Function at 0x41fa40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
cmp ebx, 0x20
je 0x41fa72
cmp ebx, 0x25
je 0x41fa72
cmp ebx, 0x27
je 0x41fa72
cmp ebx, 0x6b
je 0x41fa72
cmp ebx, 0xbb
je 0x41fa72
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x70], 0
je case.0x41faac.33
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
push 0x10
sets byte [ebp - 1]
call edi
test ax, ax
lea eax, [ebx - 0x20]
sets cl
cmp eax, 0x9b
ja case.0x41faac.33
movzx eax, byte [eax + 0x41fcfc]
jmp dword [eax*4 + 0x41fce8]
cmp byte [ebp - 1], 0
je 0x41fad2
mov ecx, dword [esi + 0x70]
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x78], eax
lea eax, [ebp - 8]
mov edx, dword [ecx + 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 2
push edx
jmp 0x41faf8
test cl, cl
je case.0x41faac.33
mov eax, dword [esi + 0x70]
mov edx, dword [esi + 0x78]
mov ecx, dword [eax + 0x20]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
cmp ecx, edx
push eax
mov eax, ecx
cmovbe eax, edx
cmovbe edx, ecx
push 4
push eax
mov ecx, esi
call fcn.0041f050
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
push eax
push 1
push dword [ebp - 8]
mov ecx, esi
call fcn.0041edc0
test al, al
je case.0x41faac.33
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esi + 0x70]
test byte [edi + 0x28], 1
jne 0x41fb53
test byte [edi], 4
je 0x41fb53
push 0
mov edx, edi
mov ecx, esi
call fcn.0041ea60
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x24]
test ecx, ecx
je case.0x41faac.33
mov edi, dword [edi + 0x20]
dec ecx
test edi, edi
je case.0x41faac.33
mov eax, dword [esi + 0xd0]
mov eax, dword [eax + 8]
lea eax, [eax + edi*4]
mov ebx, dword [eax - 4]
lea eax, [eax - 4]
dec edi
cmp dword [ebx + 0x24], ecx
je 0x41fb8f
test edi, edi
jne 0x41fb76
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x70], ebx
mov edx, edi
mov eax, dword [ebx + 0x20]
mov ecx, esi
mov dword [esi + 0x78], eax
call fcn.0041f340
push 0
mov edx, ebx
mov ecx, esi
call fcn.0041f1c0
lea eax, [ebp - 8]
mov edx, edi
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push edi
mov ecx, esi
call fcn.0041f050
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
push eax
push 1
push dword [ebp - 8]
mov ecx, esi
call fcn.0041edc0
test al, al
je 0x41fbe5
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, esi
call fcn.00421550
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x70]
test byte [ecx + 0x28], 1
jne case.0x41faac.33
test byte [ecx], 4
jne 0x41fc1b
mov edx, ecx
mov ecx, esi
push 1
call fcn.0041ea60
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ecx + 0x20]
mov edi, dword [esi + 0xd0]
lea eax, [edx + 1]
cmp eax, dword [edi]
jae case.0x41faac.33
mov eax, dword [edi + 8]
mov edi, dword [eax + edx*4 + 4]
mov eax, dword [ecx + 0x24]
inc eax
cmp dword [edi + 0x24], eax
jne case.0x41faac.33
mov dword [esi + 0x70], edi
mov ecx, esi
mov eax, dword [edi + 0x20]
mov dword [esi + 0x78], eax
mov edx, dword [edi + 0x20]
inc edx
call fcn.0041f340
push 0
mov edx, edi
mov ecx, esi
call fcn.0041f1c0
mov eax, dword [esi + 0x70]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push edx
jmp 0x41fbb9
cmp ebx, 0x6b
jne 0x41fc8c
cmp byte [ebp - 1], 0
jne 0x41fc9e
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0xbb
jne case.0x41faac.33
cmp byte [ebp - 1], 0
je case.0x41faac.33
test cl, cl
je case.0x41faac.33
test byte [esi + 0x20], 0x10
je 0x41fcb6
mov edx, dword [esi + 8]
mov ecx, esi
push 0
push dword [esi + 0xb0]
call fcn.0041e630
xor edi, edi
cmp dword [esi + 0xa8], edi
jbe case.0x41faac.33
mov eax, dword [esi + 0xa0]
mov ecx, esi
mov edx, dword [esi + 0xc]
push 0
push dword [eax + edi*4]
call fcn.0041e630
inc edi
cmp edi, dword [esi + 0xa8]
jb 0x41fcc0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret