Function at 0x408f30
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545e68
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5ad6a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x1c], esp
mov esi, esp
push eax
mov dword [ebp - 4], 1
call fcn.00401220
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov esi, esp
push eax
mov byte [ebp - 4], 2
call fcn.00401220
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [ebp - 4], 1
call fcn.00403800
add esp, 8
or ebx, 0xffffffff
test eax, eax
jns 0x40929b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0040d71d
mov ecx, dword [eax + 4]
cmp dword [ecx + 0xe0], 0
je 0x409328
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4093c0
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [ebp - 0x18], eax
call fcn.0040b6c7
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
je 0x409207
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x14]
push 0x5581b8
push eax
mov byte [ebp - 4], 3
call fcn.00402d70
mov esi, dword [ebp - 0x14]
add esp, 0xc
lea ebx, [esi - 0x10]
push edi
push ecx
mov ecx, dword [ebx]
mov dword [ebp - 0x1c], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
mov ecx, eax
jl 0x409049
cmp ecx, dword [ebx]
jne 0x409049
mov edi, ebx
mov eax, 1
lock xadd dword [edx], eax
jmp 0x409085
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov edi, eax
test edi, edi
je 0x409211
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
mov ecx, dword [ebx + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0052b8a5
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
lea eax, [edi + 0x10]
mov dword [ecx], eax
call fcn.00405020
add esp, 8
mov edi, eax
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp edi, 2
je 0x409305
cmp edi, 7
je 0x409216
mov edi, dword [ebp + 0xc]
push ecx
mov ecx, dword [edi - 0x10]
add edi, 0xfffffff0
mov eax, dword [ecx]
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x18], esp
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x4090e1
cmp ecx, dword [edi]
jne 0x4090e1
mov eax, 1
lock xadd dword [edx], eax
jmp 0x409123
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x1c], edx
test edx, edx
je 0x409211
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.0052b8a5
mov edi, dword [ebp - 0x1c]
add esp, 0x10
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 0x10]
mov dword [ecx], eax
mov edi, dword [ebp + 8]
push ecx
mov ecx, dword [edi - 0x10]
add edi, 0xfffffff0
mov eax, dword [ecx]
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], esp
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x40915b
cmp ecx, dword [edi]
jne 0x40915b
mov eax, 1
lock xadd dword [edx], eax
jmp 0x40919d
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x1c], edx
test edx, edx
je 0x409211
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.0052b8a5
mov edi, dword [ebp - 0x1c]
add esp, 0x10
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 0x10]
mov dword [ecx], eax
mov byte [ebp - 4], 3
call fcn.00403800
add esp, 8
test eax, eax
je 0x40927b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov byte [ebp - 4], 1
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4091dc
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4093c0
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [ebp - 0x18], eax
call fcn.0040b6c7
mov edi, dword [ebp - 0x10]
mov edx, eax
test edx, edx
jne 0x408ff8
push 0x80004005
call fcn.00401200
call fcn.00401640
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov edi, esp
push eax
call fcn.00401220
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp - 0x10]
add esp, 4
mov ecx, edi
call fcn.00409730
cmp eax, 1
jne 0x40925d
push edi
push ecx
mov eax, esp
lea ecx, [ebp + 0xc]
push ecx
push 0x55826c
push eax
call fcn.00402410
add esp, 0xc
call fcn.004041e0
jmp 0x409278
test eax, eax
jne 0x4092f4
push eax
push ecx
mov ecx, esp
push 0x55829c
call fcn.00401ed0
call fcn.00404f00
add esp, 8
add esi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 1
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40929b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4092bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp + 0xc]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4092de
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401110
or ebx, 0xffffffff
jmp 0x409328
add esi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 1
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409325
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x10]
push ecx
mov ecx, esp
push 0x5582cc
call fcn.00401ed0
mov ecx, edi
call fcn.00409910
or esi, 0xffffffff
jmp 0x40929d