 0x1e], al
call esi
test eax, 0x8001
setne cl
push 0x35
mov byte [edi + 0x1f], cl
call esi
test eax, 0x8001
setne dl
push 0x36
mov byte [edi + 0x20], dl
call esi
test eax, 0x8001
setne al
push 0x37
mov byte [edi + 0x21], al
call esi
test eax, 0x8001
setne cl
push 0x38
mov byte [edi + 0x22], cl
call esi
test eax, 0x8001
setne dl
push 0x39
mov byte [edi + 0x23], dl
call esi
test eax, 0x8001
setne al
push 0x60
mov byte [edi + 0x24], al
call esi
test eax, 0x8001
setne cl
push 0x61
mov byte [edi + 0x25], cl
call esi
test eax, 0x8001
setne dl
push 0x62
mov byte [edi + 0x26], dl
call esi
test eax, 0x8001
setne al
push 0x63
mov byte [edi + 0x27], al
call esi
test eax, 0x8001
setne cl
push 0x64
mov byte [edi + 0x28], cl
call esi
test eax, 0x8001
setne dl
push 0x65
mov byte [edi + 0x29], dl
call esi
test eax, 0x8001
setne al
push 0x66
mov byte [edi + 0x2a], al
call esi
test eax, 0x8001
setne cl
push 0x67
mov byte [edi + 0x2b], cl
call esi
test eax, 0x8001
setne dl
push 0x68
mov byte [edi + 0x2c], dl
call esi
test eax, 0x8001
setne al
push 0x69
mov byte [edi + 0x2d], al
call esi
test eax, 0x8001
setne cl
push 0x41
mov byte [edi + 0x2e], cl
call esi
test eax, 0x8001
setne dl
push 0x42
mov byte [edi + 0x2f], dl
call esi
test eax, 0x8001
setne al
push 0x43
mov byte [edi + 0x30], al
call esi
test eax, 0x8001
setne cl
push 0x44
mov byte [edi + 0x31], cl
call esi
test eax, 0x8001
setne dl
push 0x45
mov byte [edi + 0x32], dl
call esi
test eax, 0x8001
setne al
push 0x46
mov byte [edi + 0x33], al
call esi
test eax, 0x8001
setne cl
push 0x47
mov byte [edi + 0x34], cl
call esi
test eax, 0x8001
setne dl
push 0x48
mov byte [edi + 0x35], dl
call esi
test eax, 0x8001
setne al
push 0x49
mov byte [edi + 0x36], al
call esi
test eax, 0x8001
setne cl
push 0x4a
mov byte [edi + 0x37], cl
call esi
test eax, 0x8001
setne dl
push 0x4b
mov byte [edi + 0x38], dl
call esi
test eax, 0x8001
setne al
push 0x4c
mov byte [edi + 0x39], al
call esi
test eax, 0x8001
setne cl
push 0x4d
mov byte [edi + 0x3a], cl
call esi
test eax, 0x8001
setne dl
push 0x4e
mov byte [edi + 0x3c], dl
call esi
test eax, 0x8001
setne al
push 0x4f
mov byte [edi + 0x3b], al
call esi
test eax, 0x8001
setne cl
push 0x50
mov byte [edi + 0x3d], cl
call esi
test eax, 0x8001
setne dl
push 0x51
mov byte [edi + 0x3e], dl
call esi
test eax, 0x8001
setne al
push 0x52
mov byte [edi + 0x3f], al
call esi
test eax, 0x8001
setne cl
push 0x53
mov byte [edi + 0x40], cl
call esi
test eax, 0x8001
setne dl
push 0x54
mov byte [edi + 0x41], dl
call esi
test eax, 0x8001
setne al
push 0x55
mov byte [edi + 0x42], al
call esi
test eax, 0x8001
setne cl
push 0x56
mov byte [edi + 0x43], cl
call esi
test eax, 0x8001
setne dl
push 0x57
mov byte [edi + 0x44], dl
call esi
test eax, 0x8001
setne al
push 0x58
mov byte [edi + 0x45], al
call esi
test eax, 0x8001
setne cl
push 0x59
mov byte [edi + 0x46], cl
call esi
test eax, 0x8001
setne dl
push 0x5a
mov byte [edi + 0x47], dl
call esi
test eax, 0x8001
setne al
mov byte [edi + 0x48], al
pop edi
pop esi
ret
mov edi, dword [esp + 0x14]
mov ecx, 0x12
xor eax, eax
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
call esi
push 0x28
call esi
push 0x25
call esi
push 0x27
call esi
push 0xd
call esi
push 0x20
call esi
push 0x11
call esi
push 0x10
call esi
push 0x12
call esi
push 9
call esi
push 0x1b
call esi
push 0x21
call esi
push 0x22
call esi
push 0x23
call esi
push 0x24
call esi
mov edi, 0x70
push edi
call esi
inc edi
cmp edi, 0x7b
jle 0x49084e
mov edi, 0x30
push edi
call esi
inc edi
cmp edi, 0x69
jle 0x49085c
mov edi, 0x41
push edi
call esi
inc edi
cmp edi, 0x5a
jle 0x49086a
pop edi
pop esi
ret