Function at 0x430b20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
cmp dword [0x449564], esi
je 0x430b60
cmp dword [edi + 4], 0x112
jne 0x430b60
cmp dword [edi + 8], 0xf060
jne 0x430b60
cmp dword [edi + 0xc], esi
jne 0x430b60
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push ebx
call fcn.004308d0
test eax, eax
jne 0x430b52
lea eax, [ebx + 0x10c]
push edi
call fcn.004064e0
test eax, eax
jne 0x430b52
cmp dword [edi + 4], 0x201
jne 0x430ce0
mov eax, dword [edi]
cmp eax, dword [ebx + 0x28]
jne 0x430ce0
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
push ecx
lea esi, [ebx + 0x358]
call fcn.00406440
lea edi, [ebx + 0x35c]
lea eax, [esp + 0x20]
call fcn.0040d9c0
mov edx, dword [esp + 0x20]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
add edx, 0x3c
mov dword [esp + 0x28], edx
mov edx, dword [eax + 0x14]
push ecx
push edx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x430cdd
mov ecx, dword [ebx + 0x15c]
lea edx, [ebx + 0x10c]
call fcn.00406a70
mov esi, eax
test esi, esi
je 0x430c7a
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x430c7a
mov esi, dword [esi + 0xc8]
cmp esi, 0x7d
jg 0x430c48
je 0x430c41
cmp esi, 0x32
je 0x430c3a
cmp esi, 0x4b
je 0x430c33
cmp esi, 0x64
jne 0x430c7a
mov eax, 0x809c
jmp 0x430c70
mov eax, 0x809f
jmp 0x430c70
mov eax, 0x809e
jmp 0x430c70
mov eax, 0x809d
jmp 0x430c70
sub esi, 0x96
je 0x430c6b
sub esi, 0x32
je 0x430c64
sub esi, 0xc8
jne 0x430c7a
mov eax, 0x80a2
jmp 0x430c70
mov eax, 0x80a1
jmp 0x430c70
mov eax, 0x80a0
push 1
lea edi, [ebx + 0x34]
call fcn.00403e40
push ecx
mov eax, esp
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], 0
mov dword [eax], 0x10a
call fcn.00407ae0
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ecx, dword [ebx + 4]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
call fcn.00407d00
mov edx, dword [esp + 0x14]
push 0
push edx
mov edx, dword [esp + 0x24]
push 0
mov ecx, edi
push ecx
push eax
push 0x20
push edx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
lea esi, [esp + 0x10]
call fcn.00407ac0
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0x20a
jne 0x430e0b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x430e0b
mov ecx, dword [ebx + 0x15c]
lea edx, [ebx + 0x10c]
call fcn.00406a70
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
je 0x430e0b
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x430e0b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x430e0b
cmp word [edi + 0xa], 0
jle 0x430d5a
add dword [esi + 0xc8], 0xa
jmp 0x430d61
add dword [esi + 0xc8], 0xfffffff6
mov ecx, dword [ebx + 0x15c]
mov edx, ebx
call fcn.0042d160
mov dword [esp + 0x14], eax
test eax, eax
je 0x430e0b
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [esi + 0xc8]
lea esi, [esp + 0x20]
call fcn.0040daa0
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov edx, dword [edx + 0xd8]
push 0
mov ecx, esi
push ecx
push 0
push 0x3f
push eax
call edx
lea esi, [esp + 0x10]
call fcn.00401000
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0xc8]
push ecx
push 0x43c5ec
mov edi, esi
call fcn.00401ac0
mov edx, dword [esp + 0x18]
add esp, 8
push edx
lea eax, [ebx + 0x34]
push eax
mov ecx, 9
call fcn.00403f20
mov eax, esi
call fcn.004010c0
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov edi, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x430e26
mov ecx, dword [ebx + 4]
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x430b52
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4