Function at 0x41ab60
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
call fcn.00404a40
call fcn.00404a40
mov ecx, dword [eax + 0x10]
xor ebx, ebx
cmp ecx, ebx
je 0x41ab81
cmp dword [esi + 0x1c], ebx
je 0x41ab81
mov dword [esi + 0x1c], ebx
mov ebp, 1
push ebp
mov ecx, esi
call fcn.0041e9a0
test eax, eax
jne 0x41ae20
cmp dword [esi + 0x3840], ebx
push edi
je 0x41abd5
call fcn.00404a40
mov edi, dword [eax + 8]
call fcn.00404a40
mov eax, dword [eax + 0x10]
or eax, edi
je 0x41abd5
pop edi
mov dword [esi + 0x3840], ebx
mov dword [esi + 0x2048], ebp
mov dword [esi + 0x3838], ebp
mov dword [esi + 0x2028], 3
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp dword [esi + 0x18], ebx
je 0x41abfc
mov ecx, esi
call fcn.0041edb0
test eax, eax
je 0x41ae1f
pop edi
mov dword [esi + 0x18], ebx
mov dword [esi + 0x2288], 0xffffffff
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.00404a40
cmp word [eax + 0x30], bx
je 0x41ac1e
mov ecx, esi
mov dword [esi + 0x18], ebp
mov dword [esi + 0x2050], ebx
call fcn.0041e630
test eax, eax
jne 0x41ac1e
mov dword [esi + 0x18], ebx
cmp dword [esi + 0x2050], ebx
je 0x41ac6b
call fcn.00404a40
mov edi, dword [eax + 8]
call fcn.00404a40
mov ecx, dword [eax + 4]
or ecx, edi
je 0x41ae1f
mov dword [esi + 0x2050], ebx
call fcn.0040d320
pop edi
mov dword [eax + 0x6fe8], ebp
mov dword [eax + 0x6fec], ebp
mov dword [eax + 0x6ff0], ebp
mov dword [esi + 0x2288], 0xffffffff
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.00404a40
cmp dword [eax + 8], ebx
je 0x41ac98
mov dword [esi + 0x2050], ebp
call fcn.0040d320
pop edi
pop esi
mov dword [eax + 0x6fe8], ebp
mov dword [eax + 0x6fec], ebp
mov dword [eax + 0x6ff0], ebp
pop ebp
pop ebx
pop ecx
ret
cmp dword [esi + 0x20], ebx
mov eax, dword [esi + 0x37c4]
je 0x41ad0e
cmp eax, ebx
je 0x41aced
cmp dword [esi + 0x37c8], ebx
je 0x41aced
test byte [esi], 4
je 0x41ad30
lea ecx, [esi + 0x3848]
call fcn.00417ba0
test eax, eax
je 0x41ad30
mov ecx, dword [esi]
and ecx, 0xfffffffb
or ebx, 0xffffffff
push 0
mov dword [esi], ecx
mov dword [esi + 0x2288], ebx
call fcn.0040fcf0
mov ecx, eax
call fcn.004100a0
pop edi
mov dword [esi + 0x3854], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esi + 0x3394]
add edx, 2
imul edx, edx, 0x3e8
push edx
lea ecx, [esi + 0x3848]
call fcn.00417b70
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp eax, ebx
je 0x41ad1a
cmp dword [esi + 0x37c8], ebx
jne 0x41ad30
mov dword [esi + 0x3854], 0xbb8
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [esi + 0x3850], eax
mov eax, dword [esi + 0x1c]
or ebx, 0xffffffff
test eax, eax
je 0x41ad40
mov dword [esi + 0x3854], ebx
mov eax, dword [esi]
test ah, 0x20
je 0x41ada4
mov ecx, esi
call fcn.00405eb0
test eax, eax
je 0x41ae1f
mov edi, dword [esi]
and edi, 0xffffdfff
push 0
mov dword [esi], edi
call fcn.0040fcf0
mov ecx, eax
call fcn.004100a0
mov ecx, dword [esi + 0x37bc]
lea eax, [esp + 0x10]
push eax
push ebp
push 0x12
push ecx
lea edx, [esi + 0x2290]
push edx
mov dword [esp + 0x24], 0x46
call fcn.0040fcf0
mov ecx, eax
call fcn.00411850
pop edi
mov dword [esi + 0x2288], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
test al, 0x10
je 0x41adc7
mov ecx, esi
call fcn.0041a7e0
test eax, eax
je 0x41ae1f
push 0
call fcn.0040fcf0
mov ecx, eax
call fcn.004100a0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test al, 4
je 0x41ae1f
call fcn.00404a40
mov edi, dword [eax + 4]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebp, dword [esi + 0x383c]
mov edx, dword [esi + 0x37b8]
movsx eax, ax
or eax, ebp
or eax, edx
or eax, edi
je 0x41ae1f
mov ecx, dword [esi]
and ecx, 0xfffffffb
push 0
mov dword [esi], ecx
mov dword [esi + 0x2288], ebx
call fcn.0040fcf0
mov ecx, eax
call fcn.004100a0
call fcn.00421230
mov ecx, eax
call fcn.00421350
mov dword [esi + 0x3854], ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret