Function at 0x41e360
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
cmp edi, 1
je 0x41e5d5
mov eax, dword [0x52fe14]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
setne al
test al, al
jne 0x41e5d5
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1220], al
je 0x41e3aa
cmp byte [esi + 0x40ee], al
jne 0x41e5d5
cmp byte [esi + 0x4090], 0
jne 0x41e3c8
mov edx, dword [0x52fe14]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41e5d5
cmp byte [esi + 0x4808], 0
jne 0x41e5d5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x78b8], eax
je 0x41e41d
movzx eax, word [ebp + 0x14]
movzx ecx, word [ebp + 0x10]
shl eax, 0x10
xor edx, edx
or eax, ecx
cmp byte [ebp + 8], dl
mov ecx, dword [0x52fe14]
sete dl
push eax
movzx eax, di
inc edx
shl edx, 0x10
or edx, eax
push edx
push 5
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, esi
call fcn.0041e140
inc dword [esi + 0x554c]
mov edx, 0xffff
cmp word [ebp + 0x10], dx
je 0x41e445
mov eax, edx
cmp word [ebp + 0x14], ax
jne 0x41e454
push 0
push 1
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
call fcn.00415030
push 0
push 1
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
call fcn.00415030
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
push 0
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x30]
push 0
push ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
call fcn.00425070
add esp, 0xc
push 0
push 0x50
lea edx, [ebp - 0x30]
push edx
mov ecx, esi
call fcn.0040d990
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
test ecx, ecx
je 0x41e4b1
add eax, ecx
mov edi, dword [ebp - 0x1c]
test edx, edx
je 0x41e4ba
add edi, edx
mov edx, dword [ebp - 0x18]
test ebx, ebx
je 0x41e4c3
sub edx, ebx
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
test ebx, ebx
je 0x41e4cf
sub ecx, ebx
push 1
sub ecx, edi
push ecx
mov ecx, dword [0x52fe18]
sub edx, eax
push edx
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
test byte [esi + 0x4148], 0x80
je 0x41e521
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0x8000
mov ecx, edx
and ax, dx
cmp ax, cx
mov ecx, esi
je 0x41e511
push 0
call fcn.00416b10
jmp 0x41e521
call fcn.00409940
test al, al
je 0x41e521
mov ecx, esi
call fcn.004152e0
mov edx, dword [0x52fe2c]
mov ecx, dword [edx + 0x40a0]
call fcn.004a5af0
test al, al
je 0x41e546
mov eax, dword [0x52fe2c]
mov ecx, dword [eax + 0x40a0]
call fcn.004a5bb0
call fcn.004b9e10
cmp byte [ebp + 8], 0
je 0x41e58b
cmp dword [esi + 0x40e8], 0xffffffff
jne 0x41e58b
cmp dword [esi + 0x554c], 1
jg 0x41e58b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
push 1
push 1
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.004ba430
add esp, 0x18
push 0
call fcn.004b6400
add esp, 4
test al, al
je 0x41e5bd
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.004ba9f0
add esp, 0x10
mov ecx, esi
call fcn.0040a6d0
mov eax, dword [esi + 0x554c]
test eax, eax
jle 0x41e5d5
dec eax
mov dword [esi + 0x554c], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10