Function at 0x41d445
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4705d0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x120]
push edi
mov edi, dword [esp + 0x120]
push esi
call ebx
mov ecx, eax
inc ecx
mov eax, 0xff
cmp ecx, eax
jg 0x41d484
push esi
call ebx
inc eax
push eax
push esi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor ebx, ebx
push ebx
push ebx
push 0x4597fe
mov ebp, 0x45d508
push ebp
lea eax, [esp + 0x28]
push eax
call fcn.0043fa75
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSystemMenu]
test eax, eax
jne 0x41d4ba
mov byte [esp + 0x18], bl
lea eax, [esp + 0x18]
push 0x45d530
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41d4da
push ebx
push 0xf030
jmp 0x41d569
lea eax, [esp + 0x18]
push 0x45d52c
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41d4f7
push ebx
push 0xf020
jmp 0x41d569
lea eax, [esp + 0x18]
push str.restore
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41d514
push ebx
push 0xf120
jmp 0x41d569
lea eax, [esp + 0x18]
push str.move
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41d531
push ebx
push 0xf010
jmp 0x41d569
lea eax, [esp + 0x18]
push str.close
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41d54e
push ebx
push 0xf060
jmp 0x41d569
lea eax, [esp + 0x18]
push str.size
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x41d57a
push ebx
push 0xf000
push 0x112
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x41d76e
cmp esi, ebx
je 0x41d589
push ebp
push esi
call fcn.00445d80
pop ecx
pop ecx
jmp 0x41d58b
xor eax, eax
cmp eax, ebx
je 0x41d76e
push ebx
push edi
call fcn.00440998
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
push ebx
push ebx
push 0x12
call edi
mov ebp, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call ebp
push ebx
push ebx
push ebx
push 0x20
call edi
push eax
push 0x20
call ebp
push ebx
push 2
push ebx
push 0x20
call edi
push eax
push 0x20
call ebp
push ebx
push 2
push ebx
push 0x12
call edi
push eax
push 0x12
call ebp
cmp esi, ebx
je 0x41d5eb
push 0x45d508
push esi
call fcn.00445d80
pop ecx
pop ecx
jmp 0x41d5ed
xor eax, eax
cmp byte [eax + 1], 0x41
jl 0x41d60e
cmp esi, ebx
je 0x41d606
push 0x45d508
push esi
call fcn.00445d80
pop ecx
pop ecx
jmp 0x41d608
xor eax, eax
cmp byte [eax + 1], 0x5a
jle 0x41d67a
cmp esi, ebx
je 0x41d621
push 0x45d508
push esi
call fcn.00445d80
pop ecx
pop ecx
jmp 0x41d623
xor eax, eax
cmp byte [eax + 1], 0x61
jl 0x41d644
cmp esi, ebx
je 0x41d63c
push 0x45d508
push esi
call fcn.00445d80
pop ecx
pop ecx
jmp 0x41d63e
xor eax, eax
cmp byte [eax + 1], 0x7a
jle 0x41d67a
cmp esi, ebx
je 0x41d657
push 0x45d508
push esi
call fcn.00445d80
pop ecx
pop ecx
jmp 0x41d659
xor eax, eax
cmp byte [eax + 1], 0x30
jl 0x41d69c
cmp esi, ebx
je 0x41d672
push 0x45d508
push esi
call fcn.00445d80
pop ecx
pop ecx
jmp 0x41d674
xor eax, eax
cmp byte [eax + 1], 0x39
jg 0x41d69c
cmp esi, ebx
je 0x41d68d
push 0x45d508
push esi
call fcn.00445d80
pop ecx
pop ecx
jmp 0x41d68f
xor eax, eax
movzx eax, byte [eax + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
jmp 0x41d6b4
cmp esi, ebx
je 0x41d6af
push 0x45d508
push esi
call fcn.00445d80
pop ecx
pop ecx
jmp 0x41d6b1
xor eax, eax
mov al, byte [eax + 1]
mov byte [esp + 0x14], al
cmp esi, ebx
je 0x41d6cb
push 0x45d508
push esi
call fcn.00445d80
pop ecx
pop ecx
jmp 0x41d6cd
xor eax, eax
movzx eax, byte [eax + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
shr eax, 8
mov byte [esp + 0x13], al
cmp al, bl
je 0x41d6ef
push ebx
push ebx
push ebx
push 0x10
call edi
push eax
push 0x10
call ebp
mov cl, byte [esp + 0x14]
cmp cl, 0x21
jb 0x41d6fd
cmp cl, 0x2e
jbe 0x41d715
cmp cl, 0x11
je 0x41d715
cmp cl, 0x5b
je 0x41d715
cmp cl, 0x5c
je 0x41d715
cmp cl, 0x5d
je 0x41d715
xor eax, eax
jmp 0x41d718
xor eax, eax
inc eax
push ebx
push eax
movzx esi, cl
push ebx
push esi
call edi
push eax
push dword [esp + 0x20]
call ebp
mov al, byte [esp + 0x14]
cmp al, 0x21
jb 0x41d734
cmp al, 0x2e
jbe 0x41d748
cmp al, 0x11
je 0x41d748
cmp al, 0x5b
je 0x41d748
cmp al, 0x5c
je 0x41d748
cmp al, 0x5d
je 0x41d748
xor eax, eax
jmp 0x41d74b
xor eax, eax
inc eax
push ebx
or eax, 2
push eax
push ebx
push esi
call edi
push eax
push dword [esp + 0x20]
call ebp
cmp byte [esp + 0x13], bl
je 0x41d76e
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call ebp
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.004464bf
add esp, 0x10c
ret 8