Function at 0x4180a5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp byte [esi + 0x49], 0
je 0x418100
mov ecx, dword [esi + 0x44]
mov ecx, dword [ecx + 0x34]
call fcn.004652e4
test al, al
je 0x418100
cmp byte [0x5192b6], 0
jne 0x418100
push dword [ebp + 0xc]
mov eax, dword [esi + 0x44]
push dword [ebp + 8]
mov byte [0x5192b6], 1
push edi
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [0x5192b6], 0
jmp 0x4183d2
mov eax, dword [ebp + 8]
mov edi, eax
movzx ebx, ax
shr edi, 0x10
test bl, 8
jne 0x418364
call fcn.00464e2c
test al, al
jne 0x418364
test bl, 2
jne 0x418364
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x28]
sub eax, 4
je 0x418178
sub eax, 1
je 0x418178
sub eax, 1
je 0x418178
mov ecx, dword [esi]
push 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x28], eax
call dword [ebp - 0x28]
movss xmm0, dword [0x507194]
fstp dword [ebp - 0x28]
ucomiss xmm0, dword [ebp - 0x28]
lahf
test ah, 0x44
jp 0x418178
mov ecx, dword [esi]
mov eax, dword [ecx]
test di, di
jle 0x41835f
push 0
jmp 0x41835a
cmp dword [0x519c1c], 0
je 0x4183d0
test bl, 4
jne 0x418198
call fcn.00464e1f
test al, al
jne 0x418198
mov byte [ebp - 0x21], al
jmp 0x4181a3
mov byte [ebp - 0x21], 1
mov byte [0x5191d6], 1
cmp dword [0x519c1c], 0
jge 0x418225
mov ecx, esi
call fcn.0042d649
test eax, eax
je 0x418225
mov bl, byte [ebp - 0x21]
lea eax, [ebp - 0x20]
and dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
movzx eax, bl
xor eax, 1
movlpd qword [ebp - 0x18], xmm0
push eax
push dword [esi + 0xc]
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x20], 0x1c
mov dword [ebp - 0x1c], 2
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0x78
movsx eax, di
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edi, eax
mov ecx, esi
neg edi
call fcn.0042d649
mov ecx, eax
test bl, bl
je 0x418218
push edi
call fcn.00421bce
jmp 0x4183d0
push 1
push edi
call fcn.00421c42
jmp 0x4183d0
test bl, 0x20
jne 0x418259
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x418259
mov ecx, dword [esi + 0xc]
call fcn.004652e4
test al, al
je 0x41827c
mov edx, dword [esi + 0xc]
lea ecx, [ebp - 0x2c]
call fcn.0046531b
mov eax, dword [ebp - 0x2c]
cmp eax, dword [esi + 0x1b0]
jle 0x41827c
xor eax, eax
test di, di
push 0
setle al
add eax, 0x466
push eax
push 0x115
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4183d0
push 1
push dword [esi + 0xc]
movsx eax, di
add dword [esi + 0x1bc], eax
call dword [sym.imp.USER32.dll_GetScrollPos]
mov edx, dword [esi + 0x1bc]
mov ecx, dword [0x519c1c]
mov bl, byte [ebp - 0x21]
mov dword [ebp - 0x28], eax
cmp edx, ecx
jl 0x4182d9
push 0
push 0
test bl, bl
je 0x4182b5
push 0x114
jmp 0x4182ba
push 0x115
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esi + 0x1bc]
mov ecx, dword [0x519c1c]
sub edx, ecx
mov dword [esi + 0x1bc], edx
jmp 0x4182a2
neg ecx
cmp edx, ecx
jg 0x418311
push 0
push 1
test bl, bl
je 0x4182ee
push 0x114
jmp 0x4182f3
push 0x115
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x519c1c]
add dword [esi + 0x1bc], eax
neg eax
cmp dword [esi + 0x1bc], eax
jle 0x4182df
test bl, bl
jne 0x4183d0
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x28]
sub eax, 4
je 0x4183d0
sub eax, 1
je 0x4183d0
sub eax, 1
je 0x4183d0
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetScrollPos]
cmp eax, dword [ebp - 0x28]
jne 0x4183d0
mov ecx, dword [esi]
mov eax, dword [ecx]
test di, di
jle 0x41835f
push 1
call dword [eax + 0x68]
jmp 0x4183d0
call dword [eax + 0x64]
jmp 0x4183d0
mov edx, dword [esi + 0xc]
lea ecx, [ebp - 0x34]
call fcn.0046531b
mov ecx, dword [esi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x28], eax
test di, di
jns 0x418388
movss xmm0, dword [0x5070c8]
jmp 0x418390
movss xmm0, dword [0x507158]
push ecx
movss dword [esp], xmm0
call dword [ebp - 0x28]
mov ecx, dword [esi]
lea edx, [ebp - 0x34]
push edx
fstp dword [ebp - 0x28]
movss xmm0, dword [ebp - 0x28]
mov eax, dword [ecx]
push ecx
movss dword [esp], xmm0
call dword [eax + 0x30]
mov ecx, esi
call fcn.004527cc
test bl, 2
je 0x4183c5
mov byte [esi + 0xe1], 0
push 6
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret