Function at 0x41dc21
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41dc28
call fcn.0047f360
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.0043d000
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 4]
call fcn.0043d000
mov dword [esp + 8], 0x1a4
mov dword [esp + 0xc], 0xa0
push dword [0x9d7d80]
call fcn.00465bc3
mov ebx, eax
push dword [0x9d7d80]
call fcn.00465fd3
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 8]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0x10], ebx
push dword [0x9d7d80]
call fcn.00465c32
mov ebx, eax
push dword [0x9d7d80]
call fcn.00466451
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 0xc]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0x14], ebx
push edx
call fcn.0047f1c0
pop edx
push eax
push reloc.WS2_32.dll_connect
mov edx, dword [0x9d7c48]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, dword [esp + 0xc]
push edx
call fcn.0047f200
call fcn.0047f2f0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x28]
push dword [esp + 0x28]
push 1
call fcn.0043d312
add dword [esp + 0x14], edx
call fcn.00465fe1
call fcn.0043d330
push dword [esp + 4]
push 0x50
push 0x17c
push 0xa
push 0xf
push 3
call fcn.00461d5d
push dword [0x9d7b7c]
push 0x1e
push 0x14a
push 0x6e
push 0x2d
push 7
call fcn.0045f321
call fcn.0042be6f
call fcn.00465ed2
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x41de6e
call fcn.00468fd4
push eax
mov ebx, 1
cmp ebx, dword [esp]
jne 0x41de6b
push dword [esp + 0x1c]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x41de6a
call fcn.00468fb6
push eax
mov ebx, 7
cmp ebx, dword [esp]
jne 0x41de69
push dword [esp + 0xc]
mov edx, str.0xC004F074
pop ecx
call fcn.0043d2c0
je 0x41ddee
mov eax, str.https:__msfree.su_viewtopic.php_p55p55
push eax
call fcn.00459d6c
jmp 0x41de64
push dword [esp + 0xc]
mov edx, str.0xC004F035
pop ecx
call fcn.0043d2c0
je 0x41de0c
mov eax, str.https:__msfree.su_viewtopic.php_p56p56
push eax
call fcn.00459d6c
jmp 0x41de64
push dword [esp + 0xc]
mov edx, str.0xC004E015
pop ecx
call fcn.0043d2c0
je 0x41de2a
mov eax, str.https:__msfree.su_viewtopic.php_p57p57
push eax
call fcn.00459d6c
jmp 0x41de64
push dword [esp + 0xc]
mov edx, str.0x80040154
pop ecx
call fcn.0043d2c0
je 0x41de48
mov eax, str.https:__msfree.su_viewtopic.php_p58p58
push eax
call fcn.00459d6c
jmp 0x41de64
push dword [esp + 0xc]
mov edx, str.0xC004F038
pop ecx
call fcn.0043d2c0
je 0x41de64
mov eax, str.https:__msfree.su_viewtopic.php_p65p65
push eax
call fcn.00459d6c
add esp, 0xc
jmp 0x41dec5
pop eax
pop eax
pop eax
jmp 0x41de78
push 1
call fcn.0046645f
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41de9c
call fcn.0046647d
mov ebx, eax
cmp ebx, 1
jne 0x41de9c
call fcn.0042be6f
jmp 0x41dec5
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41dec0
call fcn.0046647d
mov ebx, eax
cmp ebx, 1
jne 0x41dec0
call fcn.0042be6f
jmp 0x41dec5
jmp 0x41dd82
push 1
call fcn.00465851
xor eax, eax
push dword [esp]
call fcn.0047f3c0
push dword [esp + 4]
call fcn.0047f3c0
add esp, 0x1c
pop edi
pop ebx
ret 8