Function at 0x40f802
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, 0xd0d0d0d1
cmp dword [0x414330], 0
jne 0x40f9cf
cmp dword [ebp + 0xc], 0x112
jne 0x40fe66
mov eax, dword [ebp + 0x10]
and eax, 0xfff0
cmp eax, 0xf000
jne 0x40fe66
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x26
call sub.USER32.dll_SystemParametersInfoA
cmp dword [ebp - 0xc], 0
je 0x40fe66
mov dword [0x414330], 1
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [0x415dd8], eax
push 0x415dec
push dword [ebp + 8]
call sub.USER32.dll_GetWindowRect
push 0x415ddc
push dword [ebp + 8]
call sub.USER32.dll_GetWindowRect
and dword [0x415db0], 0
and dword [0x415db4], 0
push 0x3d
call sub.USER32.dll_GetSystemMetrics
mov dword [0x415db8], eax
push 0x3e
call sub.USER32.dll_GetSystemMetrics
mov dword [0x415dbc], eax
push 0xfffffffffffffff0
push dword [ebp + 8]
call sub.USER32.dll_GetWindowLongA
test eax, 0x800000
je 0x40f8d6
push 5
call sub.USER32.dll_GetSystemMetrics
mov dword [0x415dc0], eax
push 6
call sub.USER32.dll_GetSystemMetrics
mov dword [0x415dc4], eax
jmp 0x40f90e
push 0xffffffffffffffec
push dword [ebp + 8]
call sub.USER32.dll_GetWindowLongA
test ax, 0x100
je 0x40f900
push 0x2d
call sub.USER32.dll_GetSystemMetrics
mov dword [0x415dc0], eax
push 0x2e
call sub.USER32.dll_GetSystemMetrics
mov dword [0x415dc4], eax
jmp 0x40f90e
and dword [0x415dc0], 0
and dword [0x415dc4], 0
push 0x22
call sub.USER32.dll_GetSystemMetrics
mov dword [0x415dc8], eax
push 0x23
call sub.USER32.dll_GetSystemMetrics
mov dword [0x415dcc], eax
push 0x3b
call sub.USER32.dll_GetSystemMetrics
mov dword [0x415dd0], eax
push 0x3c
call sub.USER32.dll_GetSystemMetrics
mov dword [0x415dd4], eax
push 0x415db0
push 0
push 0x24
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
push 1
call sub.USER32.dll_GetKeyState
or ax, ax
jne 0x40f96c
push 0
push 1
push 0x201
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
push dword [ebp + 8]
call sub.USER32.dll_SetCapture
push 0
push 0
push 0x231
push dword [ebp + 8]
call sub.USER32.dll_PostMessageA
cmp dword [0x415dd8], 0
jne 0x40f9c1
mov dword [0x415e04], 1
push 0x415dfc
call sub.USER32.dll_GetCursorPos
push 0x8040
push 0
push 0
push 2
push 0x7f86
push 0
call sub.USER32.dll_LoadImageA
push eax
call sub.USER32.dll_SetCursor
jmp 0x40f9c8
and dword [0x415e04], 0
xor ebx, ebx
jmp 0x40fe66
cmp dword [ebp + 0xc], 0x200
jne 0x40fa61
and dword [0x415e04], 0
movzx eax, word [ebp + 0x14]
and eax, reloc.crypt32.dll_CertGetStoreProperty
movsx eax, ax
mov dword [ebp - 8], eax
mov edi, dword [ebp + 0x14]
shr edi, 0x10
and edi, reloc.crypt32.dll_CertGetStoreProperty
and edi, reloc.crypt32.dll_CertGetStoreProperty
movsx edi, di
mov dword [ebp - 4], edi
push 1
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
call sub.USER32.dll_MapWindowPoints
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0040fe6f
push 0x415dec
push dword [0x415dd8]
push 0x214
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
lea esi, [0x415dec]
sub esp, 0x10
mov edi, esp
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
push dword [ebp + 8]
call fcn.00410020
add esp, 0x1c
xor ebx, ebx
jmp 0x40fe66
cmp dword [ebp + 0xc], 0x100
jne 0x40fe24
mov eax, dword [ebp + 0x10]
cmp eax, 0x1b
je 0x40fad9
jg 0x40fa82
cmp eax, 0xd
je 0x40fa9b
jmp 0x40fe66
cmp eax, 0x25
jl 0x40fe66
cmp eax, 0x28
jg 0x40fe66
jmp dword [eax*4 + 0x4142a0]
call sub.USER32.dll_ReleaseCapture
push 0
push 0
push 0x232
push dword [ebp + 8]
call sub.USER32.dll_PostMessageA
and dword [0x414330], 0
cmp dword [0x415e04], 0
je 0x40fad2
push dword [0x415e00]
push dword [0x415dfc]
call sub.USER32.dll_SetCursorPos
xor ebx, ebx
jmp 0x40fe66
call sub.USER32.dll_ReleaseCapture
lea esi, [0x415ddc]
sub esp, 0x10
mov edi, esp
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
push dword [ebp + 8]
call fcn.00410020
add esp, 0x14
push 0
push 0
push 0x232
push dword [ebp + 8]
call sub.USER32.dll_PostMessageA
and dword [0x414330], 0
cmp dword [0x415e04], 0
je 0x40fb2d
push dword [0x415e00]
push dword [0x415dfc]
call sub.USER32.dll_SetCursorPos
xor ebx, ebx
jmp 0x40fe66
cmp dword [ebp + 0xc], 0x202
jne 0x40fe66
call sub.USER32.dll_ReleaseCapture
push 0
push 0
push 0x232
push dword [ebp + 8]
call sub.USER32.dll_PostMessageA
and dword [0x414330], 0
cmp dword [0x415e04], 0
je 0x40fe64
push dword [0x415e00]
push dword [0x415dfc]
call sub.USER32.dll_SetCursorPos
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x10