Function at 0x409a70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov eax, dword [edi + 0x308]
cmp eax, 2
je 0x409bc2
cmp eax, 3
je 0x409bc2
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x10
mov dword [ebp - 4], eax
call esi
movzx ecx, ax
mov eax, dword [ebp - 4]
shr ecx, 0xf
and ecx, 0xffffff01
cmp byte [edi + 0x104], 0
mov dword [ebp - 8], ecx
je 0x409ae4
test al, al
je 0x409ae4
cmp ebx, 9
jne 0x409ae4
mov dl, cl
mov ecx, edi
call fcn.00466a30
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x25
je 0x409aee
cmp ebx, 0x27
jne 0x409b18
test cl, cl
je 0x409b18
test al, al
je 0x409b18
cmp dword [edi + 0x58], 0
je 0x409b18
cmp byte [ebp + 0xc], 0
jne 0x409b18
cmp ebx, 0x27
mov ecx, edi
sete dl
call fcn.00408560
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
test ecx, ecx
jne 0x409b27
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
call dword [eax + 0x78]
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x409b3d
mov edx, dword [ecx]
call dword [edx + 0x7c]
mov edx, eax
jmp 0x409b3f
xor edx, edx
mov ecx, dword [ebp - 4]
test cl, cl
je 0x409b4f
cmp ebx, 0x26
jne 0x409b4f
mov al, 1
jmp 0x409b51
xor al, al
test edx, edx
jne 0x409b6f
cmp ebx, 0x21
jne 0x409b65
mov dword [ebp - 0xc], 1
test cl, cl
je 0x409b6c
mov dword [ebp - 0xc], 0
or al, byte [ebp - 0xc]
test al, al
je 0x409bcb
mov esi, dword [sym.imp.USER32.dll_GetScrollPos]
push 1
push dword [edi + 0x60]
call esi
mov ecx, dword [edi]
mov ebx, eax
push 0
mov edx, dword [ecx]
mov edx, dword [edx + 0x34]
call edx
fld dword [0x55ddf8]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x409bae
push 0
push 2
push 0x115
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 0x60]
call esi
cmp eax, ebx
jne 0x409bc2
mov ecx, dword [edi]
push 1
mov eax, dword [ecx]
call dword [eax + 0x6c]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test cl, cl
je 0x409bd8
cmp ebx, 0x28
jne 0x409bd8
mov al, 1
jmp 0x409bda
xor al, al
test edx, edx
jne 0x409bf8
cmp ebx, 0x22
jne 0x409bee
mov dword [ebp - 0xc], 1
test cl, cl
je 0x409bf5
mov dword [ebp - 0xc], 0
or al, byte [ebp - 0xc]
test al, al
je 0x409c52
mov esi, dword [sym.imp.USER32.dll_GetScrollPos]
push 1
push dword [edi + 0x60]
call esi
mov ecx, dword [edi]
mov ebx, eax
push 0
mov edx, dword [ecx]
mov edx, dword [edx + 0x34]
call edx
fld dword [0x55ddf8]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x409c37
push 0
push 3
push 0x115
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 0x60]
call esi
cmp eax, ebx
jne 0x409bc2
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x68]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x409c8c
mov ecx, ebx
call fcn.00409a30
test al, al
je 0x409c89
mov ecx, dword [edi]
test ecx, ecx
je 0x409c6e
mov eax, dword [ecx]
call dword [eax + 0x7c]
jmp 0x409c70
xor eax, eax
push dword [ebp + 8]
mov ecx, eax
push ebx
push 0x100
call fcn.0047dd20
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
cmp ebx, 0x26
jne 0x409cce
test esi, esi
je 0x409bb9
mov eax, dword [esi + 0x48]
cmp eax, dword [esi + 0x50]
jge 0x409bb9
mov ecx, dword [ebp - 8]
movzx eax, cl
neg eax
push 0
sbb eax, eax
and eax, 0x401
push eax
push 0x115
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x28
jne 0x409d09
test esi, esi
je 0x409d2d
mov eax, dword [esi + 0x48]
cmp eax, dword [esi + 0x50]
jge 0x409d2d
mov ecx, dword [ebp - 8]
movzx eax, cl
neg eax
push 0
sbb eax, eax
and eax, 0x401
inc eax
push eax
push 0x115
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x21
jne 0x409d24
test cl, cl
je 0x409d63
mov ecx, dword [edi]
push 0
mov eax, dword [ecx]
call dword [eax + 0x6c]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x22
jne 0x409d3d
test cl, cl
je 0x409d63
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x68]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x24
jne 0x409d56
test cl, cl
je 0x409d63
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x70]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x23
jne 0x409d63
test cl, cl
jne 0x409e03
cmp byte [ebp + 0xc], 0
jne 0x409b1e
cmp ebx, 0x25
jne 0x409da9
test esi, esi
je 0x409d12
mov eax, dword [esi + 0x4c]
cmp eax, dword [esi + 0x54]
jge 0x409d12
test cl, cl
jne 0x409d12
mov ecx, dword [ebp - 8]
movzx eax, cl
neg eax
push 0
sbb eax, eax
and eax, 2
push eax
push 0x114
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x27
jne 0x409df5
test esi, esi
je 0x409d2d
mov eax, dword [esi + 0x4c]
cmp eax, dword [esi + 0x54]
jge 0x409d2d
test cl, cl
jne 0x409d2d
mov ecx, dword [ebp - 8]
xor eax, eax
test cl, cl
push 0
setne al
lea eax, [eax*2 + 1]
push eax
push 0x114
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x24
je 0x409d46
cmp ebx, 0x23
jne 0x409e2f
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x74]
call eax
test al, al
jne 0x409bc2
push 0
push 7
push 0x115
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x6a
jne 0x409e4e
test esi, esi
je 0x409b1e
push 0x5a
mov ecx, esi
call fcn.0047c230
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x6f
jne 0x409b1e
test esi, esi
je 0x409b1e
push 0xffffffffffffffa6
mov ecx, esi
call fcn.0047c230
pop edi
pop esi
mov byte [0x56b082], 1
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret