Function at 0x41eb90
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4755d0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x120]
push edi
mov edi, dword [esp + 0x120]
push esi
call ebx
lea ecx, [eax + 1]
mov eax, 0xff
cmp ecx, eax
jg 0x41ebcf
push esi
call ebx
inc eax
push eax
push esi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor ebx, ebx
push ebx
push ebx
push 0x45c970
mov ebp, 0x460868
push ebp
lea eax, [esp + 0x28]
push eax
call fcn.0044168f
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSystemMenu]
test eax, eax
jne 0x41ec05
mov byte [esp + 0x18], bl
lea eax, [esp + 0x18]
push 0x460890
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41ec25
push ebx
push 0xf030
jmp 0x41ecb4
lea eax, [esp + 0x18]
push 0x46088c
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41ec42
push ebx
push 0xf020
jmp 0x41ecb4
lea eax, [esp + 0x18]
push str.restore
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41ec5f
push ebx
push 0xf120
jmp 0x41ecb4
lea eax, [esp + 0x18]
push str.move
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41ec7c
push ebx
push 0xf010
jmp 0x41ecb4
lea eax, [esp + 0x18]
push str.close
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41ec99
push ebx
push 0xf060
jmp 0x41ecb4
lea eax, [esp + 0x18]
push str.size
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41ecc5
push ebx
push 0xf000
push 0x112
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x41eeb9
cmp esi, ebx
je 0x41ecd4
push ebp
push esi
call fcn.00447a30
pop ecx
pop ecx
jmp 0x41ecd6
xor eax, eax
cmp eax, ebx
je 0x41eeb9
push ebx
push edi
call fcn.00442631
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
push ebx
push ebx
push 0x12
call edi
mov ebp, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call ebp
push ebx
push ebx
push ebx
push 0x20
call edi
push eax
push 0x20
call ebp
push ebx
push 2
push ebx
push 0x20
call edi
push eax
push 0x20
call ebp
push ebx
push 2
push ebx
push 0x12
call edi
push eax
push 0x12
call ebp
cmp esi, ebx
je 0x41ed36
push 0x460868
push esi
call fcn.00447a30
pop ecx
pop ecx
jmp 0x41ed38
xor eax, eax
cmp byte [eax + 1], 0x41
jl 0x41ed59
cmp esi, ebx
je 0x41ed51
push 0x460868
push esi
call fcn.00447a30
pop ecx
pop ecx
jmp 0x41ed53
xor eax, eax
cmp byte [eax + 1], 0x5a
jle 0x41edc5
cmp esi, ebx
je 0x41ed6c
push 0x460868
push esi
call fcn.00447a30
pop ecx
pop ecx
jmp 0x41ed6e
xor eax, eax
cmp byte [eax + 1], 0x61
jl 0x41ed8f
cmp esi, ebx
je 0x41ed87
push 0x460868
push esi
call fcn.00447a30
pop ecx
pop ecx
jmp 0x41ed89
xor eax, eax
cmp byte [eax + 1], 0x7a
jle 0x41edc5
cmp esi, ebx
je 0x41eda2
push 0x460868
push esi
call fcn.00447a30
pop ecx
pop ecx
jmp 0x41eda4
xor eax, eax
cmp byte [eax + 1], 0x30
jl 0x41ede7
cmp esi, ebx
je 0x41edbd
push 0x460868
push esi
call fcn.00447a30
pop ecx
pop ecx
jmp 0x41edbf
xor eax, eax
cmp byte [eax + 1], 0x39
jg 0x41ede7
cmp esi, ebx
je 0x41edd8
push 0x460868
push esi
call fcn.00447a30
pop ecx
pop ecx
jmp 0x41edda
xor eax, eax
movzx eax, byte [eax + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
jmp 0x41edff
cmp esi, ebx
je 0x41edfa
push 0x460868
push esi
call fcn.00447a30
pop ecx
pop ecx
jmp 0x41edfc
xor eax, eax
mov al, byte [eax + 1]
mov byte [esp + 0x14], al
cmp esi, ebx
je 0x41ee16
push 0x460868
push esi
call fcn.00447a30
pop ecx
pop ecx
jmp 0x41ee18
xor eax, eax
movzx eax, byte [eax + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
shr eax, 8
mov byte [esp + 0x13], al
cmp al, bl
je 0x41ee3a
push ebx
push ebx
push ebx
push 0x10
call edi
push eax
push 0x10
call ebp
mov cl, byte [esp + 0x14]
cmp cl, 0x21
jb 0x41ee48
cmp cl, 0x2e
jbe 0x41ee60
cmp cl, 0x11
je 0x41ee60
cmp cl, 0x5b
je 0x41ee60
cmp cl, 0x5c
je 0x41ee60
cmp cl, 0x5d
je 0x41ee60
xor eax, eax
jmp 0x41ee63
xor eax, eax
inc eax
push ebx
push eax
movzx esi, cl
push ebx
push esi
call edi
push eax
push dword [esp + 0x20]
call ebp
mov al, byte [esp + 0x14]
cmp al, 0x21
jb 0x41ee7f
cmp al, 0x2e
jbe 0x41ee93
cmp al, 0x11
je 0x41ee93
cmp al, 0x5b
je 0x41ee93
cmp al, 0x5c
je 0x41ee93
cmp al, 0x5d
je 0x41ee93
xor eax, eax
jmp 0x41ee96
xor eax, eax
inc eax
push ebx
or eax, 2
push eax
push ebx
push esi
call edi
push eax
push dword [esp + 0x20]
call ebp
cmp byte [esp + 0x13], bl
je 0x41eeb9
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call ebp
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.00448080
add esp, 0x10c
ret 8