Function at 0x404020
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd10
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2dc], eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4042d0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x12
call sub.user32.dll_GetKeyState
shr ax, 8
test ax, ax
setne byte [ebp - 1]
push 0x11
call sub.user32.dll_GetKeyState
shr ax, 8
test ax, ax
setne bl
mov eax, esi
cmp eax, 0x61
jg 0x403f1a
je 0x403fd8
cmp eax, 0x26
jg 0x403f00
je 0x403f62
sub eax, 8
je 0x403f9b
add eax, 0xfffffff8
sub eax, 3
jb 0x403fb0
sub eax, 0xd
je 0x403fbc
sub eax, 5
je 0x403f4d
jmp case.default.0x403f26
sub eax, 0x27
je 0x403f77
dec eax
je 0x403f8c
sub eax, 0x38
je 0x403fca
jmp case.default.0x403f26
add eax, 0xffffff9e
cmp eax, 7
ja case.default.0x403f26
jmp dword [eax*4 + 0x403f2d]
push esi
mov esi, 0x4042e0
lea edi, [ebp - 0x1ca]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40407e
push esi
mov esi, 0x4042e4
lea edi, [ebp - 0x1ca]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40407e
push esi
mov esi, 0x4042e8
lea edi, [ebp - 0x1ca]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40407e
mov dword [ebp - 0x1ca], 0x4e574403
jmp 0x40407e
push esi
mov esi, 0x4042ec
lea edi, [ebp - 0x1ca]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40407e
mov byte [ebp - 0x1ca], 0
jmp 0x40407e
mov word [ebp - 0x1ca], 0x2001
jmp 0x40407e
mov word [ebp - 0x1ca], 0x3001
jmp 0x40407e
mov word [ebp - 0x1ca], 0x3101
jmp 0x40407e
mov word [ebp - 0x1ca], 0x3201
jmp 0x40407e
mov word [ebp - 0x1ca], 0x3301
jmp 0x40407e
mov word [ebp - 0x1ca], 0x3401
jmp 0x40407e
mov word [ebp - 0x1ca], 0x3501
jmp 0x40407e
mov word [ebp - 0x1ca], 0x3601
jmp 0x40407e
mov word [ebp - 0x1ca], 0x3701
jmp 0x40407e
mov word [ebp - 0x1ca], 0x3801
jmp 0x40407e
mov word [ebp - 0x1ca], 0x3901
jmp 0x40407e
lea eax, [ebp - 0xca]
xor ecx, ecx
mov edx, 0xc8
call fcn.004013f8
push 0xc8
lea eax, [ebp - 0xca]
push eax
mov eax, dword [ebp + 0x10]
push eax
call sub.user32.dll_GetKeyNameTextA
lea eax, [ebp - 0x1ca]
lea edx, [ebp - 0xca]
mov ecx, 0xc9
call fcn.00401430
mov eax, 0x40843c
lea edx, [ebp - 0x1ca]
call fcn.0040136c
cmp byte [ebp - 0x1ca], 1
jne 0x4040cc
cmp byte [ebp - 1], 0
jne 0x4040cc
test bl, bl
jne 0x4040cc
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 0x2ca]
push eax
call fcn.00403ddc
cmp byte [ebp - 0x2ca], 0
je 0x4040cc
lea eax, [ebp - 0x1ca]
lea edx, [ebp - 0x2ca]
call fcn.0040136c
cmp byte [ebp - 0x1ca], 0
je 0x404147
cmp byte [ebp - 1], 0
je 0x4040f2
push 1
lea edx, [ebp - 0x1ca]
mov ecx, 0xff
mov eax, 0x4042f0
call fcn.0040128c
test bl, bl
je 0x40410d
push 1
lea edx, [ebp - 0x1ca]
mov ecx, 0xff
mov eax, 0x4042f8
call fcn.0040128c
cmp byte [0x40843c], 1
seta al
or al, byte [ebp - 1]
jne 0x404120
test bl, bl
je 0x404147
push 0x10
call sub.user32.dll_GetKeyState
shr ax, 8
test ax, ax
je 0x404147
push 1
lea edx, [ebp - 0x1ca]
mov ecx, 0xff
mov eax, 0x404300
call fcn.0040128c
lea eax, [ebp - 0x1ca]
mov edx, 0x404308
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00401388
jne 0x4041c7
lea eax, [ebp - 0x2d4]
lea edx, [ebp - 0x1ca]
call fcn.00401b1c
push dword [ebp - 0x2d4]
push 0x404318
lea eax, [ebp - 0x2dc]
call fcn.00403cc4
mov eax, dword [ebp - 0x2dc]
lea ecx, [ebp - 0x2d8]
mov edx, 0xbe
call fcn.004037b8
push dword [ebp - 0x2d8]
lea eax, [ebp - 0x2d0]
mov edx, 3
call fcn.00401c38
mov edx, dword [ebp - 0x2d0]
lea eax, [ebp - 0x1ca]
mov ecx, 0xff
call fcn.00401b54
cmp byte [ebp - 0x1ca], 1
jbe 0x404219
push 0x404324
lea eax, [ebp - 0x2e4]
lea edx, [ebp - 0x1ca]
call fcn.00401b1c
push dword [ebp - 0x2e4]
push 0x404330
lea eax, [ebp - 0x2e0]
mov edx, 3
call fcn.00401c38
mov edx, dword [ebp - 0x2e0]
lea eax, [ebp - 0x1ca]
mov ecx, 0xff
call fcn.00401b54
jmp 0x404268
mov al, byte [ebp - 0x1c9]
sub al, 0x5c
je 0x40422b
sub al, 0x1f
je 0x40422b
sub al, 2
jne 0x404268
lea eax, [ebp - 0x2ec]
lea edx, [ebp - 0x1ca]
call fcn.00401b1c
mov ecx, dword [ebp - 0x2ec]
lea eax, [ebp - 0x2e8]
mov edx, 0x40433c
call fcn.00401bc4
mov edx, dword [ebp - 0x2e8]
lea eax, [ebp - 0x1ca]
mov ecx, 0xff
call fcn.00401b54
cmp esi, 0xd
jne 0x4042a4
lea eax, [ebp - 0x2f0]
lea edx, [ebp - 0x1ca]
call fcn.00401b1c
lea eax, [ebp - 0x2f0]
mov edx, 0x404348
call fcn.00401b80
mov edx, dword [ebp - 0x2f0]
lea eax, [ebp - 0x1ca]
mov ecx, 0xff
call fcn.00401b54
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x1ca]
call fcn.0040136c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4042d7
lea eax, [ebp - 0x2f0]
mov edx, 9
call fcn.00401920
ret