Function at 0x41fb20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
mov ecx, dword [esi + 0x84]
test ecx, ecx
je 0x41fb4b
mov eax, dword [esp + 0x1c]
push ebx
push edi
push eax
push ebp
call fcn.004b0a70
mov ecx, dword [esi + 0x88]
test ecx, ecx
je 0x41fb62
mov edx, dword [esp + 0x1c]
push ebx
push edi
push edx
push ebp
call fcn.00499c80
mov ecx, 0x66d858
mov dword [esp + 0x14], 0
call fcn.004a24a0
test eax, eax
je 0x41fbb6
mov ecx, 0x66d858
call fcn.004a24a0
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
push ebx
push edi
push ecx
push ebp
mov ecx, eax
call dword [edx + 0x48]
test eax, eax
mov dword [esp + 0x14], eax
je 0x41fbb6
mov eax, dword [esp + 0x1c]
cmp eax, 0x200
je 0x41fbba
cmp eax, 0x113
je 0x41fbba
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x1c]
cmp eax, 0x111
ja 0x41ff95
je 0x41ff70
cmp eax, 0x13
ja 0x41fd58
je 0x41fd3e
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x41ffbe.279
xor edx, edx
mov dl, byte [eax + 0x4201e4]
jmp dword [edx*4 + 0x4201cc]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebp
je 0x41fc16
test eax, eax
je case.0x41ffbe.279
push eax
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, ebp
jne case.0x41ffbe.279
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi]
push ebx
push edi
push ecx
push ebp
mov ecx, esi
call dword [eax + 0xf4]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esi + 0x30]
test eax, eax
je case.0x41ffbe.279
mov eax, edi
mov ecx, edi
and eax, 0xffff
shr ecx, 0x10
test eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jne 0x41fc90
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41fc90
mov edx, dword [esi + 0x2c]
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edx
call ebp
mov edx, eax
push 0
push ebx
mov dword [esp + 0x1c], edx
call ebp
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jne 0x41fc8c
mov dword [0x6633d0], ebx
mov ebp, dword [esp + 0x18]
cmp ebp, dword [esi + 0x2c]
jne case.0x41ffbe.279
mov eax, dword [esp + 0x24]
test eax, eax
je case.0x41ffbe.279
mov eax, dword [esp + 0x20]
test eax, eax
je case.0x41ffbe.279
mov eax, dword [0x6633d0]
test eax, eax
je case.0x41ffbe.279
mov dword [0x6633d0], 0
mov eax, dword [esp + 0x1c]
push ebx
push edi
push eax
push ebp
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x41fcdb
mov ecx, dword [eax + 0x50]
test ecx, ecx
jne case.0x41ffbe.279
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
push ebx
push edi
push eax
push ebp
mov ecx, esi
call dword [edx + 0x104]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
push ebx
push edi
push eax
push ebp
mov ecx, esi
call dword [edx + 0x110]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
push ebx
push edi
push eax
push ebp
mov ecx, esi
call dword [edx + 0x114]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esi + 0x30]
test eax, eax
je case.0x41ffbe.279
mov ecx, 0x66d858
call fcn.004a0290
jmp case.0x41ffbe.279
add eax, 0xffffffe4
cmp eax, 0xe9
ja case.0x41ffbe.279
xor ecx, ecx
mov cl, byte [eax + 0x420208]
jmp dword [ecx*4 + 0x4201f4]
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
push ebx
push edi
push eax
push ebp
mov ecx, esi
call dword [edx + 0xe4]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
cmp edi, 0x2c
je 0x41fdb9
cmp edi, 0x7b
jne case.0x41ffbe.279
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge case.0x41ffbe.279
mov eax, dword [esi + 0x30]
test eax, eax
je case.0x41ffbe.279
mov eax, dword [esi + 0x34]
test eax, eax
je case.0x41ffbe.279
mov eax, dword [esi + 0x6c]
test eax, eax
je case.0x41ffbe.279
mov ecx, dword [eax + 0xc]
test ecx, ecx
je case.0x41ffbe.279
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x78]
jmp case.0x41ffbe.279
cmp edi, 0x12
jne case.0x41ffbe.279
mov ecx, 0x66d858
call fcn.004a24a0
test eax, eax
je case.0x41ffbe.279
mov ecx, 0x66d858
call fcn.004a24a0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xec]
jmp case.0x41ffbe.279
mov eax, dword [esi + 0x30]
test eax, eax
je 0x41ff4b
mov eax, dword [0x6633b8]
cmp edi, 1
jne 0x41ff03
test eax, eax
je 0x41ff4b
push 0
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esi + 0x2c]
push 0
