Function at 0x410e37
Capabilities:
Log keystrokes via polling
Reference sql statements

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call fcn.0048d6d0
push 1
call fcn.0040e3ec
mov edx, 0x5cf064
lea ecx, [0x8f9a78]
call fcn.0042e008
mov dword [esp], 0
jmp 0x410e69
push 0x4d
call fcn.00478744
cmp eax, dword [esp]
jl 0x410f13
push dword [esp]
push 0x4d
call fcn.00473779
mov ebx, eax
and ebx, 1
and ebx, ebx
je 0x410f0a
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 2
push dword [esp + 0x10]
push 0x4d
call fcn.00478771
call fcn.0048d660
push dword [0x8f99d8]
push 0
call fcn.0047aa84
mov ebx, eax
add ebx, 0xa0
push ebx
push 0
call fcn.0047ab13
mov ebx, eax
add ebx, 0xc8
push ebx
call fcn.0042e5e2
add dword [esp + 0xc], edx
call fcn.0041975e
lea eax, [0x8f9a78]
push eax
call fcn.0048d5d0
jmp 0x410f13
inc dword [esp]
jno 0x410e69
push dword [0x8f9a78]
mov edx, str.noneresult
pop ecx
call fcn.0042e590
je 0x410f35
push 0
call fcn.0040e3ec
jmp 0x411366
push 7
push 0x5de4fc
lea eax, [esp + 0xc]
push eax
push 0x48
call fcn.00486c28
mov dword [esp], 0
jmp 0x410f57
push 0x4d
call fcn.00478744
cmp eax, dword [esp]
jl 0x410fc1
push dword [esp]
push 0x4d
call fcn.00473779
mov ebx, eax
and ebx, 1
and ebx, ebx
je 0x410fbc
push dword [esp + 4]
call fcn.00486cba
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0
push dword [esp + 0xc]
push 0x4d
call fcn.00478771
mov ebp, dword [esp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.0048d5d0
push dword [esp]
pop eax
mov dword [ebp + 0x4c], eax
inc dword [esp]
jno 0x410f57
mov eax, str.Begin_Transaction
push eax
push dword [0x8f9c5c]
call fcn.0047f005
mov ebx, eax
and ebx, ebx
jne 0x41101b
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
mov edx, 0x5d8d16
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
call fcn.0047f041
pop eax
call fcn.0042e5e2
add dword [esp], edx
call fcn.004200c8
call fcn.0042e610
push dword [esp + 4]
call fcn.00486d62
push dword [esp + 4]
call fcn.00486d77
or eax, eax
je 0x4112f7
mov ebp, dword [esp + 8]
push dword [ebp + 0xc]
call fcn.00414040
and eax, eax
je 0x4110fa
push 2
push dword [0x8f9a78]
mov ebp, dword [esp + 0x10]
push dword [ebp + 0x4c]
push 0x4d
call fcn.0047344a
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
mov edx, str.UPDATE_keys_SET_Comment
push edx
call fcn.0048d570
mov edx, dword [0x8f9a78]
push edx
call fcn.0048d570
mov edx, 0x5d59d8
push edx
call fcn.0048d570
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048d570
mov edx, 0x5cf830
push edx
call fcn.0048d570
call fcn.0048d660
push dword [0x8f9c5c]
call fcn.0042e5e2
add dword [esp + 4], edx
call fcn.0047f005
call fcn.0042e610
mov ebx, eax
and ebx, ebx
jne 0x4110cf
push 0
mov ebp, dword [esp + 0xc]
push dword [ebp + 0x4c]
push 0x1013
push 0x4d
call fcn.004735ef
push eax
call sub.USER32.dll_SendMessageW
call fcn.0041a887
jmp 0x4112cf
push edx
call fcn.0048d530
pop edx
push eax
mov ebp, dword [esp + 0xc]
push dword [ebp + 0xc]
call fcn.0041a1cc
lea eax, [esp + 0x10]
push eax
call fcn.0048d5d0
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0x4e
call fcn.00473529
call fcn.0042e5e2
add dword [esp], edx
call fcn.0041a1cc
call fcn.0048d660
push edx
call fcn.0048d530
pop edx
push eax
mov edx, 0x5d1a70
push edx
call fcn.0048d570
mov edx, dword [0x8f9b78]
push edx
call fcn.0048d570
call fcn.0042e600
mov edx, eax
pop ecx
push ecx
call fcn.0042e600
mov ecx, eax
call fcn.0042e590
je 0x4111b6
push edx
call fcn.0048d530
pop edx
push eax
mov edx, str.SELECT_key_FROM_keys_WHERE_NOT_key_And_Description
push edx
call fcn.0048d570
mov edx, dword [esp + 0x10]
push edx
call fcn.0048d570
mov edx, str._And_NOT_Blocked
push edx
call fcn.0048d570
lea eax, [esp + 0x14]
push eax
call fcn.0048d5d0
jmp 0x4111e8
push edx
call fcn.0048d530
pop edx
push eax
mov edx, str.SELECT_key_FROM_keys_WHERE_NOT_key_And_Description
push edx
call fcn.0048d570
mov edx, dword [esp + 0x10]
push edx
call fcn.0048d570
mov edx, str._And_Blocked
push edx
call fcn.0048d570
lea eax, [esp + 0x14]
push eax
call fcn.0048d5d0
push dword [esp + 0x10]
push dword [0x8f9c5c]
call fcn.0047f11d
mov ebx, eax
and ebx, ebx
je 0x4112cf
push dword [0x8f9c5c]
call fcn.0047f12f
and eax, eax
je 0x4112c4
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0
push dword [0x8f9c5c]
call fcn.0047f157
lea eax, [esp + 0x18]
push eax
call fcn.0048d5d0
push dword [esp + 0x14]
mov edx, 0x5cf064
pop ecx
call fcn.0042e590
jne 0x4112ba
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
mov edx, str.UPDATE_keys_SET_Comment
push edx
call fcn.0048d570
mov edx, dword [0x8f9a78]
push edx
call fcn.0048d570
mov edx, 0x5d59d8
push edx
call fcn.0048d570
mov edx, dword [esp + 0x1c]
push edx
call fcn.0048d570
mov edx, 0x5cf830
push edx
call fcn.0048d570
call fcn.0048d660
push dword [0x8f9c5c]
call fcn.0042e5e2
add dword [esp + 4], edx
call fcn.0047f005
call fcn.0042e610
mov ebx, eax
and ebx, ebx
jne 0x4112ba
call fcn.0041a887
jmp 0x411201
push dword [0x8f9c5c]
call fcn.0047f184
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x4112f2
call fcn.0047af05
mov ebx, eax
and ebx, ebx
jne 0x4112f2
call fcn.0041a887
jmp 0x4112f7
jmp 0x411024
mov eax, str.Commit
push eax
push dword [0x8f9c5c]
call fcn.0047f005
mov ebx, eax
and ebx, ebx
jne 0x411351
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
mov edx, 0x5d8d16
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
call fcn.0047f041
pop eax
call fcn.0042e5e2
add dword [esp], edx
call fcn.004200c8
call fcn.0042e610
push dword [esp + 4]
call fcn.00486dab
push 0
call fcn.0040e3ec
xor eax, eax
push dword [esp + 0x14]
call fcn.0048d760
push dword [esp + 0xc]
call fcn.0048d760
push dword [esp + 0x10]
call fcn.0048d760
push eax
push dword [esp + 8]
call fcn.00486dab
pop eax
add esp, 0x18
pop ebx
pop ebp
ret