Function at 0x402a90
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x40
mov dword [esp], 0x34
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
jne 0x402d01
mov dword [esp], 0x35
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
je 0x402ad2
mov edi, dword [0x40c018]
test edi, edi
jne 0x402c74
mov dword [esp], 0x36
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
je 0x402af4
mov esi, dword [0x40c018]
test esi, esi
jne 0x402c50
mov dword [esp], 0x11
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
je 0x402b20
mov dword [esp], 0x30
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
jne 0x402c28
mov dword [esp], 0x30
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
jne 0x402c10
mov dword [esp], 0x6b
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
je 0x402ef0
mov esi, dword [0x40c018]
test esi, esi
je 0x402b90
xor esi, esi
test ebx, ebx
jne 0x402b90
mov esi, dword [0x40c01c]
test esi, esi
jne 0x402f40
mov eax, dword [0x40c00c]
mov esi, 1
lea edx, [eax - 1]
cmp edx, 0x4e
ja 0x402b90
add eax, 1
mov ebx, 1
mov dword [0x40c00c], eax
lea esi, [esi]
mov dword [esp], 0x6d
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
je 0x402d80
mov eax, dword [0x40c018]
test eax, eax
jne 0x402bd0
cmp dword [0x4191e0], 1
je 0x402da5
test ebx, ebx
jne 0x402ccf
add esp, 0x40
pop ebx
pop esi
pop edi
ret
test ebx, ebx
jne 0x402cc0
mov esi, dword [0x40c01c]
test esi, esi
jne 0x402ca0
mov eax, dword [0x40c00c]
lea edx, [eax - 2]
cmp edx, 0x4e
ja 0x402f65
sub eax, 1
mov esi, 1
mov ebx, 1
mov dword [0x40c00c], eax
jmp 0x402bb1
mov dword [esp], 0x11
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
je 0x402b38
test ebx, ebx
jne 0x402b38
mov edx, dword [0x40c018]
xor eax, eax
mov ebx, 1
test edx, edx
sete al
mov dword [0x40c018], eax
jmp 0x402b38
test ebx, ebx
jne 0x402af4
mov ecx, dword [0x40c014]
xor eax, eax
mov ebx, 1
test ecx, ecx
sete al
mov dword [0x40c014], eax
jmp 0x402af4
test ebx, ebx
jne 0x402ad2
mov ebx, dword [0x40c01c]
test ebx, ebx
je 0x402ad2
mov dword [0x40c01c], 0
mov ebx, 1
jmp 0x402ad2
cmp esi, 1
jne 0x402f7b
mov eax, dword [0x40c010]
sub eax, 1
cmp eax, 0x11
ja 0x402bb1
mov dword [0x40c010], eax
nop
mov ebx, dword [0x4191e0]
cmp ebx, 1
je 0x402da5
call fcn.004028f0
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
sub esp, 4
test esi, esi
jne 0x402bc6
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
sub esp, 4
add esp, 0x40
pop ebx
pop esi
pop edi
ret
mov ecx, dword [0x40c008]
xor eax, eax
mov dword [esp], 0x419c20
test ecx, ecx
sete al
mov dword [0x40c008], eax
call sub.USER32.dll_GetCursorPos
mov eax, dword [0x419c24]
sub esp, 4
mov dword [0x4191e8], 0
mov dword [0x4191e4], 0
mov dword [esp + 4], eax
mov eax, dword [0x419c20]
mov dword [esp], eax
call sub.USER32.dll_SetCursorPos
sub esp, 8
jmp 0x402d5e
cmp dword [0x419c28], 1
je 0x402f10
mov dword [esp], 0x419c28
call fcn.00401510
test eax, eax
jne 0x402d51
mov ebx, 1
jmp 0x402ab0
mov dword [esp], 0xbd
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
jne 0x402ba8
cmp dword [0x4191e0], 1
jne 0x402bbe
mov eax, dword [0x419c4c]
lea edi, [esp + 0x3c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], edi
add eax, 0xa43590
mov dword [esp + 4], eax
mov eax, dword [0x419c48]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadProcessMemory
fld dword [0x40d674]
sub esp, 0x14
fld dword [esp + 0x3c]
fucomp st(1)
fnstsw ax
sahf
ja 0x40304e
fstp st(0)
mov eax, dword [0x419c4c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], edi
add eax, 0xa4368c
mov dword [esp + 4], eax
mov eax, dword [0x419c48]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadProcessMemory
sub esp, 0x14
cmp dword [esp + 0x3c], 0x4b
jg 0x40300b
mov eax, dword [0x419c4c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], edi
add eax, 0xa4368e
mov dword [esp + 4], eax
mov eax, dword [0x419c48]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadProcessMemory
sub esp, 0x14
cmp dword [esp + 0x3c], 0x1e
jg 0x402fc8
mov eax, dword [0x419c4c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], edi
add eax, 0xa43692
mov dword [esp + 4], eax
mov eax, dword [0x419c48]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadProcessMemory
sub esp, 0x14
cmp dword [esp + 0x3c], 0xf
jg 0x402f85
mov eax, dword [0x419c4c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], edi
mov dword [esp + 0x3c], 0
add eax, 0xa43688
mov dword [esp + 4], eax
mov eax, dword [0x419c48]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteProcessMemory
sub esp, 0x14
jmp 0x402bbe
mov dword [esp], 0xbb
xor esi, esi
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
test ax, ax
je 0x402b90
jmp 0x402b50
mov edx, dword [0x419c30]
mov eax, dword [0x419c34]
test edx, edx
jne 0x402f30
add dword [0x4191e8], eax
jmp 0x402d5e
add dword [0x4191e4], eax
jmp 0x402d5e
cmp esi, 1
jne 0x402f71
mov eax, dword [0x40c010]
cmp eax, 0x11
ja 0x402b90
add eax, 1
mov ebx, 1
mov dword [0x40c010], eax
jmp 0x402b90
mov ebx, esi
mov esi, 1
jmp 0x402bb1
mov esi, 1
jmp 0x402b90
mov esi, 1
jmp 0x402bb1
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 0x38], 0xf
mov dword [esp + 8], eax
mov eax, dword [0x419c4c]
add eax, 0xa43692
mov dword [esp + 4], eax
mov eax, dword [0x419c48]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteProcessMemory
sub esp, 0x14
jmp 0x402ea9
lea eax, [esp + 0x34]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 0x34], 0x1e
mov dword [esp + 8], eax
mov eax, dword [0x419c4c]
add eax, 0xa4368e
mov dword [esp + 4], eax
mov eax, dword [0x419c48]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteProcessMemory
sub esp, 0x14
jmp 0x402e6c
lea eax, [esp + 0x30]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 0x30], 0x4b
mov dword [esp + 8], eax
mov eax, dword [0x419c4c]
add eax, 0xa4368c
mov dword [esp + 4], eax
mov eax, dword [0x419c48]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteProcessMemory
sub esp, 0x14
jmp 0x402e2f
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
fstp dword [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [0x419c4c]
add eax, 0xa43590
mov dword [esp + 4], eax
mov eax, dword [0x419c48]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteProcessMemory
sub esp, 0x14
jmp 0x402df2