Function at 0x403154
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor ebx, ebx
push 0x13
mov byte [esp + 0x17], bl
call esi
test ah, 0x80
jne 0x40317b
push 0x91
call esi
test ah, 0x80
je 0x403181
mov dword [0x4057b8], ebx
cmp dword [0x4057b8], ebx
je 0x4034a6
mov ecx, dword [0x4057c0]
mov esi, dword [0x4057b4]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, 0x200
lea eax, [ecx + ecx*4]
lea ebp, [esi + eax*4]
mov eax, dword [esi + eax*4]
cmp eax, 0x100
jb 0x403323
cmp eax, 0x101
jbe 0x4032be
cmp eax, edx
je 0x40324c
jbe 0x403323
cmp eax, 0x202
jbe 0x40322c
cmp eax, 0x203
jbe 0x403323
cmp eax, 0x205
ja 0x403323
xor ecx, ecx
cmp eax, 0x204
setne cl
dec ecx
push ebx
and ecx, 0xfffffff8
push ebx
push ebx
add ecx, 0x10
push ebx
push ecx
call dword [sym.imp.USER32.dll_mouse_event]
mov ecx, dword [0x4057c0]
mov esi, dword [0x4057b4]
lea eax, [ecx + ecx*4]
cmp dword [esi + eax*4], 0x201
sete byte [0x4059ec]
jmp 0x403323
mov byte [0x4059ed], 1
xor eax, eax
cmp dword [ebp], 0x201
push ebx
push ebx
push ebx
setne al
dec eax
push ebx
and al, 0xfe
add eax, 4
push eax
jmp 0x403204
push ebx
push ebx
push 1
call edi
mov edx, dword [0x4057b4]
mov ecx, eax
mov eax, dword [0x4057c0]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 8]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push ebx
call edi
mov edx, dword [0x4057b4]
mov ecx, eax
mov eax, dword [0x4057c0]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 4]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push 0x8001
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [0x4057c0]
mov ecx, dword [0x4057b4]
lea eax, [eax + eax*4]
push dword [ecx + eax*4 + 8]
lea eax, [ecx + eax*4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x403317
mov dl, byte [ebp + 4]
cmp dl, 0xa0
mov byte [esp + 0x14], dl
je 0x403323
cmp eax, 0x101
jne 0x4032d6
push 2
pop ecx
jmp 0x4032d8
xor ecx, ecx
cmp dl, 0x21
jb 0x4032e2
cmp dl, 0x2e
jbe 0x4032fa
cmp dl, 0x11
je 0x4032fa
cmp dl, 0x5b
je 0x4032fa
cmp dl, 0x5c
je 0x4032fa
cmp dl, 0x5d
je 0x4032fa
xor eax, eax
jmp 0x4032fd
push 1
pop eax
or eax, ecx
push ebx
push eax
push ebx
movzx eax, dl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_keybd_event]
mov esi, dword [0x4057b4]
mov ecx, dword [0x4057c0]
inc ecx
cmp esi, ebx
mov dword [0x4057c0], ecx
je 0x403343
push esi
call fcn.00403744
mov esi, dword [0x4057b4]
pop ecx
mov ecx, dword [0x4057c0]
jmp 0x403345
xor eax, eax
push 0x14
xor edx, edx
pop ebp
div ebp
cmp ecx, eax
jae 0x403477
lea eax, [ecx + ecx*4]
cmp dword [esi + eax*4], ebx
lea ebp, [esi + eax*4]
je 0x403477
mov al, byte [0x4059ee]
cmp al, 1
jne 0x40345d
cmp byte [0x4059ec], bl
jne 0x40343f
lea eax, [ecx + ecx*4]
cmp dword [esi + eax*4], 0x200
jne 0x40343f
push 6
mov eax, ecx
xor edx, edx
pop ebp
div ebp
test edx, edx
je 0x4033aa
lea eax, [ecx + ecx*4 + 5]
cmp dword [esi + eax*4], 0x200
je 0x403433
push ebx
push ebx
push 1
call edi
mov edx, dword [0x4057b4]
mov ecx, eax
mov eax, dword [0x4057c0]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 8]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push ebx
call edi
mov edx, dword [0x4057b4]
mov ecx, eax
mov eax, dword [0x4057c0]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 4]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push 0x8001
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [0x4057c0]
mov ecx, dword [0x4057b4]
lea eax, [eax + eax*4]
push dword [ecx + eax*4 + 8]
lea eax, [ecx + eax*4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursorPos]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x4057b4]
mov ecx, dword [0x4057c0]
mov byte [esp + 0x13], 1
inc ecx
mov dword [0x4057c0], ecx
jmp 0x403370
mov al, byte [esp + 0x13]
push ebx
neg al
sbb eax, eax
and eax, 0x4a
inc eax
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4034a6
mov ecx, dword [ebp + 0xc]
push ebx
sub ecx, dword [ebp - 8]
movzx eax, al
inc eax
neg eax
sbb eax, eax
and al, 0xfc
add eax, 5
imul ecx, eax
push ecx
jmp 0x40344d
cmp byte [0x4059ed], bl
je 0x40348e
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [0x4057b8]
push ebx
push eax
push 0x111
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 8