Function at 0x4ca480
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp ebx, 0x104
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
ja 0x4ca5f1
je 0x4ca5de
cmp ebx, 0x20
ja 0x4ca582
je 0x4ca555
lea eax, [ebx - 1]
cmp eax, 0x13
ja case.0x4ca666.515
movzx eax, byte [eax + 0x4ca72c]
jmp dword [eax*4 + 0x4ca714]
push 0
push 0
call fcn.004c8ee0
mov ecx, esi
call fcn.004c8fa0
mov ecx, dword [esi]
push 0
push 0x3e8
push 1
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [esi]
push edx
call fcn.0044d7f0
add esp, 4
call fcn.004c9f00
mov ecx, dword [0x6b7eec]
mov eax, 1
add ecx, 8
lock xadd dword [ecx], eax
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [0x6b7eec]
or edx, 0xffffffff
add eax, 8
lock xadd dword [eax], edx
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
shr ecx, 0x10
movzx edx, ax
push ecx
push edx
mov ecx, esi
call fcn.004c8eb0
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
call fcn.004c9190
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi]
jne case.0x4ca666.515
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
lea eax, [ebx - 0x30]
cmp eax, 0xd0
ja case.0x4ca666.515
movzx eax, byte [eax + 0x4ca754]
jmp dword [eax*4 + 0x4ca740]
cmp dword [esp + 0x18], 0
mov edx, dword [esp + 0x14]
setne cl
push ecx
push edx
mov ecx, esi
call fcn.004c8ee0
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [esi + 4]
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x14]
push eax
call fcn.004ca420
test al, al
je case.0x4ca666.515
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
cmp dword [esp + 0x14], 0x12
jne case.0x4ca666.515
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
cmp ebx, 0x200
ja 0x4ca657
je 0x4ca61a
mov eax, ebx
sub eax, 0x105
je 0x4ca5de
sub eax, 0xe
jne case.0x4ca666.515
call fcn.004ca3c0
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi]
jne case.0x4ca666.515
push edi
mov ecx, ebp
shr ecx, 0x10
movsx edi, cx
movsx edx, bp
mov ecx, edi
sub ecx, dword [esi + 0x2c]
mov eax, edx
sub eax, dword [esi + 0x28]
neg ecx
push ecx
neg eax
push eax
mov ecx, esi
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], edi
call fcn.004c90e0
pop edi
jmp case.0x4ca666.515
lea eax, [ebx - 0x201]
cmp eax, 9
ja case.0x4ca666.515
jmp dword [eax*4 + 0x4ca828]
mov edx, dword [esp + 0x14]
shr edx, 0x10
movsx eax, dx
add dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
cdq
mov ecx, 0x78
idiv ecx
test eax, eax
je case.0x4ca666.515
mov dword [esi + 0x24], edx
mov edx, dword [esi + 0xc]
add edx, eax
push edx
mov ecx, esi
call fcn.004c9010
jmp case.0x4ca666.515
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl case.0x4ca666.519
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x4ca666.515
movsx ecx, bp
mov edx, ebp
shr edx, 0x10
mov dword [esi + 0x28], ecx
mov ecx, dword [esi]
movsx eax, dx
push ecx
mov dword [esi + 0x2c], eax
call dword [sym.imp.USER32.dll_SetCapture]
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x4ca666.515
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi]
jne case.0x4ca666.515
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
push ebp
push ecx
push ebx
push edx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop esi
pop ebp
pop ebx
ret 0xc