Function at 0x40adf0
Capabilities:
Hide graphical window
Log keystrokes
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, ecx
push edi
mov edi, eax
cmp ebx, 0x100
jb 0x40ae43
test edi, edi
je 0x40ae43
push 0x11
call esi
shr eax, 0xf
test al, 1
jne 0x40ae43
push 0x12
call esi
shr eax, 0xf
test al, 1
jne 0x40ae43
sar edi, 0x10
push 1
and edi, 0xff
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x40ae43
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_IsCharUpperW]
test eax, eax
je 0x40ae5b
movzx edx, bx
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
movzx ebx, ax
mov eax, dword [ebp + 0x328]
cmp eax, 2
je 0x40b620
cmp eax, 3
je 0x40b620
lea eax, [ebx - 9]
cmp eax, 0x69
ja case.0x40ae86.10
movzx eax, byte [eax + 0x40b648]
jmp dword [eax*4 + 0x40b634]
mov eax, dword [ebp + 0x378]
test eax, eax
je 0x40aeb6
push 0xffffffffffffffff
push eax
mov byte [ebp + 0x37c], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp + 0x37c], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov esi, dword [ebp + 0x36c]
mov edi, 3
mov ecx, esi
call fcn.004474c0
test eax, eax
jne 0x40b07c
mov eax, dword [ebp + 0x328]
test eax, eax
je 0x40aee8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp fcn.0040a7e0
mov ecx, dword [0x9f48bc]
cmp byte [ecx + 4], 0
je 0x40b039
cmp dword [0x9f43ec], 0
mov edx, dword [0x9e8478]
je 0x40af27
xor eax, eax
test edx, edx
je 0x40af27
mov ecx, dword [0x9e8484]
cmp dword [ecx + eax*4], ebp
je 0x40af1f
inc eax
cmp eax, edx
jb 0x40af13
jmp 0x40af27
test eax, eax
je case.0x40b0db.9
cmp dword [ebp + 0x370], 0
je 0x40af6b
cmp byte [ebp + 0x374], 0
jne 0x40af6b
call fcn.00402910
or eax, 0x34
push eax
mov eax, str.Printing_in_progress.
call fcn.0044a3e0
push eax
mov eax, str.Printing_is_still_in_progress._Abort_and_quit_
call fcn.0044a3e0
mov edx, dword [ebp + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je case.0x40b0db.9
mov ecx, dword [ebp + 4]
test ecx, ecx
je 0x40af99
mov eax, dword [ecx]
mov edx, dword [eax + 0x78]
call edx
test eax, eax
je 0x40af99
mov ecx, dword [ebp + 4]
test ecx, ecx
je 0x40af91
mov eax, dword [ecx]
mov edx, dword [eax + 0x78]
call edx
mov byte [eax + 0x24], 1
jmp 0x40afca
xor eax, eax
mov byte [eax + 0x24], 1
jmp 0x40afca
mov ecx, dword [ebp + 4]
test ecx, ecx
je 0x40afca
mov eax, dword [ecx]
mov edx, dword [eax + 0x80]
call edx
test eax, eax
je 0x40afca
mov ecx, dword [ebp + 4]
test ecx, ecx
je 0x40afc1
mov eax, dword [ecx]
mov edx, dword [eax + 0x80]
call edx
jmp 0x40afc3
xor eax, eax
mov byte [eax + 0xb4], 0
cmp dword [ebp + 0x328], 0
je 0x40afda
mov ecx, ebp
call fcn.0040a5c0
cmp dword [0x9e8478], 1
sete al
mov byte [esp + 0x1c], al
test al, al
je 0x40afff
mov eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00445cc0
jmp 0x40b006
mov esi, ebp
call fcn.004027b0
mov ebx, ebp
call fcn.00433c20
mov esi, dword [ebp + 8]
mov edi, ebp
call fcn.00405260
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp byte [esp + 0x1c], 0
je case.0x40b0db.9
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp byte [ebp + 0x324], 0
je 0x40b050
mov ecx, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp fcn.0040a5c0
cmp byte [ebp + 0x160], 0
je 0x40b068
mov esi, ebp
call fcn.00424860
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, 4
mov ecx, esi
call fcn.004474c0
test eax, eax
je case.0x40b0db.9
mov ebx, edi
call fcn.004474f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 1
push ebp
call fcn.004070b0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 0
push ebp
call fcn.00404aa0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, ebp
call fcn.0040a860
mov ecx, dword [ebp + 4]
xor edi, edi
cmp ecx, edi
je case.0x40b0db.9
add ebx, 0xfffffff8
cmp ebx, 0xdc
ja case.0x40b0db.9
movzx edx, byte [ebx + 0x40b6fc]
jmp dword [edx*4 + 0x40b6b4]
push edi
push edi
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
neg eax
sbb eax, eax
add eax, 0x22
push eax
mov eax, ebp
call fcn.0040a9e0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 0x10
call esi
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov edx, dword [edx + 0x20]
shr eax, 0xf
and al, 1
mov eax, edi
setne al
lea eax, [eax + eax - 1]
push eax
call edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp fcn.0040a2b0
push 0x11
call esi
push 0x10
shr eax, 0xf
and al, 1
mov bl, al
call esi
mov ecx, dword [ebp + 4]
shr eax, 0xf
and al, 1
mov byte [esp + 0x1c], al
test ecx, ecx
je case.0x40b0db.9
mov eax, dword [ecx]
mov edx, dword [eax + 0x78]
call edx
mov ecx, dword [ebp + 4]
mov esi, eax
test ecx, ecx
je 0x40b179
mov eax, dword [ecx]
mov edx, dword [eax + 0x7c]
call edx
jmp 0x40b17b
xor eax, eax
test eax, eax
setne al
test bl, bl
setne cl
test cl, cl
je 0x40b1e8
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_GetScrollPos]
push 1
push eax
call esi
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [edx + 0x34]
push 0
call eax
fld dword [0x9adb1c]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x40b1c7
mov ecx, dword [ebp + 0xc]
push 0
push 3
push 0x115
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp + 0xc]
push 1
push edx
call esi
cmp eax, edi
jne case.0x40b0db.9
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x68]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp edx
test al, al
je 0x40b209
push 0
push 0x28
push 0x100
mov eax, ebp
call fcn.00401a90
call fcn.00447e40
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [ebp + 0x328]
cmp eax, 2
je case.0x40b0db.9
cmp eax, 3
je case.0x40b0db.9
test esi, esi
je 0x40b257
mov eax, dword [esi + 0x48]
cmp eax, dword [esi + 0x50]
jge 0x40b257
movzx ecx, byte [esp + 0x1c]
neg ecx
sbb ecx, ecx
and ecx, 0x401
inc ecx
mov edx, dword [ebp + 0xc]
push 0
push ecx
push 0x115
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x68]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp edx
push 0x11
call esi
push 0x10
shr eax, 0xf
and al, 1
mov bl, al
call esi
mov ecx, dword [ebp + 4]
shr eax, 0xf
and al, 1
mov byte [esp + 0x1c], al
test ecx, ecx
je case.0x40b0db.9
mov eax, dword [ecx]
mov edx, dword [eax + 0x78]
call edx
mov ecx, dword [ebp + 4]
mov esi, eax
test ecx, ecx
je 0x40b2a4
mov eax, dword [ecx]
mov edx, dword [eax + 0x7c]
call edx
jmp 0x40b2a6
xor eax, eax
test eax, eax
setne al
test bl, bl
setne cl
test cl, cl
je 0x40b319
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_GetScrollPos]
push 1
push eax
call esi
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [edx + 0x34]
push 0
call eax
fld dword [0x9adb1c]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x40b2f2
mov ecx, dword [ebp + 0xc]
push 0
push 2
push 0x115
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp + 0xc]
push 1
push edx
call esi
cmp eax, edi
jne case.0x40b0db.9
mov ebp, dword [ebp + 4]
mov eax, dword [ebp]
mov edx, dword [eax + 0x6c]
push 1
mov ecx, ebp
call edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
test al, al
je 0x40b326
push 0
push 0x26
jmp 0x40b1f0
mov eax, dword [ebp + 0x328]
cmp eax, 2
je case.0x40b0db.9
cmp eax, 3
je case.0x40b0db.9
test esi, esi
je 0x40b302
mov eax, dword [esi + 0x48]
cmp eax, dword [esi + 0x50]
jge 0x40b302
movzx ecx, byte [esp + 0x1c]
neg ecx
sbb ecx, ecx
and ecx, 0x401
jmp 0x40b23d
mov eax, dword [ecx]
mov edx, dword [eax + 0x68]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp edx
