Function at 0x41bbe0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 0x409c]
call fcn.00447fc0
test eax, eax
jne 0x41bc3c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0040a8f0
mov ebx, eax
test ebx, ebx
je 0x41bc3c
push 0
push ebx
call fcn.004b6cc0
add esp, 8
test al, al
je 0x41bc3c
mov ecx, ebx
call fcn.004bcc80
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x41bcbd
mov eax, dword [0x52fe30]
cmp byte [eax + 0x112a0], 0
je 0x41bcb2
cmp byte [eax + 0x1131d], 0
jne 0x41bcb2
mov ecx, dword [0x52fe14]
push 1
lea eax, [ebp - 0x10]
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 0x40a8]
push edx
push eax
call fcn.004a2530
test al, al
je 0x41bcb2
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [0x52fe14]
push edx
push eax
push 0
push 0
push 0x20
push ecx
mov ecx, dword [esi + 0x40a8]
mov dword [ebp + 0xc], 0
call fcn.004a4aa0
test al, al
jne 0x41bf22
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, edi
call fcn.00488d20
test eax, eax
je 0x41bcd7
mov ecx, edi
call fcn.00486e80
test eax, eax
jne 0x41bf22
mov edi, dword [ebp + 0xc]
cmp edi, 0xffffffff
jne 0x41bd25
mov eax, dword [0x52fe14]
lea edx, [ebp - 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push ecx
push edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x41bd18
push eax
push 1
push eax
mov ecx, esi
call fcn.004169e0
test al, al
je 0x41bcb2
xor edi, edi
jmp 0x41bd1d
mov edi, 1
lea ecx, [ebx + 8]
call fcn.004b32e0
test byte [esi + 0x4148], 0x80
je 0x41bd52
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x41bcb2
push 0
mov ecx, esi
call fcn.00416b10
cmp di, 1
je 0x41bd61
test di, di
jne 0x41bcb2
mov ecx, dword [esi + 0x409c]
mov dword [ebp + 0xc], 1
call fcn.00447fc0
test eax, eax
jne 0x41bf15
cmp di, 1
jne 0x41bedf
mov eax, 0x4000
test word [esi + 0x4148], ax
je 0x41bda5
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x41bed5
cmp dword [esi + 0x4844], 0
je 0x41bdc4
mov ecx, esi
call fcn.0040a9a0
test al, al
je 0x41bdc4
mov eax, dword [esi + 0x4844]
jmp 0x41bed5
mov edi, dword [ebp - 4]
mov ecx, edi
call fcn.00489140
test al, al
je 0x41bdea
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1251], 0
je 0x41bedf
jmp 0x41becf
mov ecx, edi
call fcn.004899d0
test eax, eax
je 0x41be07
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x41bed5
movzx eax, word [esi + 0x4148]
test eax, 0x3c00
je 0x41be32
test eax, 0x400
je 0x41be27
mov eax, dword [esi + 0x4840]
jmp 0x41bed5
mov eax, dword [esi + 0x483c]
jmp 0x41bed5
push 0
push 1
push 0
mov ecx, esi
call fcn.004169e0
movzx eax, al
mov dword [ebp + 0xc], eax
test eax, eax
je 0x41bf15
lea ecx, [ebx + 8]
call fcn.004b32e0
mov ecx, dword [ebp - 4]
push 0
mov edi, eax
call fcn.00489030
test al, al
je 0x41beb3
test edi, edi
je 0x41beb3
push 1
lea edx, [ebp - 0x10]
push edx
push edi
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push 0
push eax
push ecx
lea edx, [ebp - 8]
push edx
mov ecx, ebx
call fcn.004bf3d0
mov eax, dword [ebp - 8]
push eax
mov ecx, esi
call fcn.0040c9a0
cmp eax, 1
jne 0x41bea5
mov eax, dword [esi + 0x4840]
jmp 0x41beaf
test eax, eax
je 0x41beb3
mov eax, dword [esi + 0x483c]
test eax, eax
jne 0x41bf1b
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1251], 0
je 0x41bed9
push 0
mov ecx, esi
call fcn.0040c890
test eax, eax
je 0x41bed9
mov eax, dword [esi + 0x4838]
test eax, eax
jne 0x41bf1b
cmp dword [ebp + 0xc], 0
je 0x41bf15
cmp dword [esi + 0x5500], 0
je 0x41bef0
mov eax, dword [esi + 0x4828]
jmp 0x41bf11
mov edx, dword [0x52fe30]
cmp byte [edx + 0x1242], 0
je 0x41bf15
mov ecx, dword [ebp - 4]
call fcn.004893a0
test al, al
jne 0x41bf15
mov eax, dword [esi + 0x4830]
test eax, eax
jne 0x41bf1b
mov eax, dword [esi + 0x482c]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8