Function at 0x40cfd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4edba8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x10]
mov esi, ecx
mov ecx, dword [edi + 0xc]
mov edx, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
cmp edx, 0x200
ja 0x40d142
je 0x40d0ed
sub edx, 0x51
cmp edx, 0xbe
ja case.0x40d15b.515
movzx edx, byte [edx + 0x40d43c]
jmp dword [edx*4 + 0x40d428]
cmp eax, 0x100
jne 0x40d08f
cmp ecx, 0x56
je 0x40d05f
cmp ecx, 0x76
jne 0x40d08f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x40d087
mov eax, dword [esi + 0xe8]
shr eax, 5
test al, 1
jne 0x40d087
mov eax, esi
call fcn.0040cf90
mov al, 1
jmp 0x40d406
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp ecx, 0xd
jne 0x40d0a6
push esi
push 0
push 0x72
call fcn.0040fec0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 0x250]
test edx, edx
je case.0x40d047.257
push ebx
push ecx
push eax
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x18]
push ebx
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [edi + 0x14]
push ecx
mov eax, esi
call fcn.0040c7d0
dec eax
neg eax
sbb eax, eax
neg eax
jmp 0x40d406
push ebx
push ecx
push eax
lea edx, [edi + 0x14]
mov eax, esi
call fcn.0040c7d0
jmp 0x40d404
movsx edx, bx
shr ebx, 0x10
movsx ebx, bx
mov eax, esi
test esi, esi
je 0x40d10d
lea esp, [esp]
sub edx, dword [eax + 0x28]
sub ebx, dword [eax + 0x2c]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x40d100
cmp dword [esi + 0xdc], 0
je 0x40d13b
mov esi, dword [esi + 0xdc]
mov eax, dword [esi]
add edi, 0x14
push edi
movzx edi, bx
movzx edx, dx
shl edi, 0x10
or edi, edx
mov edx, dword [eax + 0xc]
push edi
push ecx
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, esi
call edx
mov al, 1
jmp 0x40d406
sub edx, 0x201
cmp edx, 0x85
ja case.0x40d15b.515
movzx edx, byte [edx + 0x40d514]
jmp dword [edx*4 + 0x40d4fc]
cmp eax, 0x102
jne 0x40d204
test byte [esi + 0xb9], 2
je 0x40d284
cmp ecx, 0x30
jb 0x40d184
cmp ecx, 0x39
jbe 0x40d18e
cmp ecx, 0x2e
je 0x40d197
jmp 0x40d404
cmp ecx, 0x2e
jne 0x40d284
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], eax
mov word [esp + 0x30], cx
lea edx, [esp + 0x2c]
push edx
push esi
mov dword [esp + 0x60], eax
call fcn.0040c800
cmp dword [esp + 0x40], 0
je 0x40d1f6
cmp dword [esp + 0x44], 8
mov eax, dword [esp + 0x30]
jae 0x40d1d1
lea eax, [esp + 0x30]
push 0x2e
push eax
call fcn.004c950c
add esp, 8
test eax, eax
jne 0x40d1f6
lea ecx, [esp + 0x2c]
mov dword [esp + 0x58], 0xffffffff
call fcn.004016f0
jmp 0x40d27c
lea ecx, [esp + 0x2c]
call fcn.004016f0
jmp 0x40d404
cmp eax, 0x10f
jne 0x40d284
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
mov ecx, esi
call edx
test eax, eax
je 0x40d221
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
jmp 0x40d229
mov dword [esp + 0x20], 0
mov ecx, dword [esp + 0x20]
push ecx
call sub.IMM32.dll_ImmGetContext
mov dword [esp + 0x1c], eax
test eax, eax
je 0x40d27c
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_GetCaretPos]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x2c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x34], 2
mov dword [esp + 0x3c], ecx
call sub.IMM32.dll_ImmSetCompositionWindow
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push ecx
push edx
call sub.IMM32.dll_ImmReleaseContext
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ebx
push ecx
lea edx, [edi + 0x14]
push eax
mov eax, esi
mov dword [esp + 0x28], edx
call fcn.0040c7d0
cmp dword [edi + 8], 0x286
jne 0x40d2b9
mov eax, dword [esi + 0x94]
mov edx, dword [eax + 0x98]
lea ecx, [esi + 0x94]
push 0
push 0x300
call edx
mov eax, dword [esp + 0x1c]
mov dword [eax], 0
jmp 0x40d404
mov eax, esi
call fcn.0040fc80
mov edx, ebx
mov eax, esi
add edi, 0x14
call fcn.0040d770
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
push ecx
push edx
mov edx, edi
mov eax, esi
call fcn.0040c7d0
mov al, 1
jmp 0x40d406
mov edx, ebx
mov eax, esi
add edi, 0x14
call fcn.0040d770
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
mov edx, edi
mov eax, esi
call fcn.0040c7d0
mov al, 1
jmp 0x40d406
mov edx, dword [esi]
mov eax, dword [edx + 0x60]
mov ecx, esi
call eax
mov al, 1
jmp 0x40d406
shr ecx, 0x10
movsx eax, cx
mov dword [esp + 0x20], eax
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cdq
xor eax, edx
sub eax, edx
test eax, eax
jle 0x40d39a
mov dword [esp + 0x1c], eax
cmp dword [esi + 0xdc], 0
je 0x40d393
mov eax, dword [esi + 0xdc]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
xor ecx, ecx
cmp dword [esp + 0x20], ecx
lea eax, [edi + 0x14]
setle cl
push eax
lea ecx, [ecx + ecx - 1]
push ecx
mov ecx, dword [esi + 0xdc]
push 0
push 0xb6
call edx
sub dword [esp + 0x1c], 1
jne 0x40d35e
mov esi, dword [esi + 0x250]
test esi, esi
je 0x40d3b6
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push ebx
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
jmp 0x40d406
lea edx, [eax - 0x200]
cmp edx, 0xe
ja 0x40d3d8
mov edx, ebx
mov eax, esi
call fcn.0040d770
mov ecx, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [esp + 0x14]
cmp dword [esi + 0xdc], 0
je 0x40d080
mov esi, dword [esi + 0xdc]
mov edx, dword [esi]
add edi, 0x14
push edi
push ebx
push ecx
push eax
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
cmp eax, 1
jne 0x40d080
xor al, al
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004c8f08
mov esp, ebp
pop ebp
ret 4