Function at 0x414300
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, ecx
mov dword [esp + 0x14], edi
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x49e7d0], eax
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x414347
mov ecx, 0x177b
call fcn.0044d8d0
push eax
push 1
call fcn.00415ad0
mov dword [ebp + 0x20], eax
add esp, 8
mov dword [eax + 8], 0x6e
mov dword [eax + 0xc], 0x235
mov al, byte [0x49d50a]
mov byte [0x495f4d], 1
test al, al
je 0x41436c
mov ecx, dword [0x4bf19c]
call fcn.00424a40
xor ecx, ecx
mov cl, byte [eax + 6]
call fcn.00428db0
mov bl, byte [0x4b60f4]
xor edx, edx
test bl, bl
sete dl
xor ecx, ecx
call fcn.00463dc0
test eax, eax
je 0x41480d
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
test edi, edi
jne 0x414856
call fcn.00447040
call fcn.0044e520
call fcn.0044b1b0
mov al, byte [0x4b60f4]
test al, al
je 0x4143b9
call fcn.00426eb0
mov ecx, dword [0x4bf1c8]
test ecx, ecx
mov ecx, dword [0x49d720]
setne byte [esp + 0x13]
call fcn.0040d520
mov eax, dword [ebp + 8]
test eax, eax
je 0x4144b1
mov al, byte [0x4b64d7]
test al, al
je 0x41447b
mov eax, dword [0x4bf1c8]
test eax, eax
jne 0x41447b
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [0x49e7d0]
add ecx, 0x1f4
cmp eax, ecx
jbe 0x41447b
mov al, byte [0x49e7c4]
test al, al
je 0x414422
mov al, byte [0x4b60f4]
test al, al
jne 0x41481c
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x414437
mov al, byte [ebp + 0x17]
test al, al
je 0x414437
mov eax, 3
jmp 0x414463
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41444c
mov al, byte [ebp + 0x16]
test al, al
je 0x41444c
mov eax, 2
jmp 0x414463
mov eax, dword [ebp + 8]
test eax, eax
je 0x414461
mov al, byte [ebp + 0x15]
test al, al
je 0x414461
mov eax, 1
jmp 0x414463
xor eax, eax
push eax
mov ecx, ebp
call fcn.004155d0
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
jne 0x414856
jmp 0x4144b1
mov al, byte [0x4b64d4]
test al, al
je 0x4144b1
mov al, byte [esp + 0x13]
test al, al
jne 0x4144b1
mov al, byte [ebp + 0x15]
test al, al
je 0x4144b1
push 1
mov ecx, ebp
mov byte [0x4b64d4], 0
call fcn.004155d0
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
jne 0x414856
mov al, byte [0x4b60f4]
test al, al
je 0x4144e1
mov al, byte [0x49e7c4]
test al, al
je 0x4144e1
mov eax, dword [ebp + 8]
test eax, eax
je 0x4144e1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4144e1
call fcn.00428d80
mov byte [ebp + 0x15], al
call fcn.00428d80
mov byte [ebp + 0x16], al
mov al, byte [esp + 0x13]
test al, al
jne 0x414666
mov al, byte [0x4b60f4]
test al, al
jne 0x414666
push 0x76
call esi
test ah, 0x80
jne 0x414510
push 0x76
call ebx
test ah, 0x80
je 0x414666
mov edx, dword [0x51d9a8]
cmp dword [edx], 0
je 0x414666
mov cl, 1
call dword [0x51cf70]
cmp dword [ebp + 0x54], 1
je 0x4145c2
mov byte [0x4b6468], 1
mov ecx, dword [ebp + 0x18]
mov dl, 1
call fcn.0040ed70
mov ecx, dword [ebp + 0x18]
push 1
push 0xffffffffffffffff
or edx, 0xffffffff
call fcn.0044c7a0
mov esi, dword [ebp + 0x50]
push 0
push 0
mov ecx, 0x4b0a48
call fcn.00415a10
test eax, eax
jne 0x41457d
mov ecx, 0x1776
call fcn.0044d8d0
push eax
push 1
call fcn.00432060
add esp, 8
jmp 0x4145af
mov edx, esi
mov ebx, 0x258
mov ecx, 0x190
mov esi, edx
mov edi, eax
add edx, 0x640
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4b6098]
dec ebx
lea eax, [eax + ecx*2]
jne 0x414584
mov ecx, 0x4b0a48
call fcn.0040f470
mov edi, dword [esp + 0x14]
call fcn.0040f180
mov byte [0x495f4d], 0
mov dword [ebp + 0x54], 1
call fcn.0044e380
test al, al
je 0x4145d0
call fcn.0044b370
mov al, byte [0x4b60f4]
xor ebx, ebx
xor edx, edx
test al, al
sete dl
xor ecx, ecx
call fcn.00463dc0
test eax, eax
je 0x414745
mov eax, dword [0x51d9ac]
test eax, eax
je 0x414745
call fcn.00447040
call fcn.0044e520
mov ecx, 0x49e570
call fcn.00412240
call fcn.0044b1b0
call fcn.00421790
inc ebx
test bl, 1
je 0x414645
call fcn.0040f180
call fcn.0044b3b0
mov ecx, dword [0x49d720]
call fcn.0040d520
call fcn.00447180
call fcn.00421820
mov cl, 1
call dword [0x51cf70]
call fcn.0046b640
mov al, byte [0x4b60f4]
xor edx, edx
