Function at 0x412a27
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439e7b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x44d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov ebx, dword [ebp + 8]
push ebx
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
call fcn.004122c0
test eax, eax
jne 0x412913
mov eax, dword [ebx + 4]
cmp eax, 0x100
ja 0x4127d6
je case.0x4127fa.260
sub eax, 7
je 0x4127bd
sub eax, 1
je 0x4127a4
sub eax, 0x18
jne case.0x4128f0.518
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je case.0x4128f0.518
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0x412b23
mov ecx, esi
call fcn.004120e0
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
mov ecx, esi
call fcn.00411ff0
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
cmp eax, 0x205
ja 0x412883
cmp eax, 0x200
jae case.0x412898.519
sub eax, 0x101
cmp eax, 4
ja case.0x4128f0.518
jmp dword [eax*4 + 0x412b44]
mov ecx, dword [ebx + 8]
call fcn.00418380
mov ecx, eax
and eax, 0xffff1fff
and ecx, 0xe000
push ecx
push eax
mov ecx, esi
call fcn.00411e10
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
mov ecx, dword [ebx + 8]
call fcn.00418380
mov ecx, eax
and eax, 0xffff1fff
and ecx, 0xe000
push ecx
push eax
mov ecx, esi
call fcn.00411f00
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
movzx eax, word [ebx + 8]
mov ecx, esi
push eax
call fcn.004121d0
test eax, eax
js 0x412913
jle case.0x4128f0.518
mov dword [ebx + 8], eax
jmp case.0x4128f0.518
sub eax, 0x207
cmp eax, 0x2c
ja case.0x4128f0.518
movzx eax, byte [eax + 0x412b68]
jmp dword [eax*4 + 0x412b58]
movsx eax, word [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x21c], eax
movsx eax, word [ebx + 0xe]
mov dword [ebp - 0x220], eax
mov eax, ecx
and eax, 8
shl eax, 0xa
mov edi, eax
or edi, 0x8000
and cl, 4
push 0x12
cmove edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4128df
or edi, 0x4000
mov eax, dword [ebx + 4]
add eax, 0xfffffe00
cmp eax, 8
ja case.0x4128f0.518
jmp dword [eax*4 + 0x412b98]
push edi
push dword [ebp - 0x220]
mov ecx, esi
push dword [ebp - 0x21c]
call fcn.004115a0
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
push edi
push dword [ebp - 0x220]
mov ecx, esi
push dword [ebp - 0x21c]
call fcn.00411690
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
push edi
push dword [ebp - 0x220]
mov ecx, esi
push dword [ebp - 0x21c]
call fcn.00411780
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
push edi
push dword [ebp - 0x220]
mov ecx, esi
push dword [ebp - 0x21c]
call fcn.00411870
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
push edi
push dword [ebp - 0x220]
mov ecx, esi
push dword [ebp - 0x21c]
call fcn.00411960
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
push edi
push dword [ebp - 0x220]
mov ecx, esi
push dword [ebp - 0x21c]
call fcn.00411a50
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
push edi
push dword [ebp - 0x220]
mov ecx, esi
push dword [ebp - 0x21c]
call fcn.00411b40
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
push edi
push dword [ebp - 0x220]
mov ecx, esi
push dword [ebp - 0x21c]
call fcn.00411c30
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
mov ecx, dword [ebx + 8]
mov eax, ecx
and eax, 8
shl eax, 0xa
mov edi, eax
or edi, 0x8000
and cl, 4
push 0x12
cmove edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x412a53
or edi, 0x4000
movsx ecx, word [ebx + 0xa]
mov eax, 0x88888889
imul ecx
push edi
add edx, ecx
mov ecx, esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
call fcn.00411d20
test eax, eax
je case.0x4128f0.518
mov eax, 1
jmp 0x412b23
mov ebx, dword [ebx + 8]
push 0
push 0
push 0xffffffffffffffff
push ebx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x21c], eax
call fcn.00411380
mov dword [ebp - 4], 0
xor edi, edi
cmp dword [ebp - 0x21c], edi
jbe 0x412af1
mov esi, dword [ebp - 0x21c]
nop dword [eax]
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push ebx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.00412da0
inc edi
cmp edi, esi
jb 0x412ac0
mov esi, dword [ebp - 0x220]
push ebx
call dword [sym.imp.SHELL32.dll_DragFinish]
cmp dword [ebp - 0x228], 0
je 0x412b0f
lea eax, [ebp - 0x24c]
mov ecx, esi
push eax
call fcn.004124b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00411450
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424249
mov esp, ebp
pop ebp
ret 4