Function at 0x403232
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor ebx, ebx
push 0x13
mov byte [esp + 0x17], bl
call esi
test ah, 0x80
jne 0x403259
push 0x91
call esi
test ah, 0x80
je 0x40325f
mov dword [0x405a70], ebx
cmp dword [0x405a70], ebx
je 0x403590
mov eax, dword [0x405a78]
mov edx, dword [0x405a6c]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, dword [sym.imp.USER32.dll_mouse_event]
lea ecx, [eax + eax*4]
lea ecx, [edx + ecx*4]
mov edx, dword [ecx]
cmp edx, 0x100
jb 0x40340d
mov ebp, 0x101
cmp edx, ebp
jbe 0x4033b2
mov ebp, 0x200
cmp edx, ebp
je 0x403344
jbe 0x40340d
cmp edx, 0x202
jbe 0x403311
cmp edx, 0x203
jbe 0x40340d
cmp edx, 0x205
ja 0x40340d
xor eax, eax
cmp edx, 0x204
setne al
dec eax
push ebx
and al, 0xf8
push ebx
push ebx
add eax, 0x10
push ebx
push eax
call edi
mov eax, dword [0x405a78]
mov edx, dword [0x405a6c]
lea ecx, [eax + eax*4]
cmp dword [edx + ecx*4], 0x201
sete cl
mov byte [0x405ca8], cl
jmp 0x40340d
mov ebp, 0x201
mov byte [0x405ca9], 1
xor eax, eax
cmp dword [ecx], ebp
push ebx
push ebx
setne al
dec eax
push ebx
and al, 0xfe
push ebx
add eax, 4
push eax
call edi
mov eax, dword [0x405a78]
mov edx, dword [0x405a6c]
lea ecx, [eax + eax*4]
cmp dword [edx + ecx*4], ebp
jmp 0x403303
push ebx
push ebx
push 1
call esi
mov edx, dword [0x405a6c]
mov ecx, eax
mov eax, dword [0x405a78]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 8]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push ebx
call esi
mov edx, dword [0x405a6c]
mov ecx, eax
mov eax, dword [0x405a78]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 4]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push 0x8001
call edi
mov eax, dword [0x405a78]
mov ecx, dword [0x405a6c]
lea eax, [eax + eax*4]
push dword [ecx + eax*4 + 8]
lea eax, [ecx + eax*4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x403408
mov cl, byte [ecx + 4]
cmp cl, 0xa0
mov byte [esp + 0x14], cl
je 0x40340d
cmp edx, ebp
jne 0x4033c7
push 2
pop edx
jmp 0x4033c9
xor edx, edx
cmp cl, 0x21
jb 0x4033d3
cmp cl, 0x2e
jbe 0x4033eb
cmp cl, 0x11
je 0x4033eb
cmp cl, 0x5b
je 0x4033eb
cmp cl, 0x5c
je 0x4033eb
cmp cl, 0x5d
je 0x4033eb
xor eax, eax
jmp 0x4033ee
push 1
pop eax
or eax, edx
push ebx
push eax
push ebx
movzx eax, cl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [0x405a78]
push dword [0x405a6c]
inc eax
mov dword [0x405a78], eax
call fcn.004037bf
pop ecx
xor edx, edx
push 0x14
pop ecx
div ecx
mov ecx, dword [0x405a78]
cmp ecx, eax
jae 0x403561
mov edx, dword [0x405a6c]
lea eax, [ecx + ecx*4]
cmp dword [edx + eax*4], ebx
lea ebp, [edx + eax*4]
je 0x403561
mov dl, byte [0x405caa]
cmp dl, 0x63
jb 0x403543
cmp byte [0x405ca8], bl
jne 0x403525
mov edx, dword [0x405a6c]
lea eax, [ecx + ecx*4]
cmp dword [edx + eax*4], 0x200
jne 0x403525
push 6
mov eax, ecx
xor edx, edx
pop ebp
div ebp
test edx, edx
je 0x40349a
mov edx, dword [0x405a6c]
lea eax, [ecx + ecx*4 + 5]
cmp dword [edx + eax*4], 0x200
je 0x403519
push ebx
push ebx
push 1
call esi
mov edx, dword [0x405a6c]
mov ecx, eax
mov eax, dword [0x405a78]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 8]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push ebx
call esi
mov edx, dword [0x405a6c]
mov ecx, eax
mov eax, dword [0x405a78]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 4]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push 0x8001
call edi
mov eax, dword [0x405a78]
mov ecx, dword [0x405a6c]
lea eax, [eax + eax*4]
push dword [ecx + eax*4 + 8]
lea eax, [ecx + eax*4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursorPos]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x405a78]
mov byte [esp + 0x13], 1
inc ecx
mov dword [0x405a78], ecx
jmp 0x403458
mov al, byte [esp + 0x13]
push ebx
neg al
sbb eax, eax
and eax, 0x4a
inc eax
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x403590
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
cmp dl, 1
jne 0x403552
add eax, eax
jmp 0x40355e
cmp dl, 2
jb 0x40355e
movzx ecx, dl
xor edx, edx
div ecx
push ebx
jmp 0x403532
cmp byte [0x405ca9], bl
je 0x403578
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [0x405a70]
push ebx
push eax
push 0x111
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 8