Function at 0x450111
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x487304]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, dword [ebp + 0x14]
push ebx
push esi
push edi
lea edi, [eax - 0x314]
mov dword [ebp - 0x28], eax
mov eax, dword [edi]
mov dword [ebp - 0x3c], ecx
mov ecx, edi
call dword [eax + 0xc8]
test al, al
je 0x4501ec
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd4]
test al, al
je 0x4501ec
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xdc]
mov esi, dword [ebp + 8]
test al, al
jne 0x450175
lea eax, [esi - 0x200]
cmp eax, 0xd
jbe 0x4501ec
mov ebx, dword [ebp + 0xc]
cmp esi, 0x20a
jne 0x45018e
test bl, 8
je 0x4501ec
mov byte [ebp - 0x21], 1
jmp 0x45021c
cmp esi, 0x10f
jne 0x4501ff
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0042e701
push eax
call sub.IMM32.dll_ImmGetContext
mov esi, eax
test esi, esi
je 0x4501ec
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push esi
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], ecx
call sub.IMM32.dll_ImmSetCompositionWindow
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0042e701
push eax
call sub.IMM32.dll_ImmReleaseContext
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004662d8
leave
ret 0x10
mov byte [ebp - 0x21], 1
cmp esi, 0x200
jb 0x450213
cmp esi, 0x20d
jbe 0x45021c
cmp esi, 0x20
jne 0x450330
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 4]
call fcn.0044fff1
test eax, eax
jne 0x450266
mov eax, esi
sub eax, 0x201
je 0x450248
sub eax, 1
je 0x450248
sub eax, 1
je 0x450248
sub eax, 1
je 0x450248
sub eax, 1
jne 0x450266
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00430453
cmp eax, edi
jne 0x4501ec
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov ecx, eax
mov dword [ebp - 0x2c], eax
call fcn.0044fff1
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 3
mov dword [ebp - 0x34], ecx
test eax, eax
jne 0x4502ee
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
push eax
call fcn.0044fbe8
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
cmp esi, 0x20a
jne 0x4502c9
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
mov eax, dword [edi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0042e701
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
push eax
push ecx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4502eb
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004309f3
test al, al
je 0x4502f7
mov ecx, dword [ebp - 0x34]
cmp ecx, 3
jne 0x4501ec
cmp esi, 0x20
jne 0x450305
mov byte [ebp - 0x21], 0
jmp 0x450420
cmp esi, 0x201
je 0x450321
cmp esi, 0x203
je 0x450321
cmp esi, 0x204
jne 0x4503c2
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xf0]
jmp 0x4503c2
cmp esi, 0x100
jb 0x450340
cmp esi, 0x109
jbe 0x4503b0
cmp esi, 0x102
je 0x4503b0
cmp esi, 0x286
je 0x4503b0
cmp esi, 0x7b
jne 0x45039e
mov ecx, dword [ebp + 0x10]
movsx eax, cx
mov dword [ebp - 0x30], eax
mov eax, ecx
shr eax, 0x10
mov ecx, edi
cwde
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [edi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0042e701
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 0x2c]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 0x30]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00430453
cmp eax, edi
jne 0x4501ec
jmp 0x4503ab
cmp esi, 0x53
jne 0x4501ec
mov byte [ebp - 0x21], 0
mov ebx, dword [ebp + 0xc]
jmp 0x450420
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xec]
test al, al
je 0x4501ec
cmp esi, 0x102
jne 0x450420
mov ecx, edi
call fcn.0044ffea
test al, al
je 0x450420
push 0x15
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x4503ef
push 0
mov ecx, edi
call fcn.00450762
mov eax, dword [ebp - 0x28]
jmp 0x45041c
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x24], 0
jne 0x450414
push ebx
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x450420
mov ecx, dword [ebp - 0x28]
movzx eax, bx
shl eax, 8
mov dword [ecx + 0x24], eax
jmp 0x4501ec
or ebx, dword [eax + 0x24]
mov esi, 0x286
and dword [eax + 0x24], 0
mov eax, dword [edi]
lea ecx, [ebp - 0x38]
and dword [ebp - 0x38], 0
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push ebx
push esi
call dword [eax + 0x1b8]
test eax, eax
je 0x450475
cmp esi, 0x100
jb 0x45044b
cmp esi, 0x109
jbe 0x450475
cmp esi, 0x102
je 0x450475
cmp esi, 0x286
je 0x450475
lea eax, [esi - 0x200]
cmp eax, 0xd
ja 0x45047d
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
call fcn.0044fff1
test eax, eax
je 0x45047d
mov ecx, dword [ebp - 0x3c]
mov al, byte [ebp - 0x21]
mov byte [ecx], al
mov eax, dword [ebp - 0x38]
jmp 0x4501ee