Function at 0x41369b
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x28c
mov eax, 0x4655a1
call fcn.0043587d
mov eax, dword [ebp + 8]
lea edi, [ecx + 0x1050]
push dword [edi]
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x278], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
test eax, eax
jne 0x4137ae
mov eax, dword [ebp - 0x278]
jmp 0x4136ef
push dword [ebp - 0x26c]
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, ebx
je 0x413705
push 0xfffffffffffffff0
push eax
mov dword [ebp - 0x26c], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
jne 0x4136df
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x27c], esp
push ebx
push 3
push ebx
push ecx
mov dword [eax], ebx
mov eax, esp
mov dword [ebp - 0x27c], esp
push dword [ebp - 0x26c]
mov ecx, edi
mov dword [eax], ebx
call fcn.00411ca6
push 0x1f8
lea eax, [ebp - 0x238]
push ebx
push eax
call fcn.004374f0
add esp, 0xc
push ebx
lea ecx, [ebp - 0x238]
mov eax, 0x1f8
push ecx
push eax
push 0x29
mov dword [ebp - 0x238], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 0x274]
mov eax, dword [eax + 4]
push 1
push eax
push 0x30
push dword [edi]
mov dword [ebp - 0xec], 0x190
call esi
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x41a
push dword [edi]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call esi
push 0x280
push ebx
push 0x418
push dword [edi]
call esi
push ebx
push ebx
push 0x401
push dword [edi]
call esi
mov eax, dword [ebp + 0xc]
cmp eax, 0x200
je 0x4137d8
cmp eax, 0x2a3
je 0x4137d8
cmp eax, 0x202
je 0x4137d8
cmp eax, 0x205
je 0x4137d8
cmp eax, 0x208
jne 0x413a81
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x413a7e
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x413a7e
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x413a7e
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41381f
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x30
lea eax, [ebp - 0x268]
push ebx
push eax
call fcn.004374f0
mov ecx, dword [ebp - 0x274]
mov eax, dword [ebp - 0x278]
add ecx, 8
mov dword [ebp - 0x244], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x290], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x298], eax
add esp, 0xc
mov dword [ebp - 0x28c], ecx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x284]
push eax
mov dword [ebp - 0x268], 0x30
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x294], ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0x244]
lea ecx, [ebp - 0x27c]
call fcn.004076dd
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x278]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx eax, word [ebp - 0x14]
movzx ecx, word [ebp - 0x18]
shl eax, 0x10
or eax, ecx
push eax
lea eax, [ebp - 0x268]
push eax
push 0x465
push dword [ebp - 0x278]
call esi
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x274]
mov ecx, dword [eax + 0x1060]
cmp ecx, dword [ebp - 0x25c]
jne 0x4139dc
mov eax, dword [eax + 0x105c]
cmp eax, dword [ebp - 0x260]
jne 0x4139dc
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x278], ebx
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebp - 0x274]
add eax, 0x1064
push eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x4139e8
cmp dword [ebp - 0x26c], 0xffffffff
je 0x413a6e
push dword [ebp - 0x244]
lea ecx, [ebp - 0x26c]
call fcn.004076dd
push dword [eax]
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 1
call fcn.004061cf
mov ecx, dword [ebp - 0x26c]
test eax, eax
setne byte [ebp - 0x26d]
add ecx, 0xfffffff0
call fcn.00405c12
cmp byte [ebp - 0x26d], bl
je 0x4139ba
lea eax, [ebp - 0x268]
push eax
push ebx
push 0x436
push dword [edi]
call esi
push ebx
push 1
push 0x401
push dword [edi]
call esi
lea eax, [ebp - 0x298]
push eax
push ebx
push 0x407
push dword [edi]
call esi
jmp 0x413a6e
mov dword [ebp - 0x278], 1
jmp 0x4139fe
mov eax, dword [ebp - 0x274]
add eax, 0x1054
push eax
push ebx
push 0x433
push dword [edi]
call esi
cmp dword [ebp - 0x26c], 0xffffffff
je 0x413a1d
lea eax, [ebp - 0x268]
push eax
push ebx
push 0x432
push dword [edi]
call esi
push ebx
push 1
jmp 0x413a1f
push ebx
push ebx
push 0x401
push dword [edi]
call esi
lea eax, [ebp - 0x298]
push eax
push ebx
push 0x407
push dword [edi]
call esi
cmp dword [ebp - 0x278], ebx
je 0x413a57
mov eax, dword [ebp - 0x274]
add eax, 0x1054
push eax
push ebx
push 0x433
push dword [edi]
call esi
mov edi, dword [ebp - 0x274]
push 0xc
add edi, 0x1054
pop ecx
lea esi, [ebp - 0x268]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x27c]
add ecx, 0xfffffff0
call fcn.00405c12
jmp 0x413adb
mov eax, dword [ebp + 0xc]
cmp eax, 0x100
jb 0x413a8f
cmp eax, 0x109
jbe 0x413ac4
lea ecx, [eax - 0x104]
cmp ecx, 3
jbe 0x413ac4
cmp eax, 0x201
je 0x413ac4
cmp eax, 0x203
je 0x413ac4
cmp eax, 0x204
je 0x413ac4
cmp eax, 0x206
je 0x413ac4
cmp eax, 0x207
je 0x413ac4
cmp eax, 0x209
jne 0x413adb
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x413adb
push ebx
push ebx
push 0x401
push dword [edi]
call esi
call fcn.00435900
ret 0x10