Function at 0x40db30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 0x4230]
call fcn.0043dcf0
test eax, eax
jne 0x40db8c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00406750
mov ebx, eax
test ebx, ebx
je 0x40db8c
push 0
push ebx
call fcn.0049fc10
add esp, 8
test al, al
je 0x40db8c
mov ecx, ebx
call fcn.004a4a70
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x40dc0d
mov eax, dword [0x50b3a0]
cmp byte [eax + 0x11294], 0
je 0x40dc02
cmp byte [eax + 0x11310], 0
jne 0x40dc02
mov ecx, dword [0x50b384]
push 1
lea eax, [ebp - 0x10]
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 0x423c]
push edx
push eax
call fcn.0048e770
test al, al
je 0x40dc02
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [0x50b384]
push edx
push eax
push 0
push 0
push 0x20
push ecx
mov ecx, dword [esi + 0x423c]
mov dword [ebp + 0xc], 0
call fcn.00490af0
test al, al
jne 0x40de26
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, edi
call fcn.0049ca00
test eax, eax
je 0x40dc27
mov ecx, edi
call fcn.00476dd0
test eax, eax
jne 0x40de26
mov edi, dword [ebp + 0xc]
cmp edi, 0xffffffff
jne 0x40dc74
mov eax, dword [0x50b384]
lea edx, [ebp - 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push ecx
push edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x40dc67
push 1
push eax
mov ecx, esi
call fcn.004068c0
test al, al
je 0x40dc02
xor edi, edi
jmp 0x40dc6c
mov edi, 1
lea ecx, [ebx + 8]
call fcn.0049ca00
test byte [esi + 0x42c0], 0x80
je 0x40dca6
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x40dc02
mov ecx, esi
call fcn.00406ac0
mov byte [esi + 0x42c4], 1
cmp di, 1
je 0x40dcb5
test di, di
jne 0x40dc02
mov dword [ebp + 0xc], 1
cmp di, 1
jne 0x40dde4
mov eax, 0x4000
test word [esi + 0x42c0], ax
je 0x40dce6
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x40ddda
cmp dword [esi + 0x43a4], 0
je 0x40dd05
mov ecx, esi
call fcn.00406800
test al, al
je 0x40dd05
mov eax, dword [esi + 0x43a4]
jmp 0x40ddda
mov edi, dword [ebp - 4]
mov ecx, edi
call fcn.00478f90
test al, al
je 0x40dd25
push 0x7f01
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x40ddda
mov ecx, edi
call fcn.00479750
test eax, eax
je 0x40dd42
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x40ddda
movzx eax, word [esi + 0x42c0]
test eax, 0x3c00
je 0x40dd5f
test eax, 0x400
je 0x40ddd4
mov eax, dword [esi + 0x43a0]
jmp 0x40ddda
push 1
push 0
mov ecx, esi
call fcn.004068c0
movzx eax, al
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40de19
lea ecx, [ebx + 8]
call fcn.0049ca00
mov ecx, dword [ebp - 4]
push 0
mov edi, eax
call fcn.00478e80
test al, al
je 0x40ddde
test edi, edi
je 0x40ddde
push 1
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push 0
push edx
push eax
lea ecx, [ebp - 8]
push ecx
mov ecx, ebx
call fcn.004a6810
mov edx, dword [ebp - 8]
push edx
mov ecx, esi
call fcn.00408dd0
cmp eax, 1
jne 0x40ddd0
mov eax, dword [esi + 0x43a0]
jmp 0x40ddda
test eax, eax
je 0x40ddde
mov eax, dword [esi + 0x439c]
test eax, eax
jne 0x40de1f
cmp dword [ebp + 0xc], 0
je 0x40de19
cmp dword [esi + 0x5060], 0
je 0x40ddf5
mov eax, dword [esi + 0x438c]
jmp 0x40de15
mov eax, dword [0x50b3a0]
cmp byte [eax + 0x123d], 0
je 0x40de19
mov ecx, dword [ebp - 4]
call fcn.00479180
test al, al
jne 0x40de19
mov eax, dword [esi + 0x4394]
test eax, eax
jne 0x40de1f
mov eax, dword [esi + 0x4390]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8