Function at 0x438690
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 0x112
ja 0x438957
je 0x4388ea
lea ecx, [eax - 0xd]
cmp ecx, 0xf4
ja case.0x4386c2.14
movzx ecx, byte [ecx + 0x438b24]
jmp dword [ecx*4 + 0x438aec]
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], 1
mov al, 1
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
push 0
push eax
mov ecx, edi
call fcn.004380e0
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov al, 1
pop ebx
pop ebp
ret 0x14
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push ecx
push eax
push edx
mov ecx, edi
call fcn.004381e0
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov al, 1
pop ebx
pop ebp
ret 0x14
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push ecx
push eax
push edx
mov ecx, edi
call fcn.004383e0
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov al, 1
pop ebx
pop ebp
ret 0x14
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push ecx
push eax
push edx
mov ecx, edi
call fcn.004384c0
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov al, 1
pop ebx
pop ebp
ret 0x14
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push ecx
push eax
push edx
mov ecx, edi
call fcn.00437bd0
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov al, 1
pop ebx
pop ebp
ret 0x14
mov esi, dword [ebp + 0x10]
cmp esi, 2
jne 0x43878f
mov dword [edi + 0x14], 1
jmp 0x438794
cmp esi, 0x12
je 0x4387d0
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [0x52fe2c]
push ebx
push esi
lea edx, [ebp + 0xc]
push edx
push eax
call fcn.0040c3d0
test eax, eax
je 0x4387bb
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0
jmp 0x4387d0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp esi, 2
jne 0x438ae1
mov dword [edi + 0x14], 0
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x14
mov edx, dword [0x52fe30]
cmp byte [edx + 0x11342], 0
je case.0x4386c2.14
cmp dword [ebp + 0x10], 9
je 0x438812
mov eax, dword [0x52fe2c]
mov ecx, dword [eax + 0x40a0]
call fcn.004a5d40
test al, al
je case.0x4386c2.14
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne case.0x4386c2.14
push 0x12
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je case.0x4386c2.14
push 0x5b
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je case.0x4386c2.14
push 0x5c
call esi
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ecx
push edx
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov al, 1
pop ebx
pop ebp
ret 0x14
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
push ecx
push eax
jmp 0x438ad2
mov ecx, dword [ebp + 0x14]
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
call edx
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov al, 1
pop ebx
pop ebp
ret 0x14
cmp dword [edi + 0x14], 0
je case.0x4386c2.14
mov edx, dword [0x52fe30]
cmp byte [edx + 0x11350], 0
je case.0x4386c2.14
cmp dword [ebp + 0x10], 0
je 0x4388d8
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4388d8
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], 0
mov al, 1
pop ebx
pop ebp
ret 0x14
mov esi, dword [ebp + 0x10]
cmp esi, 0xf030
je 0x438905
cmp esi, 0xf020
je 0x438905
cmp esi, 0xf120
jne 0x43890c
mov dword [edi + 0x14], 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, dword [0x52fe2c]
push eax
push esi
push ecx
mov ecx, dword [edx + 0x409c]
call fcn.00448690
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp esi, 0xf030
je 0x438947
cmp esi, 0xf020
je 0x438947
cmp esi, 0xf120
jne 0x438ae1
mov dword [edi + 0x14], 0
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x14
cmp eax, 0x2a2
ja 0x438aba
je case.0x4386c2.160
cmp eax, 0x200
je case.0x4386c2.14
cmp eax, 0x2a0
jne case.0x4386c2.14
mov edi, dword [ebp + 0x14]
mov esi, edi
shr esi, 0x10
movzx edx, si
movzx eax, di
push edx
push eax
call fcn.00425060
mov dword [0x53000c], edx
mov edx, dword [ebp + 0xc]
add esp, 8
mov dword [0x530008], eax
cmp edx, 0xa0
je 0x4389b0
cmp edx, 0xa2
jne 0x4389bf
mov ecx, dword [0x52fe2c]
push edx
call fcn.0041aac0
mov edx, dword [ebp + 0xc]
mov ecx, dword [0x52fe30]
mov bl, byte [ecx + 0x11350]
mov ecx, dword [ebp + 0x10]
xor al, al
cmp ecx, 3
jne 0x438a00
cmp edx, 0xa1
jne 0x438a00
mov edx, dword [0x52fe2c]
mov ecx, dword [edx + 0x409c]
call fcn.0044c3e0
mov eax, dword [ebp + 0x18]
pop edi
pop esi
mov dword [eax], 0
mov al, 1
pop ebx
pop ebp
ret 0x14
test bl, bl
je 0x438a4a
cmp ecx, 3
je 0x438a0e
cmp ecx, 2
jne 0x438a4a
cmp edx, 0xa4
je 0x438a38
cmp edx, 0xa5
jne 0x438a4a
mov eax, dword [0x52fe2c]
movsx ecx, si
push 0
movsx edx, di
push ecx
mov ecx, dword [eax + 0x409c]
push edx
call fcn.0044bff0
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], 0
mov al, 1
pop ebx
pop ebp
ret 0x14
cmp edx, 0xa4
je 0x438a5e
cmp edx, 0xa5
jne 0x438ae3
cmp ecx, 0x14
je 0x438a6d
cmp ecx, 8
je 0x438a6d
cmp ecx, 9
jne 0x438ae3
movzx eax, cx
sub eax, 8
je 0x438a7f
sub eax, 1
je 0x438a9d
sub eax, 0xb
jne 0x438a8b
push 0
mov ecx, 0x532a10
call fcn.004ae350
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], 0
mov al, 1
pop ebx
pop ebp
ret 0x14
mov ecx, dword [0x52fe2c]
call fcn.0041ffe0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], 0
mov al, 1
pop ebx
pop ebp
ret 0x14
cmp eax, 0x31e
jne case.0x4386c2.14
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push 0x31e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x14