Function at 0x1004ece0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e59aa
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10145188]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x10145188]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
cmp esi, 0x112
jne 0x1004ed54
cmp edi, 0xf120
je 0x1004ed4e
cmp edi, 0xf030
je 0x1004ed4e
cmp edi, 0xf020
jne 0x1004ed54
mov dword [ebx + 0x5b8], edi
mov ecx, dword [0x101489d4]
cmp esi, dword [ecx + 0x4c]
jne 0x1004ed74
call fcn.100c39d0
push str.Taskbar_re_Created_.
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 8
mov edx, dword [esp + 0x14]
push edx
push edi
push esi
mov ecx, ebx
call fcn.100028c0
mov dword [esp + 0x18], eax
cmp esi, 0x17a1
ja 0x1004f0fb
je 0x1004f0dc
cmp esi, 0x112
ja 0x1004f03a
je 0x1004f00e
cmp esi, 5
je 0x1004ef06
cmp esi, 0x7e
je 0x1004ee70
cmp esi, 0x100
jne case.0x1004f111.6063
cmp edi, 0x44
je 0x1004edd6
cmp edi, 0x64
jne case.0x1004f111.6063
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
test al, al
je 0x1004ee22
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.Configuration.dll_class_cm_configuration::ConfigurationManager____cdecl_cm_configuration::GetConfigurationManager_void_]
mov ecx, eax
call dword [sym.imp.Configuration.dll_public:_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______thiscall_cm_configuration::ConfigurationManager::get_lang_void_]
mov dword [esp + 0x40], 0
push 0x1010043c
mov esi, eax
mov dword [esp + 0x20], 1
call fcn.10038e70
add esp, 4
test al, al
je 0x1004ee22
mov bl, 1
jmp 0x1004ee24
xor bl, bl
mov dword [esp + 0x40], 0xffffffff
test byte [esp + 0x1c], 1
je 0x1004ee3d
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
test bl, bl
je case.0x1004f111.6063
push str.start_en_halo.
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x100ee700
call dword [0x100ec95c]
call fcn.100c4120
jmp case.0x1004f111.6063
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
push eax
push edi
call dword [sym.imp.RJCTeacher.dll_int___cdecl_RJCTLIB::cm_on_screen_change_int__int_]
add esp, 8
call dword [sym.imp.Configuration.dll_class_cm_configuration::ConfigurationManager____cdecl_cm_configuration::GetConfigurationManager_void_]
mov ecx, eax
call dword [sym.imp.Configuration.dll_public:_enum_RCD_PRODUCT_MODE___thiscall_cm_configuration::ConfigurationManager::get_rcd_mode_void_]
cmp eax, 2
jne case.0x1004f111.6063
cmp dword [ebx + 0x48c], 0
je case.0x1004f111.6063
cmp byte [ebx + 0x548], 0
je case.0x1004f111.6063
push str.display_change__stop_screen_bacst.
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
mov edx, dword [0x1014897c]
add esp, 8
test edx, edx
je case.0x1004f111.6063
xor cl, cl
call fcn.1009ea40
mov ecx, dword [0x101489d4]
mov eax, dword [ecx + 0x20]
mov word [eax + 0x548], 0
mov ecx, dword [ecx + 0x20]
mov edi, dword [ecx + 0x468]
call fcn.100683e0
jmp case.0x1004f111.6063
xor eax, eax
cmp edi, 2
jne 0x1004ef20
mov dword [ebx + 0x5b8], 0xf030
mov byte [ebx + 0x4c4], 1
jmp 0x1004ef2e
cmp edi, eax
jne 0x1004ef2e
mov dword [ebx + 0x5b8], 0xf120
lea edx, [esp + 0x20]
push edx
mov ecx, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.DuiLib_u.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov ecx, dword [ebx + 0x4a4]
sub edi, dword [esp + 0x20]
sub esi, dword [esp + 0x24]
test ecx, ecx
je 0x1004ef9f
mov eax, dword [ecx]
mov edx, dword [eax + 0xd8]
call edx
test al, al
je 0x1004ef9f
mov eax, dword [ebx + 0x4a4]
mov edx, dword [eax]
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 0x4a4]
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x34]
call eax
mov eax, dword [ebx + 0x4b0]
test eax, eax
je 0x1004efc8
mov edx, dword [eax]
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 0x4b0]
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x34]
call eax
mov ecx, dword [ebx + 0x4ac]
test ecx, ecx
je case.0x1004f111.6063
mov edx, dword [ecx]
mov eax, dword [edx + 0xd8]
call eax
test al, al
je case.0x1004f111.6063
mov ebx, dword [ebx + 0x4ac]
mov edx, dword [ebx]
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x34]
mov ecx, ebx
call eax
jmp case.0x1004f111.6063
cmp edi, 0xf030
jne 0x1004f022
mov byte [ebx + 0x4c4], 1
jmp case.0x1004f111.6063
cmp edi, 0xf120
jne case.0x1004f111.6063
mov byte [ebx + 0x4c4], 0
jmp case.0x1004f111.6063
cmp esi, 0x219
je 0x1004f0cb
cmp esi, 0x2b1
je 0x1004f074
cmp esi, 0x179f
jne case.0x1004f111.6063
call fcn.100c4560
push str.some_one_call_the_cmr_client
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 8
jmp case.0x1004f111.6063
test edi, edi
je 0x1004f0b5
cmp edi, 4
jbe 0x1004f082
cmp edi, 8
jne 0x1004f0b5
push edi
push str.WM_WTSSESSION_CHANGE___type___d__
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 0xc
push 0x3e8
push 0xbbb
lea ecx, [ebx + 0x2c]
call dword [sym.imp.DuiLib_u.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::GetRoot_void_const]
push eax
lea ecx, [ebx + 0x2c]
call dword [sym.imp.DuiLib_u.dll_public:_bool___thiscall_DuiLib::CPaintManagerUI::SetTimer_class_DuiLib::CControlUI___unsigned_int__unsigned_int_]
jmp case.0x1004f111.6063
push edi
push str.WM_WTSSESSION_CHANGE___type___d
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 0xc
jmp case.0x1004f111.6063
push edi
mov edi, dword [esp + 0x18]
mov ecx, ebx
call fcn.10053be0
jmp case.0x1004f111.6063
mov eax, dword [esp + 0x14]
mov esi, dword [0x101489d4]
mov dword [esi + 0x30], eax
test eax, eax
je case.0x1004f111.6063
call fcn.100c0570
jmp case.0x1004f111.6063
add esi, 0xffffe854
cmp esi, 0x15
ja case.0x1004f111.6063
movzx ecx, byte [esi + 0x1004f298]
jmp dword [ecx*4 + 0x1004f278]
mov esi, dword [0x101489d4]
mov ecx, dword [esp + 0x14]
add esi, 0x670
call fcn.100b1820
mov edx, dword [ebp + 8]
push edx
mov ecx, edi
mov edx, ebx
call fcn.1004f7d0
mov dword [esp + 0x18], eax
jmp case.0x1004f111.6063
mov eax, dword [esp + 0x14]
push eax
push edi
call fcn.10050f70
mov dword [esp + 0x18], eax
jmp case.0x1004f111.6063
mov edx, dword [esp + 0x14]
push edi
mov ecx, ebx
call fcn.10050020
mov dword [esp + 0x18], eax
jmp case.0x1004f111.6063
mov eax, dword [esp + 0x14]
add eax, 0xfffffdfd
cmp eax, 0xa0
ja case.0x1004f111.6063
push eax
mov ecx, ebx
call fcn.10052180
jmp case.0x1004f111.6063
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x100fc02c
call fcn.100431a0
push 2
call dword [sym.imp.RJCredits.dll_void___cdecl_RJCREDITS::credits_add_unsigned_int__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___]
add esp, 0x20
jmp case.0x1004f111.6063
mov ecx, dword [0x101489d4]
mov ecx, dword [ecx + 0x20]
push 0
push 0
push 0x179f
call dword [sym.imp.DuiLib_u.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push eax
call esi
push str.BasicFunciton_80
call dword [sym.imp.DuiLib_u.dll_public:_static_wchar_t_const____cdecl_DuiLib::CPaintManagerUI::GetStringById_wchar_t_const__]
add esp, 4
push eax
mov eax, dword [ebx + 4]
call fcn.10003410
mov edx, dword [0x101489d4]
mov eax, dword [edx]
add esp, 4
push 0
push 0x2a
push 0x17ae
push eax
call esi
jmp case.0x1004f111.6063
cmp edi, 4
jne 0x1004f23a
push str.BasicFunciton_81
call dword [sym.imp.DuiLib_u.dll_public:_static_wchar_t_const____cdecl_DuiLib::CPaintManagerUI::GetStringById_wchar_t_const__]
add esp, 4
push eax
mov eax, dword [ebx + 4]
call fcn.10003410
mov ecx, dword [0x101489d4]
mov edx, dword [ecx]
add esp, 4
push 0
push 0x2a
push 0x17ae
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x1004f111.6063
push str.BasicFunciton_82
call dword [sym.imp.DuiLib_u.dll_public:_static_wchar_t_const____cdecl_DuiLib::CPaintManagerUI::GetStringById_wchar_t_const__]
add esp, 4
push eax
mov eax, dword [ebx + 4]
call fcn.10003410
add esp, 4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100d0962
mov esp, ebp
pop ebp
ret 0xc