Function at 0x7d02c77e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1074
call fcn.7d041c90
push ebx
push esi
push edi
push 0x190
push dword [0x7d04cdfc]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_Ordinal_177]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x7d02cb6f
xor edi, edi
mov dword [ebp - 0x14], ebx
test byte [esi + 0x168], 6
je 0x7d02c7f0
mov eax, dword [esi + 0x8c]
mov ecx, dword [esi + 0xa0]
add eax, dword [esi + 0x118]
shl ecx, 2
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x94]
add eax, dword [esi + 0x90]
sub eax, ecx
add eax, dword [esi + 0x114]
mov dword [ebp - 0xc], eax
jmp 0x7d02c813
mov eax, dword [esi + 0x118]
mov ecx, dword [esi + 0x114]
sub eax, dword [esi + 0xa4]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xa0]
shl eax, 2
sub ecx, eax
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x158]
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0x7cf49a4c
lea eax, [ebp - 0x1074]
push 0x824
push eax
push dword [esi + 0x140]
call fcn.7d03d475
test eax, eax
jl 0x7d02c85c
lea eax, [ebp - 0x1074]
push eax
call fcn.7d04131e
cmp eax, 9
je 0x7d02c859
cmp eax, 0xffffffff
jne 0x7d02c85c
push 1
pop edi
push dword [esi + 0x140]
call fcn.7d03d4e3
cmp edi, ebx
mov dword [ebp - 8], eax
jne 0x7d02c8fb
cmp eax, ebx
jl 0x7d02c8fb
cmp eax, 1
jne 0x7d02c8a7
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
push 0xa103
push dword [ebp - 4]
call edi
push ebx
push 0xa104
push dword [ebp - 4]
call edi
mov dword [ebp - 0x14], 1
jmp 0x7d02c93c
cmp eax, ebx
jne 0x7d02c93c
push ebx
push ebx
push 0x50000009
call fcn.7cf690b0
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
test eax, eax
je 0x7d02c8d0
push ebx
push 0xa103
push dword [ebp - 4]
call edi
push 0x40000018
call sym.SHELL32.dll_SHRestricted
test eax, eax
je 0x7d02c8e9
push ebx
push 0xa104
push dword [ebp - 4]
call edi
push 8
push 0xa102
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x7d02c93c
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
push 0xa102
push dword [ebp - 4]
call edi
push ebx
push 0xa103
push dword [ebp - 4]
call edi
push ebx
push 0xa104
push dword [ebp - 4]
call edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetMenuItemID]
cmp eax, 0xffffffff
jne 0x7d02c93c
push 0x400
push ebx
push dword [ebp - 4]
call edi
push 0x40000015
call sym.SHELL32.dll_SHRestricted
test eax, eax
je 0x7d02c95a
push 1
push 0xa109
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableMenuItem]
test byte [esi + 0x168], 1
je 0x7d02c9d4
lea eax, [ebp - 0x1074]
push 0x824
push eax
push 0x7667
push dword [0x7d04cdfc]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x1074]
mov edi, 0xa10c
push eax
push edi
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ModifyMenuW]
lea eax, [ebp - 0x2c]
push ebx
push eax
push dword [esi + 0x140]
call fcn.7d02c3e6
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp eax, 0xffffffff
jne 0x7d02c9b8
cmp ecx, 0xffffffff
je 0x7d02c9c8
cmp eax, dword [esi + 0x11c]
jne 0x7d02c9d4
cmp ecx, dword [esi + 0x120]
jne 0x7d02c9d4
push 1
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableMenuItem]
test byte [esi + 0x168], 4
jne 0x7d02c9ed
cmp dword [esi + 0xc8], ebx
je 0x7d02c9ed
cmp dword [esi + 0xcc], ebx
jne 0x7d02c9fd
push 1
push 0xa10b
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableMenuItem]
test byte [esi + 0x168], 2
jne 0x7d02ca16
cmp dword [esi + 0xc8], ebx
je 0x7d02ca16
cmp dword [esi + 0xcc], ebx
jne 0x7d02ca26
push 1
push 0xa10a
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableMenuItem]
or dword [0x7d04ea64], 1
push ebx
push dword [esi + 0x158]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x182
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
and dword [esi + 0x154], 0xfffffffd
push 2
mov ecx, esi
call fcn.7d02b30f
lea eax, [edi - 0xa101]
cmp eax, 0xb
ja case.0x7d02ca73.41221
jmp dword [eax*4 + 0x7d02cb77]
cmp dword [ebp - 0x14], ebx
je 0x7d02ca92
push dword [esi + 0x4c]
push dword [esi + 0x140]
call fcn.7d03d5e7
jmp 0x7d02cb5a
push dword [esi + 0x140]
call fcn.7d03d628
jmp 0x7d02cb5a
push dword [esi + 0x140]
call fcn.7d03d667
jmp 0x7d02cb5a
push ebx
push dword [esi + 0x140]
call fcn.7d03d5aa
jmp 0x7d02cb5a
lea eax, [ebp - 0x1074]
push 0x824
push eax
push 0x104e
push dword [0x7d04cdfc]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x1074]
push ebx
push eax
call sym.SHELL32.dll_SHRunControlPanel
mov dword [ebp - 8], ebx
jmp case.0x7d02ca73.41221
push dword [esi + 0x140]
call fcn.7d03d53a
jmp 0x7d02cb5a
push edi
mov ecx, esi
call fcn.7d02c522
jmp 0x7d02cb5a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x7d02cb28
cmp dword [esi + 0xc8], ebx
je 0x7d02cb38
cmp dword [esi + 0xcc], ebx
jne 0x7d02cb3d
jmp 0x7d02cb38
cmp dword [esi + 0xc8], ebx
je 0x7d02cb3d
cmp dword [esi + 0xcc], ebx
je 0x7d02cb3d
push 1
pop eax
jmp 0x7d02cb3f
xor eax, eax
push dword [esi + 0x120]
push dword [esi + 0x11c]
push eax
push dword [esi + 0x10]
push dword [esi + 0x140]
call fcn.7d03d707
mov dword [ebp - 8], eax
and dword [0x7d04ea64], 0xfffffffe
cmp edi, ebx
je 0x7d02cb6f
mov ecx, esi
call fcn.7cf6c7fe
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret