Function at 0x406bb4
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x40a020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
mov eax, 0xa2
push eax
xor ebx, ebx
call esi
xor edi, edi
mov ecx, 0x8000
inc edi
test cx, ax
je 0x406beb
mov ebx, edi
mov eax, 0xa3
push eax
call esi
mov ecx, 0x8000
push 2
pop edx
test cx, ax
je 0x406c02
or ebx, edx
mov eax, 0xa4
push eax
call esi
mov ecx, 0x8000
test cx, ax
je 0x406c17
or ebx, 4
mov eax, 0xa5
push eax
call esi
mov ecx, 0x8000
test cx, ax
je 0x406c2c
or ebx, 8
mov eax, 0xa0
push eax
call esi
mov ecx, 0x8000
test cx, ax
je 0x406c41
or ebx, 0x10
mov eax, 0xa1
push eax
call esi
mov ecx, 0x8000
test cx, ax
je 0x406c56
or ebx, 0x20
and dword [ebp - reloc.ADVAPI32.dll_EventWrite], 0
push 0x1bc
lea eax, reloc.ADVAPI32.dll_EventWrite
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor ecx, ecx
push 2
pop edx
test bl, 1
je 0x406c97
mov eax, 0xa2
mov dword [ebp - reloc.ADVAPI32.dll_EventWrite], edi
mov word [ebp - 0x1c0], ax
mov dword [ebp - reloc.ADVAPI32.dll_EventWrite], edx
mov ecx, edi
push 3
pop esi
test bl, 2
je 0x406cc3
mov eax, ecx
imul eax, eax, 0x1c
mov edx, 0xa3
push 2
mov word [ebp + eax - 0x1c0], dx
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edi
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], esi
inc ecx
pop edx
test bl, 4
je 0x406cec
mov eax, ecx
imul eax, eax, 0x1c
mov esi, 0xa4
push 3
mov word [ebp + eax - 0x1c0], si
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edi
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edx
inc ecx
pop esi
test bl, 8
je 0x406d15
mov eax, ecx
imul eax, eax, 0x1c
mov edx, 0xa5
push 2
mov word [ebp + eax - 0x1c0], dx
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edi
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], esi
inc ecx
pop edx
test bl, 0x10
je 0x406d3b
mov eax, ecx
imul eax, eax, 0x1c
mov esi, 0xa0
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edi
mov word [ebp + eax - 0x1c0], si
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edx
inc ecx
test bl, 0x20
je 0x406d61
mov eax, ecx
imul eax, eax, 0x1c
mov esi, 0xa1
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edi
mov word [ebp + eax - 0x1c0], si
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edx
inc ecx
mov eax, ecx
imul eax, eax, 0x1c
and dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], 0
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edi
push 0x5b
pop esi
mov word [ebp + eax - 0x1c0], si
lea eax, [ecx + 1]
imul eax, eax, 0x1c
and dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], 0
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edi
push 0x55
pop edx
mov word [ebp + eax - 0x1c0], dx
lea eax, [ecx + 2]
imul eax, eax, 0x1c
mov word [ebp + eax - 0x1c0], dx
push 2
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edi
pop edx
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edx
lea eax, [ecx + 3]
imul eax, eax, 0x1c
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edi
mov word [ebp + eax - 0x1c0], si
mov dword [ebp + eax - reloc.ADVAPI32.dll_EventWrite], edx
push 0x1c
lea eax, reloc.ADVAPI32.dll_EventWrite
push eax
lea eax, [ecx + 4]
push eax
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040838b
leave
ret