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
cmp dword [esi + 0x1dc], 1
je 0x41fe6f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc4]
mov dword [0x6633b8], 0
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x41fe94
call fcn.0045ea50
mov ecx, dword [esi + 0x6c]
call fcn.0045eb80
mov ecx, esi
call fcn.00422400
mov ecx, 0x66d858
call fcn.004a02e0
cmp dword [esi + 0x1dc], 1
je 0x41ff4b
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x41fecd
call fcn.0045ea10
mov ecx, dword [esi + 0x6c]
lea eax, [ecx + 0xb8]
push eax
push 0x100
push 0
call fcn.0045f810
mov ecx, esi
call fcn.00422400
mov ecx, dword [esi + 0x2c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [0x66335c], 0xa
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x663360], eax
mov dword [0x6633bc], 1
jmp 0x41ff4b
test eax, eax
jne 0x41ff4b
mov edx, dword [esi + 0x2c]
push 0
push 0xfffffffffffffff4
push edx
call dword [sym.imp.USER32.dll_SetClassLongA]
cmp dword [esi + 0x1dc], 1
je 0x41ff28
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc0]
mov eax, 1
mov dword [0x6633b8], eax
mov ecx, dword [esi + 0x1dc]
cmp ecx, eax
je 0x41ff4b
mov ecx, dword [esi + 0x1ec]
test ecx, ecx
je 0x41ff4b
call fcn.0048a970
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
push ebx
push edi
push eax
push ebp
mov ecx, esi
call dword [edx + pe_nt_image_headers32]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov edx, dword [esi]
push ebx
push edi
push 0x111
push ebp
mov ecx, esi
call dword [edx + 0xec]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
cmp eax, 0x212
ja 0x4200f9
je 0x4200d4
add eax, 0xfffffeee
cmp eax, 0xf8
ja case.0x41ffbe.279
xor ecx, ecx
mov cl, byte [eax + 0x42030c]
jmp dword [ecx*4 + 0x4202f4]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xd8]
jmp case.0x41ffbe.279
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi]
push ebx
push edi
push ecx
push ebp
mov ecx, esi
call dword [eax + 0xdc]
test eax, eax
jne 0x41fff5
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [0x663318]
test eax, eax
je case.0x41ffbe.279
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x420038
push 0
call dword [sym.imp.USER32.dll_SetCursor]
mov edx, dword [esi + 0x2c]
push 0
push 0xfffffffffffffff4
push edx
call dword [sym.imp.USER32.dll_SetClassLongA]
mov ecx, esi
call fcn.0041f910
mov dword [0x663318], 0
jmp case.0x41ffbe.279
mov eax, dword [esi + 0x200]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x663318], 0
jmp case.0x41ffbe.279
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
push ebx
push edi
push eax
push ebp
mov ecx, esi
call dword [edx + 0xe0]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
cmp edi, 0xf100
jne case.0x41ffbe.279
mov ecx, dword [esi + 0x28]
mov eax, dword [ecx + 0x894]
test eax, eax
je case.0x41ffbe.279
mov edx, dword [esi + 0x2c]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne case.0x41ffbe.279
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi]
push ebx
push edi
push ecx
push ebp
mov ecx, esi
call dword [eax + 0xfc]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov edx, dword [esi]
push ebx
push edi
push 0x212
push ebp
mov ecx, esi
call dword [edx + 0x100]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
cmp eax, 0x311
ja 0x420172
je 0x42014d
cmp eax, 0x218
je 0x420139
cmp eax, 0x30f
jne case.0x41ffbe.279
mov eax, dword [esi]
push ebx
push edi
push 0x30f
push ebp
mov ecx, esi
call dword [eax + 0x10c]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
test edi, edi
jne case.0x41ffbe.279
pop edi
pop esi
pop ebp
mov eax, 0x424d5144
pop ebx
ret 0x14
mov edx, dword [esi]
push ebx
push edi
push 0x311
push ebp
mov ecx, esi
call dword [edx + 0x108]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
sub eax, 0x3b9
je 0x4201a7
sub eax, 0x47
jne case.0x41ffbe.279
mov eax, dword [esi]
push ebx
push edi
push 0x400
push ebp
mov ecx, esi
call dword [eax + 0xe8]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov edx, dword [esi]
push ebx
push edi
push 0x3b9
push ebp
mov ecx, esi
call dword [edx + 0xf0]
test eax, eax
jne case.0x41ffbe.279
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14