test al, al
sete dl
xor ecx, ecx
call fcn.00463dc0
test eax, eax
jne 0x4145ed
jmp 0x414745
push 0x10
call esi
test ah, 0x80
jne 0x41467c
push 0x10
call ebx
test ah, 0x80
je 0x414725
mov cl, byte [esp + 0x13]
test cl, cl
jne 0x414729
cmp dword [ebp + 0x54], 1
je 0x414745
mov byte [0x4b6468], 1
mov ecx, dword [ebp + 0x18]
mov dl, 1
call fcn.0040ed70
mov ecx, dword [ebp + 0x18]
push 1
push 0xffffffffffffffff
or edx, 0xffffffff
call fcn.0044c7a0
mov esi, dword [ebp + 0x50]
push 0
push 0
mov ecx, 0x4b0a48
call fcn.00415a10
test eax, eax
jne 0x4146de
mov ecx, 0x1776
call fcn.0044d8d0
push eax
push 1
call fcn.00432060
add esp, 8
jmp 0x414710
mov edx, esi
mov ebx, 0x258
mov ecx, 0x190
mov esi, edx
mov edi, eax
add edx, 0x640
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4b6098]
dec ebx
lea eax, [eax + ecx*2]
jne 0x4146e5
mov ecx, 0x4b0a48
call fcn.0040f470
mov edi, dword [esp + 0x14]
call fcn.0040f180
mov byte [0x495f4d], 0
mov dword [ebp + 0x54], 1
jmp 0x414745
mov cl, byte [esp + 0x13]
mov eax, dword [ebp + 0x54]
test eax, eax
je 0x414736
test cl, cl
je 0x41473e
jmp 0x41473a
test cl, cl
je 0x414745
test eax, eax
je 0x414745
mov ecx, ebp
call fcn.00414f80
call fcn.0040f180
mov eax, dword [ebp + 0x54]
test eax, eax
jne 0x414776
call fcn.00421790
mov ecx, ebp
mov word [0x4b6530], 0
call fcn.00413e00
push eax
mov ecx, ebp
call fcn.004155d0
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x4147c3
mov byte [0x495f4d], 0
call fcn.0044b3b0
mov ecx, dword [0x4b64d8]
call fcn.00419250
mov ecx, dword [0x4b64d8]
call fcn.00418710
mov al, byte [0x4b6054]
test al, al
je 0x4147c3
mov edx, dword [0x4b604c]
mov eax, dword [0x4b6048]
push 1
push 0
push 0
push 0x3f800000
push edx
push eax
mov ecx, 0x4b6040
call fcn.00407f60
mov al, byte [0x4b60f4]
test al, al
je 0x4147d6
call fcn.00428440
call fcn.004267d0
call fcn.00447180
call fcn.00421820
mov cl, 1
call dword [0x51cf70]
call fcn.0046b640
mov bl, byte [0x4b60f4]
xor edx, edx
test bl, bl
sete dl
xor ecx, ecx
call fcn.00463dc0
test eax, eax
jne 0x414388
test edi, edi
jne 0x414856
call fcn.00420f80
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov al, byte [ebp + 0x2c]
test al, al
je 0x414833
mov eax, 2
mov dword [esp + 0x14], eax
mov dword [0x49e7cc], eax
jmp 0x414841
mov ecx, 2
mov dword [esp + 0x14], ecx
call fcn.00427b00
mov ecx, dword [0x4bf19c]
call fcn.00424a40
xor ecx, ecx
mov cl, byte [eax + 6]
call fcn.00428db0
sub esp, 0x10
xor eax, eax
mov ebx, esp
xor edx, edx
mov esi, 0x320
mov edi, 0x258
mov dword [ebx], eax
mov cl, 1
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
call fcn.0040f0e0
call fcn.0044cbe0
mov ecx, dword [0x4b0a50]
mov ebp, dword [ebp + 0x50]
and ecx, 0xff
xor esi, esi
xor eax, eax
dec ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
je 0x4148a8
dec ecx
jne 0x414911
mov eax, dword [0x4b0a4c]
jmp 0x414907
mov ecx, dword [0x4b0a48]
mov al, byte [ecx + 0x10]
test al, al
je 0x4148da
mov eax, dword [0x51da28]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
cmp dword [esp + 0x18], esi
jge 0x4148d0
mov dword [esp + 0x18], esi
cmp dword [esp + 0x1c], esi
jge 0x4148da
mov dword [esp + 0x1c], esi
mov ecx, dword [0x4b0a48]
call fcn.0044c6c0
cmp eax, esi
je 0x414915
mov ecx, dword [0x4b0a58]
mov edx, dword [0x4b0a54]
imul ecx, dword [esp + 0x18]
imul edx, dword [esp + 0x1c]
shr ecx, 3
add edx, eax
lea eax, [edx + ecx]
mov dword [0x4b0a5c], 1
cmp eax, esi
jne 0x41492c
mov ecx, 0x1776
call fcn.0044d8d0
push eax
push 1
call fcn.00432060
add esp, 8
jmp 0x41497d
mov edx, ebp
mov ebx, 0x258
mov ecx, 0x190
mov esi, edx
mov edi, eax
add edx, 0x640
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4b6098]
dec ebx
lea eax, [eax + ecx*2]
jne 0x414933
mov eax, dword [0x4b0a50]
and eax, 0xff
dec eax
jne 0x414971
mov eax, dword [0x4b0a5c]
test eax, eax
je 0x414971
mov ecx, dword [0x4b0a48]
call fcn.0044c780
mov dword [0x4b0a5c], 0
xor esi, esi
call fcn.0044b350
call fcn.0040f180
call fcn.00447150
mov eax, dword [esp + 0x14]
mov dword [0x49e7c8], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret