Function at 0x41cabd
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [0x4e4030]
mov dword [ebp - 0xc], edi
test ecx, ecx
je case.default.0x41ce4a
add ecx, 8
mov dword [ebp - 4], ecx
call fcn.0041c163
xor ebx, ebx
mov esi, eax
mov eax, 0x204
inc ebx
cmp edx, eax
ja 0x41ce21
je 0x41ccb6
mov eax, 0x104
cmp edx, eax
ja 0x41cc7d
je 0x41cc75
mov eax, edx
sub eax, 7
je 0x41cc61
sub eax, ebx
je 0x41cc61
sub eax, 0x18
je 0x41cc40
sub eax, 0xe0
je 0x41cb94
sub eax, ebx
je 0x41cb94
sub eax, ebx
jne case.default.0x41ce4a
push edi
call dword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x41cb68
mov edx, dword [ebp + 8]
lea eax, [edx - 1]
cmp eax, 0xfffe
ja case.default.0x41ce4a
mov ecx, dword [ebp - 4]
push edx
call fcn.0040270a
jmp case.default.0x41ce4a
and dword [ebp - 8], 0
lea eax, [ebp - 8]
xor ebx, ebx
inc ebx
push ebx
push eax
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 4]
push eax
call fcn.004026b6
jmp case.default.0x41ce4a
cmp edx, 0x100
je 0x41cc75
mov byte [ebp - 4], 0
cmp dword [ebp + 8], 0x100
jae case.default.0x41ce4a
call fcn.0041c395
mov esi, dword [ebp + 8]
cmp esi, 0xd
jne 0x41cbd0
mov eax, dword [ebp + 0xc]
shr eax, 0x10
test eax, 0x100
je 0x41cbd0
mov esi, 0x10d
mov ecx, esi
call fcn.0041c578
mov edi, dword [ebp - 4]
test eax, eax
je 0x41cbed
push edi
push eax
mov eax, dword [0x4e4030]
lea ecx, [eax + 8]
call fcn.00402916
cmp esi, 0x10
jne 0x41cd74
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call esi
shr eax, 0xf
and al, bl
cmp al, byte [ebp - 4]
jne 0x41cc20
mov eax, dword [0x4e4030]
push edi
push 0x210
lea ecx, [eax + 8]
call fcn.00402916
push 0xa1
call esi
shr eax, 0xf
and al, bl
cmp al, byte [ebp - 4]
jne case.default.0x41ce4a
push edi
push 0x214
jmp 0x41ce0e
xor ebx, ebx
inc ebx
cmp word [ebp + 0xc], bx
jne case.default.0x41ce4a
call fcn.0041c22b
test al, al
je case.default.0x41ce4a
mov eax, ebx
jmp 0x41cf18
cmp edx, 7
sete al
movzx eax, al
push eax
call fcn.00402b21
jmp case.default.0x41ce4a
mov byte [ebp - 4], bl
jmp 0x41cba4
mov eax, edx
sub eax, 0x105
je 0x41cba0
sub eax, 0xfb
je 0x41cd22
sub eax, 1
je case.0x41ce4a.518
sub eax, 1
je case.0x41ce4a.517
sub eax, 1
jne case.default.0x41ce4a
xor edi, edi
cmp edx, 0x206
jne 0x41ccb8
mov edi, ebx
cmp edx, 0x207
je 0x41ccc8
cmp edx, 0x209
jne 0x41cccb
push 2
pop edi
cmp edx, 0x20b
je 0x41ccdb
cmp edx, 0x20d
jne 0x41ccf1
mov eax, dword [ebp + 8]
xor ecx, ecx
shr eax, 0x10
cmp ax, bx
setne cl
add ecx, 3
mov dword [ebp - 8], ecx
mov edi, ecx
cmp dword [esi + 0xc], 0
jne 0x41cd0a
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x41cd0a
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
bts eax, edi
push ebx
mov dword [esi + 0xc], eax
push edi
call fcn.00402a35
jmp case.default.0x41ce4a
cmp byte [esi + 8], 0
mov dword [esi + 4], edi
jne 0x41cd4e
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_TrackMouseEvent]
mov byte [esi + 8], 1
mov ecx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 0x10
cwde
mov dword [ebp - 8], eax
fild dword [ebp - 8]
push ecx
push ecx
movsx eax, cx
mov ecx, dword [ebp - 4]
fstp dword [esp + 4]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
jmp 0x41cf0e
cmp esi, 0x11
jne 0x41cdc0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa2
call esi
shr eax, 0xf
and al, bl
cmp al, byte [ebp - 4]
jne 0x41cda3
mov eax, dword [0x4e4030]
push edi
push 0x20f
lea ecx, [eax + 8]
call fcn.00402916
push 0xa3
call esi
shr eax, 0xf
and al, bl
cmp al, byte [ebp - 4]
jne case.default.0x41ce4a
push edi
push 0x213
jmp 0x41ce0e
cmp esi, 0x12
jne case.default.0x41ce4a
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa4
call esi
shr eax, 0xf
and al, bl
cmp al, byte [ebp - 4]
jne 0x41cdf3
mov eax, dword [0x4e4030]
push edi
push 0x211
lea ecx, [eax + 8]
call fcn.00402916
push 0xa5
call esi
shr eax, 0xf
and al, bl
cmp al, byte [ebp - 4]
jne case.default.0x41ce4a
push edi
push 0x215
mov ecx, dword [0x4e4030]
lea ecx, [ecx + 8]
call fcn.00402916
jmp case.default.0x41ce4a
mov eax, 0x219
cmp edx, eax
ja 0x41ceed
je case.default.0x41ce4a
lea eax, [edx - 0x205]
cmp eax, 9
ja case.default.0x41ce4a
movzx eax, byte [eax + 0x41cf2d]
jmp dword [eax*4 + 0x41cf1d]
xor ebx, ebx
cmp edx, 0x205
sete bl
cmp edx, 0x208
jne 0x41ce69
push 2
pop ebx
jmp 0x41ce83
cmp edx, 0x20c
jne 0x41ce83
mov eax, dword [ebp + 8]
xor ebx, ebx
shr eax, 0x10
cmp ax, 1
setne bl
add ebx, 3
mov eax, dword [esi + 0xc]
btr eax, ebx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x41cea3
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, edi
jne 0x41cea0
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp - 4]
push 0
push ebx
jmp 0x41cd18
mov eax, dword [ebp + 8]
shr eax, 0x10
cwde
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
push ecx
push ecx
fmul dword [0x48d0b0]
fstp dword [esp + 4]
fldz
fstp dword [esp]
call fcn.00402aab
jmp case.default.0x41ce4a
mov eax, dword [ebp + 8]
push ecx
shr eax, 0x10
push ecx
fldz
cwde
fstp dword [esp + 4]
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
fmul dword [0x48d0b0]
jmp 0x41cec6
cmp edx, 0x2a3
jne case.default.0x41ce4a
cmp dword [esi + 4], edi
jne 0x41cefe
and dword [esi + 4], 0
fld dword [0x48d520]
push ecx
push ecx
fst dword [esp + 4]
mov byte [esi + 8], 0
fstp dword [esp]
call fcn.00402941
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret