Function at 0x409750
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d16e6
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x144
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
jne 0x40977d
xor esi, esi
jmp 0x409780
mov esi, dword [eax + 0x1c]
mov ecx, dword [esp + 0x168]
or eax, 0xffffffff
cmp ecx, eax
jne 0x40979e
cmp dword [esp + 0x16c], eax
jne 0x40979e
mov ebx, 1
jmp 0x4097a0
xor ebx, ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov dword [esp + 0x14], ebx
call edi
test ah, 0x80
je 0x4097bc
push 0x79
call edi
test ah, 0x80
je 0x4097cd
push 0x11
call edi
test ah, 0x80
mov dword [esp + 0x14], 0
je 0x4097d5
mov dword [esp + 0x14], 1
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
test ebx, ebx
je 0x409855
cmp esi, dword [ebp + 0xd0]
jne 0x40a183
push 1
push 0xffffffffffffffff
push 0x100c
push esi
call edi
lea ecx, [esp + 0x18]
test ecx, ecx
je 0x40980d
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x18]
jmp 0x40980f
xor ecx, ecx
push ecx
push eax
push 0x100e
push esi
call edi
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
add eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
mov dword [esp + 0x168], eax
lea eax, [ecx + edx]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x16c], eax
lea eax, [esp + 0x168]
push eax
push esi
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [esp + 0x16c]
mov edx, dword [esp + 0x168]
mov ebx, dword [ebp + 0xd0]
push ecx
push edx
call dword [sym.imp.USER32.dll_WindowFromPoint]
push eax
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, ebx
jne 0x409924
mov eax, dword [ebp + 0x144]
push 0x4ee8
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push 0
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ecx, dword [0x4f83ec]
mov edx, dword fs:[0x2c]
mov ebx, dword [sym.imp.USER32.dll_CheckMenuItem]
mov esi, eax
mov edi, dword [edx + ecx*4]
mov al, byte [edi + 0x279]
test al, al
je 0x4098cb
push 8
push 0x4ea3
push esi
call ebx
mov al, byte [edi + 0x27a]
test al, al
je 0x4098df
push 8
push 0x4ea4
push esi
call ebx
mov al, byte [edi + 0x27b]
test al, al
je 0x4098f3
push 8
push 0x4ea5
push esi
call ebx
mov al, byte [edi + 0x27c]
test al, al
je 0x409907
push 8
push 0x4ea6
push esi
call ebx
mov al, byte [edi + 0x27d]
test al, al
je 0x40a12a
push 8
push 0x4ea7
push esi
call ebx
jmp 0x40a12a
cmp esi, dword [ebp + 0xcc]
jne 0x4099b0
mov eax, dword [ebp + 0x144]
push 0x4eca
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push 0
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
mov esi, eax
mov eax, dword [ebp + 0x170]
test eax, eax
je 0x40996b
push 8
push 0x4f11
push esi
call edi
mov ecx, dword [0x4f83ec]
mov edx, dword fs:[0x2c]
mov ebx, dword [edx + ecx*4]
mov al, byte [ebx + 0xd]
test al, al
je 0x40998f
push 8
push 0x4ea9
push esi
call edi
mov al, byte [ebx + 0x2d9]
test al, al
je 0x40a12a
push 0
push 0x4e90
push esi
call dword [sym.imp.USER32.dll_RemoveMenu]
jmp 0x40a12a
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x409b3a
cmp esi, ebx
je 0x409b3a
mov eax, dword [esp + 0x164]
lea ecx, [ebp + 0x1844]
cmp eax, ecx
jne 0x409a4b
mov edx, dword [ebp + 0x144]
push 0x72
push edx
call dword [sym.imp.USER32.dll_LoadMenuA]
push 0