mov eax, dword [ecx]
mov edx, dword [eax + 0x6c]
push edi
call edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov esi, ebp
call fcn.0043d980
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
fld dword [0x9adb08]
mov eax, dword [ecx]
mov edx, dword [eax + 0x38]
push edi
push edi
push ecx
fstp dword [esp]
call edx
push ecx
fstp dword [esp]
push ebp
call fcn.0042c430
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
fld dword [0x9adb18]
jmp 0x40b391
cmp byte [0x9f43f4], 0
jne 0x40b3cb
mov eax, ebp
call fcn.00424350
mov byte [0x9f43f4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp fcn.00409ce0
mov eax, ebp
call fcn.00401a70
test eax, eax
je 0x40b4ec
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
call edx
call fcn.004013c0
test al, al
jne 0x40b4ec
push 0x10
call esi
mov ecx, dword [ebp + 4]
shr eax, 0xf
not al
and al, 1
mov bl, al
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
mov edi, eax
mov eax, ebp
call fcn.00401a70
test bl, bl
je 0x40b49e
call fcn.00441ce0
test al, al
jne case.0x40b0db.9
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
mov esi, 3
call edx
call fcn.00401400
test al, al
je 0x40b45c
mov esi, 2
push esi
mov dl, 1
mov eax, ebp
call fcn.00401f80
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
add esp, 4
call edx
test bl, bl
je 0x40b4cd
cmp edi, eax
jl case.0x40b0db.9
cmp edi, 1
jg 0x40b48d
cmp esi, 3
jne case.0x40b0db.9
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x68]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp edx
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
mov ecx, esi
call edx
cmp eax, 3
je 0x40b4b3
cmp eax, 6
jne 0x40b43f
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
mov ecx, esi
call edx
cmp eax, 1
jne 0x40b43f
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp edi, eax
jg case.0x40b0db.9
mov ebp, dword [ebp + 4]
mov eax, dword [ebp]
mov edx, dword [eax + 0x6c]
push 0
mov ecx, ebp
call edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, ebp
call fcn.00401ab0
test eax, eax
je case.0x40b0db.46
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
call edx
call fcn.004013c0
test al, al
jne case.0x40b0db.46
push 0x10
call esi
mov ecx, dword [ebp + 4]
shr eax, 0xf
not al
and al, 1
mov bl, al
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov esi, eax
xor eax, eax
test bl, bl
setne al
lea esi, [esi + eax*2 - 1]
mov eax, dword [edx + 0x64]
push esi
call eax
test al, al
je case.0x40b0db.9
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
push 0
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [ebp + 0x328], edi
je case.0x40b0db.9
mov eax, 2
mov esi, ebp
call fcn.00401ad0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [ebp + 0x328], edi
je case.0x40b0db.9
mov eax, 3
mov esi, ebp
call fcn.00401ad0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, ebp
call fcn.00401a70
test eax, eax
je case.0x40b0db.9
mov ecx, dword [0x9f48bc]
cmp byte [ecx + 0xa8], 0
je 0x40b5c6
cmp byte [ebp + 0x324], 0
jne 0x40b5c6
cmp dword [ebp + 0x328], 1
jne case.0x40b0db.9
push edi
or eax, 0xffffffff
mov ecx, ebp
call fcn.00405d50
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, ebp
call fcn.00401a70
test eax, eax
je case.0x40b0db.9
mov edx, dword [ebp + 0xc]
push edx
lea esi, [esp + 0x14]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call fcn.00451d30
add esp, 4
test al, al
je case.0x40b0db.9
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push edi
mov eax, ebp
call fcn.00406030
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, 1
mov esi, ebp
call fcn.00401ad0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret