Function at 0x40f0f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x3c
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
mov esi, edx
cmp byte [esi + 0x41], 0
push edi
mov ebx, ecx
je 0x40f15b
mov eax, dword [esi + 0x3c]
push eax
call fcn.00451c80
add esp, 4
test al, al
je 0x40f15b
cmp byte [0x9f43f5], 0
jne 0x40f15b
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov eax, dword [esi + 0x3c]
push ecx
push ebx
push edx
push eax
mov byte [0x9f43f5], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [0x9f43f5], 0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0065865c
add esp, 0x3c
ret
mov ebp, ebx
shr ebp, 0x10
mov dword [esp + 0x14], ebp
test bl, 8
jne 0x40f401
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
shr eax, 0xf
test al, 1
jne 0x40f401
test bl, 2
jne 0x40f401
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
cmp eax, 4
je 0x40f1ff
cmp eax, 5
je 0x40f1ff
cmp eax, 6
je 0x40f1ff
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x34]
push 0
call eax
fld qword [0x9ad8b8]
fucompp
fnstsw ax
test ah, 0x44
jp 0x40f1ff
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
test bp, bp
jle 0x40f1e5
mov eax, dword [edx + 0x6c]
push 0
call eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0065865c
add esp, 0x3c
ret
mov eax, dword [edx + 0x68]
call eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0065865c
add esp, 0x3c
ret
cmp dword [0x9f43f8], 0
je 0x40f494
test bl, 0x20
jne 0x40f220
push 0x12
call edi
shr eax, 0xf
test al, 1
jne 0x40f220
xor bl, bl
jmp 0x40f228
mov bl, 1
mov byte [0x9f43f6], bl
cmp dword [0x9f43f8], 0
jge 0x40f2fd
mov eax, esi
call fcn.00401a70
test eax, eax
je 0x40f2fd
xor eax, eax
xor edx, edx
test bl, bl
sete dl
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov eax, dword [esi + 0xc]
push edx
push eax
mov dword [esp + 0x34], 0x1c
mov dword [esp + 0x38], 2
call dword [sym.imp.USER32.dll_GetScrollInfo]
test bl, bl
je 0x40f2c1
mov edx, dword [esp + 0x38]
movsx ecx, bp
push 0x78
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edi, eax
mov eax, esi
neg edi
call fcn.00401a70
mov edx, edi
call fcn.00443f80
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0065865c
add esp, 0x3c
ret
mov ecx, dword [esp + 0x38]
push 1
movsx eax, bp
push 0x78
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edi, eax
mov eax, esi
neg edi
call fcn.00401a70
mov ecx, eax
mov eax, edi
call fcn.00443fb0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0065865c
add esp, 0x3c
ret
mov eax, dword [esi + 0xc]
movsx edx, bp
mov ebp, dword [sym.imp.USER32.dll_GetScrollPos]
add dword [esi + 0x364], edx
push 1
push eax
call ebp
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x18], eax
mov eax, dword [0x9f43f8]
cmp dword [esi + 0x364], eax
jl 0x40f361
jmp 0x40f330
push 0
push 0
test bl, bl
je 0x40f343
mov ecx, dword [esi + 0xc]
push 0x114
push ecx
jmp 0x40f34c
mov edx, dword [esi + 0xc]
push 0x115
push edx
call edi
mov eax, dword [0x9f43f8]
sub dword [esi + 0x364], eax
cmp dword [esi + 0x364], eax
jge 0x40f330
neg eax
cmp dword [esi + 0x364], eax
jg 0x40f3a3
jmp 0x40f370
push 0
push 1
test bl, bl
je 0x40f383
mov eax, dword [esi + 0xc]
push 0x114
push eax
jmp 0x40f38c
mov ecx, dword [esi + 0xc]
push 0x115
push ecx
call edi
mov eax, dword [0x9f43f8]
add dword [esi + 0x364], eax
neg eax
cmp dword [esi + 0x364], eax
jle 0x40f370
test bl, bl
jne 0x40f494
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
call fcn.004013e0
test al, al
jne 0x40f494
mov ecx, dword [esi + 0xc]
push 1
push ecx
call ebp
cmp eax, dword [esp + 0x18]
jne 0x40f494
cmp word [esp + 0x14], 0
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
jle 0x40f1e5
mov eax, dword [edx + 0x6c]
push 1
call eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0065865c
add esp, 0x3c
ret
mov edi, dword [esi + 0xc]
lea ecx, [esp + 0x18]
xor ebp, ebp
push ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x40f43d
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x40f43d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp word [esp + 0x14], bp
jge 0x40f44c
fld dword [0x9adb18]
jmp 0x40f452
fld dword [0x9adb08]
mov ecx, dword [esi + 4]
fstp dword [esp + 0x14]
mov eax, dword [ecx]
fld dword [esp + 0x14]
mov edx, dword [eax + 0x38]
push ecx
fstp dword [esp]
call edx
mov ecx, dword [esi + 4]
fstp dword [esp + 0x18]
mov eax, dword [ecx]
fld dword [esp + 0x18]
mov eax, dword [eax + 0x30]
lea edx, [esp + 0x20]
push edx
push ecx
fstp dword [esp]
call eax
call fcn.00423300
test bl, 2
je 0x40f494
mov byte [esi + 0x144], 0
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0065865c
add esp, 0x3c
ret