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov esi, eax
mov eax, dword [ebp + 0x1908]
neg eax
sbb eax, eax
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
and al, 0xf8
add eax, 8
push eax
push 0x5018
push esi
call edi
mov ecx, dword [ebp + 0x1908]
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xfffffff8
add ecx, 8
push ecx
push 0x501a
push esi
call edi
mov ebx, dword [ebp + 0x1908]
xor edx, edx
cmp ebx, 2
setne dl
dec edx
and edx, 8
push edx
push 0x5019
push esi
call edi
jmp 0x40a12a
lea ecx, [ebp + 0x1910]
cmp eax, ecx
jne 0x409ace
mov edx, dword [ebp + 0x144]
push 0x4ee9
push edx
call dword [sym.imp.USER32.dll_LoadMenuA]
push 0
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov esi, eax
mov eax, dword [ebp + 0x19d4]
neg eax
sbb eax, eax
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
and al, 0xf8
add eax, 8
push eax
push 0x501b
push esi
call edi
mov ecx, dword [ebp + 0x19d4]
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xfffffff8
add ecx, 8
push ecx
push 0x501c
push esi
call edi
mov ebx, dword [ebp + 0x19d4]
xor edx, edx
cmp ebx, 2
setne dl
dec edx
and edx, 8
push edx
push 0x501d
push esi
call edi
jmp 0x40a12a
lea ecx, [ebp + 0x17c8]
cmp eax, ecx
jne 0x40a17c
mov edx, dword [ebp + 0x144]
push 0x73
push edx
call dword [sym.imp.USER32.dll_LoadMenuA]
push 0
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov esi, eax
mov eax, dword [ebp + 0x1c2c]
neg eax
sbb eax, eax
push 0
and eax, 0x8b
add eax, 0x4ebd
push eax
push esi
call dword [sym.imp.USER32.dll_RemoveMenu]
mov ecx, dword [ebp + 0x1c2c]
push 0
neg ecx
sbb ecx, ecx
and cl, 0x75
add ecx, 0x4f48
push ecx
push esi
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
jmp 0x40a12a
lea esi, [ebp + 0x1b88]
mov ecx, esi
call fcn.0042e0a0
mov edx, dword [ebp + 0xd0]
push 0
push 0
push 0x1032
push edx
call edi
test eax, eax
jbe 0x40a001
mov eax, dword [esp + 0x14]
test eax, eax
je 0x409da1
push 0x80
mov dword [esp + 0x38], vtable.Table_class_DirEntry_.0
call fcn.004bd49b
mov dword [esp + 0x3c], eax
xor eax, eax
mov ebx, 0x1f
mov edi, 0x40
add esp, 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x34], vtable.DirTable.0
mov dword [esp + 0x15c], eax
push eax
lea eax, [esp + 0x38]
mov ecx, esi
push eax
call fcn.0042d950
push 0x80
mov dword [esp + 0x1c], vtable.Table_char_.0
call fcn.004bd49b
xor esi, esi
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x15c], 1
cmp esi, eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x14], esi
jge 0x409cc4
test esi, esi
jl 0x409c12
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx + esi*4]
jmp 0x409c14
xor ecx, ecx
lea edx, [esp + 0x50]
push 0
push edx
call fcn.004257f0
lea eax, [esp + 0x50]
push eax
call fcn.00470f80
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x409cb3
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
lea edx, [ecx + 1]
cmp edi, edx
jne 0x409c9f
mov eax, dword [esp + 0x2c]
add eax, ecx
lea ecx, [eax*4 + 4]
push ecx
call fcn.004bd49b
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov ebx, eax
lea ecx, [edx*4 + 4]
mov edi, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004bd4c4
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x1c]
add esp, 8
add eax, edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
inc esi
cmp esi, eax
mov dword [esp + 0x14], esi
jl 0x409c05
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x168]
push eax
mov eax, dword [ebp + 0xd0]
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
call fcn.00402330
add esp, 0x10
test eax, eax
jne 0x409cf4
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, dword [esp + 0x28]
mov byte [esp + 0x15c], 0
test eax, eax
mov dword [esp + 0x18], vtable.Table_char_.0
je 0x409d3b
mov eax, dword [esp + 0x20]
xor esi, esi
test eax, eax
jle 0x409d3b
cmp esi, eax
jge 0x409d27
test esi, esi
jl 0x409d27
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + esi*4]
jmp 0x409d29
xor eax, eax
push eax
call fcn.004bd4c4
mov eax, dword [esp + 0x24]
add esp, 4
inc esi
cmp esi, eax
jl 0x409d1a
mov edx, dword [esp + 0x1c]
push edx
call fcn.004bd4c4
mov eax, dword [esp + 0x48]
add esp, 4
test eax, eax
mov dword [esp + 0x15c], 0xffffffff
mov dword [esp + 0x34], vtable.Table_class_DirEntry_.0
je 0x409d8f
mov eax, dword [esp + 0x3c]
xor esi, esi
test eax, eax
jle 0x409d8f
cmp esi, eax
jge 0x409d8a
test esi, esi
jl 0x409d8a
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
je 0x409d8a
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x3c]
inc esi
cmp esi, eax
jl 0x409d71
mov eax, dword [esp + 0x38]
push eax
call fcn.004bd4c4
add esp, 4
jmp 0x40a183
mov ecx, dword [ebp + 0x144]
push 0x82
push ecx
call dword [sym.imp.USER32.dll_LoadMenuA]
push 0
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edi, dword [sym.imp.USER32.dll_RemoveMenu]
mov esi, eax
mov eax, dword [ebp + 0x1768]
test eax, eax
jne 0x409ddc
push 0x400
push 0xd
push esi
call edi
mov ecx, 0x4f5738
call fcn.004509a0
mov ecx, dword [ebp + 0x14c]
mov ebx, eax
test ecx, ecx
je 0x409dfb
mov edx, dword [ecx]
call dword [edx + 0x10]
test eax, eax
je 0x409e05
push 0
push 0x4f8c
push esi
call edi
mov eax, dword [ebp + 0x1754]
test eax, eax
jne 0x409e19
push 0
push 0x4e84
push esi
call edi
mov eax, dword [ebp + 0x1764]
test eax, eax
jne 0x409e2d
push 0
push 0x4e85
push esi
call edi
mov eax, dword [ebp + 0x1758]
test eax, eax
jne 0x409e41
push 0
push 0x4eb0
push esi
call edi
mov eax, dword [ebp + 0x1794]
test eax, eax
jne 0x409e69
push 0
push 0x4f44
push esi
call edi
mov eax, dword [ebp + 0x1794]
test eax, eax
jne 0x409e69
push 0
push 0x4f47
push esi
call edi
mov eax, dword [ebp + 0x1790]
test eax, eax
jne 0x409e7d
push 0
push 0x4f67
push esi
call edi
mov eax, dword [ebp + 0x1760]
test eax, eax
jne 0x409e91
push 0
push 0x4ea8
push esi
call edi
mov eax, dword [ebp + 0x1788]
test eax, eax
jne 0x409ea5
push 0
push 0x4f2c
push esi
call edi
mov eax, dword [ebp + 0x17a4]
test eax, eax
jne 0x409eb9
push 0
push 0x4f3f
push esi
call edi
mov eax, dword [ebp + 0x1774]
test eax, eax
jne 0x409ecd
push 0
push 0x4e87
push esi
call edi
mov eax, dword [ebp + 0x1778]
test eax, eax
jne 0x409ee1
push 0
push 0x4f49
push esi
call edi
mov eax, dword [ebp + 0x1770]
test eax, eax
jne 0x409ef5
push 0
push 0x4e89
push esi
call edi
mov eax, dword [ebp + 0x177c]
test eax, eax
jne 0x409f09
push 0
push 0x4f40
push esi
call edi
mov eax, dword [ebp + 0x1774]
test eax, eax
jne 0x409f1d
push 0
push 0x4f3d
push esi
call edi
mov eax, dword [ebp + 0x1780]
test eax, eax
jne 0x409f31
push 0
push 0x4e88
push esi
call edi
mov eax, dword [ebp + 0x17b4]
test eax, eax
jne 0x409f45
push 0
push 0x4f77
push esi
call edi
mov eax, dword [ebp + 0x1784]
test eax, eax
jne 0x409f59
push 0
push 0x4e8b
push esi
call edi
mov eax, dword [ebp + 0x17ac]
test eax, eax
jne 0x409f6d
push 0
push 0x4fc3
push esi
call edi
mov eax, dword [ebp + 0x17b0]
test eax, eax
jne 0x409f81
push 0
push 0x500c
push esi
call edi
test ebx, ebx
jne 0x409f8e
push ebx
push 0x5013
push esi
call edi
mov eax, dword [ebp + 0x17a8]
test eax, eax
jne 0x409fa2
push 0
push 0x4fa3
push esi
call edi
mov eax, dword [ebp + 0x175c]
test eax, eax
jne 0x409fca
push 0
push 0x4e94
push esi
call edi
mov eax, dword [ebp + 0x175c]
test eax, eax
jne 0x409fca
push 0
push 0x4e8c
push esi
call edi
mov eax, dword [ebp + 0x1754]
mov edi, dword [sym.imp.USER32.dll_SetMenuDefaultItem]
test eax, eax
je 0x409fe4
push 0
push 0x4e84
push esi
call edi
mov eax, dword [ebp + 0x1758]
test eax, eax
je 0x40a12a
push 0
push 0x4eb0
push esi
call edi
jmp 0x40a12a
mov eax, dword [ebp + 0x144]
push 0x4e8f
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push 0
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ecx, dword [ebp + 0x14c]
mov esi, eax
test ecx, ecx
je 0x40a035
mov edx, dword [ecx]
call dword [edx + 0x54]
test eax, eax
jne 0x40a043
push 0
push 0x4f1f
push esi
call dword [sym.imp.USER32.dll_RemoveMenu]
mov eax, dword [0x4f83ec]
mov ecx, dword fs:[0x2c]
xor edi, edi
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 0x280]
cmp eax, 4
ja case.default.0x40a063
jmp dword [eax*4 + 0x40a1a0]
mov edi, 0x4ed5
jmp case.default.0x40a063
mov edi, 0x4ed7
jmp case.default.0x40a063
mov edi, 0x4ed8
jmp case.default.0x40a063
mov edi, 0x4ed9
jmp case.default.0x40a063
mov edi, 0x4eda
mov ebx, dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push edi
push esi
call ebx
mov edx, dword [esp + 0x14]
movsx eax, byte [edx + 8]
inc eax
cmp eax, 6
ja case.default.0x40a0a8
jmp dword [eax*4 + 0x40a1b4]
mov edi, 0x4e9a
jmp case.default.0x40a0a8
mov edi, 0x4e9b
jmp case.default.0x40a0a8
mov edi, 0x4e9c
jmp case.default.0x40a0a8
mov edi, 0x4e9d
jmp case.default.0x40a0a8
mov edi, 0x4e9e
jmp case.default.0x40a0a8
mov edi, 0x4e9f
jmp case.default.0x40a0a8
mov edi, 0x4ea0
push 8
push edi
push esi
call ebx
mov ecx, dword [esp + 0x14]
xor eax, eax
push 8
mov dl, byte [ecx + 0xa]
test dl, dl
setne al
add eax, 0x4ea1
push eax
push esi
call ebx
call fcn.004231e0
test eax, eax
je 0x40a11c
mov ecx, dword [ebp + 0x14c]
test ecx, ecx
je 0x40a11c
mov edx, dword [ecx]
call dword [edx + 0x54]
test eax, eax
jne 0x40a12a
push 1
push 0x4f3e
push esi
call dword [sym.imp.USER32.dll_EnableMenuItem]
test esi, esi
je 0x40a17c
push esi
call fcn.00473b40
mov eax, dword [ebp + 0xcc]
mov ecx, dword [esp + 0x170]
mov edx, dword [esp + 0x16c]
add esp, 4
push 0
push eax
push 0
push ecx
push edx
push 2
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov ecx, dword [ebp + 0xd4]
push 0
push 8
push 0x110b
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, ebp
call fcn.004141d0
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x150
ret 0xc