Function at 0x4148a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, eax
push edi
lea eax, [esp + 0x14]
push eax
mov ebx, 1
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
or dword [esi + 4], 2
mov dword [esi + 0x14], 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
mov dword [esp + 0x4c], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp edi, eax
jne 0x414add
test byte [esi + 4], bl
jne 0x41495f
test byte [ebp], 8
mov eax, 0
setne al
inc eax
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x414add
test byte [ebp], 8
je 0x414933
mov dword [esp + 0x20], 0x204
mov dword [esp + 0x24], 2
jmp 0x41493f
mov dword [esp + 0x20], 0x201
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x40]
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, ebp
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], ecx
call fcn.00414d90
test byte [esi + 4], 2
je 0x414add
lea esp, [esp]
push 2
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x414a83
mov ecx, ebp
mov eax, esi
call fcn.00414c50
test eax, eax
jne 0x414add
mov eax, dword [esp + 0x20]
cmp eax, 0x201
je 0x414a5c
cmp eax, 0x204
je 0x414a5c
cmp eax, 0xa1
je 0x414a5c
cmp eax, 0xa4
je 0x414a5c
push 1
push eax
push eax
xor edi, edi
push edi
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x414ad3
push 2
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_CallMsgFilterW]
test eax, eax
jne 0x414a63
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.00414d90
test eax, eax
jne 0x414a22
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, ebp
mov eax, esi
call fcn.00414c50
test eax, eax
jne 0x414add
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp dword [esp + 0x44], eax
jne 0x414add
mov eax, dword [esp + 0x20]
cmp eax, 0x118
je 0x414a83
cmp eax, 0x113
je 0x414ad3
cmp eax, 0xf
jne 0x414a7c
jmp 0x414ad3
mov edi, 1
jmp 0x4149e6
test edi, edi
je 0x414a7c
mov eax, dword [esp + 0x20]
push 1
push eax
push eax
push 0
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, 1
jmp 0x414ad3
mov ecx, ebp
mov eax, esi
call fcn.00414c50
test eax, eax
jne 0x414add
test dword [ebp], 0x4000
je 0x414aac
mov edi, dword [esp + 0x40]
push eax
mov eax, ebp
call fcn.00414c00
and dword [ebp], 0xffffbfff
test ebx, ebx
je 0x414acd
mov eax, dword [ebp + 4]
test eax, eax
je 0x414ac9
mov ecx, dword [ebp + 0x18]
push ecx
push 2
push 0x121
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
jmp 0x414ad3
call dword [sym.imp.USER32.dll_WaitMessage]
test byte [esi + 4], 2
jne 0x414970
and dword [esi + 4], 0xfffffffd
test byte [ebp + 2], 1
jne 0x414af7
mov edx, dword [esp + 0x40]
push 0
push 0
push edx
mov edi, esi
call fcn.00416110
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
test eax, eax
je 0x414b17
test dword [eax + 4], 0x800
je 0x414b17
and dword [eax + 4], 0xfffff7ff
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 2
push 0x200
push 0x200
push 0
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
mov eax, dword [esi + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8