Function at 0x41b480
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56abb8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [sym.imp.USER32.dll_GetFocus]
call ebx
push eax
call fcn.0045a881
mov ecx, dword [ebp + 8]
mov edi, eax
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x41b722
cmp eax, 0x26
je 0x41b722
cmp eax, 0x27
je 0x41b722
cmp eax, 0x28
je 0x41b722
mov ecx, dword [ecx + 4]
cmp ecx, 0x100
jne 0x41b77d
cmp eax, 9
jne 0x41b64c
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
call ebx
push eax
call fcn.0045a881
mov ebx, eax
push 0
push ebx
mov ecx, esi
call fcn.0040a190
push 1
push ebx
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.0040a190
mov ecx, esi
mov dword [ebp - 0x18], eax
call fcn.0044daeb
and edi, 0x8000
mov ebx, dword [ebp - 0x14]
je 0x41b540
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 9
jne 0x41b77d
test ebx, ebx
je 0x41b63e
push 0x581ed4
mov ecx, ebx
call fcn.0044e6f6
test eax, eax
je 0x41b63e
mov ebx, dword [ebx + 0x20]
mov ecx, dword [esi + 0xf64]
cmp ebx, dword [ecx + 0x20]
jne 0x41b597
mov ecx, esi
call fcn.0041a240
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 0xf60]
cmp ebx, dword [edx + 0x20]
jne 0x41b5c4
push 1
mov ecx, esi
call fcn.0041a3f0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0xf5c]
cmp ebx, dword [eax + 0x20]
jne 0x41b5ef
mov ecx, esi
call fcn.0041a670
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0xf68]
cmp ebx, dword [ecx + 0x20]
jne 0x41b61a
mov ecx, esi
call fcn.0041a840
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esi + 0x730]
call fcn.0040e990
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
mov ecx, esi
call fcn.0041a3f0
jmp 0x41b77d
cmp ecx, 0x100
jne 0x41b77d
cmp eax, 0xd
je 0x41b673
cmp eax, 0x20
jne 0x41b77d
cmp eax, 0xd
je 0x41b673
cmp eax, eax
jne 0x41b77d
lea ecx, [ebp - 0x10]
call fcn.00401fd0
lea edx, [ebp - 0x10]
push edx
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.0045c4ed
mov ecx, edi
call fcn.0045e615
mov ebx, eax
test edi, edi
je 0x41b6ed
push 0x581ed4
mov ecx, edi
call fcn.0044e6f6
test eax, eax
jne 0x41b6c3
cmp ebx, 0x3023
je 0x41b6c3
cmp ebx, 0x3024
je 0x41b6c3
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0xd
jne 0x41b6ed
push ebx
push edi
mov ecx, esi
call fcn.00419d30
lea ecx, [ebp - 0x10]
call fcn.00402000
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x20
lea ecx, [ebp - 0x10]
jne 0x41b714
call fcn.00402000
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
call fcn.00402000
jmp 0x41b77d
test edi, edi
je 0x41b77d
push 0x581ed4
mov ecx, edi
call fcn.0044e6f6
test eax, eax
je 0x41b77d
inc dword [esi + 0xf80]
mov edx, dword [esi + 0xf64]
mov eax, dword [edi + 0x20]
cmp eax, dword [edx + 0x20]
jne 0x41b751
mov ecx, esi
call fcn.0041a240
mov ecx, dword [esi + 0xf60]
mov edx, dword [edi + 0x20]
cmp edx, dword [ecx + 0x20]
jne 0x41b768
push 1
mov ecx, esi
call fcn.0041a3f0
mov eax, dword [esi + 0xf5c]
mov ecx, dword [edi + 0x20]
cmp ecx, dword [eax + 0x20]
jne 0x41b77d
mov ecx, esi
call fcn.0041a670
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x41b7fc
cmp dword [eax + 8], 0x1b
jne 0x41b7fc
mov ecx, esi
call fcn.0041b150
test eax, eax
jne 0x41b7bc
lea edx, [esi + 0xa44]
push edx
mov ecx, esi
call fcn.0044d5b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x3e8
je 0x41b7c8
cmp eax, 0xffffffff
jne 0x41b7fc
mov ecx, esi
call fcn.0044daeb
test eax, eax
je 0x41b7fc
push 0x582390
mov ecx, eax
call fcn.0044e6f6
test eax, eax
je 0x41b7fc
mov eax, dword [esi + 0xf68]
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0xf5
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp + 8]
push edx
mov ecx, esi
call fcn.0044d3e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4