Function at 0x409e80
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov eax, dword [esi + 0x308]
cmp eax, 2
je 0x40a3a1
cmp eax, 3
je 0x40a3a1
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp edi, 0x100
jb 0x409eee
cmp dword [ebp + 8], 0
je 0x409eee
push 0x11
call ebx
shr eax, 0xf
test al, 1
jne 0x409eee
push 0x12
call ebx
shr eax, 0xf
test al, 1
jne 0x409eee
mov eax, dword [ebp + 8]
sar eax, 0x10
push 1
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x409eee
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsCharUpperW]
test eax, eax
je 0x409f17
xor eax, eax
mov word [esp + 0x10], di
mov word [esp + 0x12], ax
lea eax, [esp + 0x10]
push 1
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
movzx edi, word [esp + 0x10]
lea eax, [edi - 9]
cmp eax, 0x69
ja case.0x409f2a.10
movzx eax, byte [eax + 0x40a3c4]
jmp dword [eax*4 + 0x40a3b0]
mov eax, dword [esi + 0x34c]
test eax, eax
je 0x409f59
push 0xffffffffffffffff
push eax
mov byte [esi + 0x350], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [esi + 0x350], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esi + 0x340]
mov ecx, edi
push 3
call fcn.00484fc0
mov ecx, edi
test eax, eax
je 0x409f7c
push 3
call fcn.00485000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 4
call fcn.00484fc0
mov ecx, edi
test eax, eax
je 0x409f97
push 4
call fcn.00485000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
call fcn.00484fc0
test eax, eax
je 0x409fb2
push 5
mov ecx, edi
call fcn.00485000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0x14c], 0
je 0x409fd4
mov dl, 1
mov ecx, esi
call fcn.0045bf30
push 0
mov ecx, esi
call fcn.0046b610
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x56be3c]
cmp byte [eax + 4], 0
je 0x409fff
mov ecx, esi
call fcn.00406440
test al, al
je 0x409fff
push 0
mov dl, 1
mov ecx, esi
call fcn.004064d0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x308]
test eax, eax
jne 0x40a017
cmp byte [esi + 0x304], al
je case.0x40a06f.9
test eax, eax
setne dl
mov ecx, esi
call fcn.00409800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dl, 1
mov ecx, esi
call fcn.004063d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor dl, dl
mov ecx, esi
call fcn.00403e40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.004098e0
mov ecx, dword [esi]
test ecx, ecx
je case.0x40a06f.9
add edi, 0xfffffff8
cmp edi, 0xdc
ja case.0x40a06f.9
movzx eax, byte [edi + 0x40a478]
jmp dword [eax*4 + 0x40a430]
push 0
push 0
push 0x10
call ebx
shr eax, 0xf
mov ecx, esi
and al, 1
movzx edx, al
neg edx
sbb edx, edx
add edx, 0x22
call fcn.00409a70
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
call ebx
mov ecx, dword [esi]
shr eax, 0xf
and al, 1
mov eax, 0
mov edx, dword [ecx]
setne al
lea eax, [eax*2 - 1]
push eax
call dword [edx + 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00409350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
mov edx, 0x28
mov ecx, esi
call fcn.00409a70
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
mov edx, 0x26
mov ecx, esi
call fcn.00409a70
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00467860
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
fld dword [0x55ddb0]
mov eax, dword [ecx]
push 0
push ecx
fstp dword [esp]
mov eax, dword [eax + 0x38]
call eax
push ecx
xor dl, dl
mov ecx, esi
fstp dword [esp]
call fcn.0045c5a0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
fld dword [0x55dcec]
jmp 0x40a11b
cmp byte [0x56b082], 0
jne 0x40a157
mov ecx, esi
call fcn.0045d3a0
mov byte [0x56b082], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00409040
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
call dword [eax + 0x78]
test eax, eax
je 0x40a27a
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x28]
cmp eax, 1
je 0x40a27a
cmp eax, 4
je 0x40a27a
push 0x10
call ebx
mov ecx, dword [esi]
mov bx, ax
shr ebx, 0xf
not bl
mov edx, dword [ecx]
call dword [edx + 0x14]
mov ecx, dword [esi]
mov dword [esp + 0x10], eax
and bl, 1
je 0x40a1d5
test ecx, ecx
je 0x40a1c2
mov edx, dword [ecx]
call dword [edx + 0x78]
jmp 0x40a1c4
xor eax, eax
mov ecx, eax
call fcn.00479790
test al, al
jne case.0x40a06f.9
jmp 0x40a205
test ecx, ecx
je 0x40a1e2
mov eax, dword [ecx]
call dword [eax + 0x78]
mov edi, eax
jmp 0x40a1e4
xor edi, edi
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x28]
cmp eax, 3
je 0x40a1f5
cmp eax, 6
jne 0x40a205
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
cmp eax, 1
je case.0x40a06f.9
mov ecx, dword [esi]
mov edi, 3
mov eax, dword [ecx]
call dword [eax + 0x28]
cmp eax, edi
je 0x40a21a
cmp eax, 6
jne 0x40a21f
mov edi, 2
push 1
mov edx, edi
mov ecx, esi
call fcn.00401b10
mov ecx, dword [esi]
add esp, 4
mov eax, dword [ecx]
call dword [eax + 0x14]
test bl, bl
je 0x40a260
mov ecx, dword [esp + 0x10]
cmp ecx, eax
jl case.0x40a06f.9
cmp ecx, 1
jg 0x40a252
cmp edi, 3
jne case.0x40a06f.9
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x68]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x10], eax
jg case.0x40a06f.9
mov ecx, dword [esi]
mov eax, dword [ecx]
push 0
call dword [eax + 0x6c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi]
test ecx, ecx
je case.0x40a06f.46
mov eax, dword [ecx]
call dword [eax + 0x80]
test eax, eax
je case.0x40a06f.46
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x28]
cmp eax, 1
je case.0x40a06f.46
cmp eax, 4
je case.0x40a06f.46
push 0x10
call ebx
mov ecx, dword [esi]
movzx ebx, ax
shr ebx, 0xf
not bl
mov edx, dword [ecx]
call dword [edx + 0x14]
xor ecx, ecx
mov edi, eax
and bl, 1
setne cl
lea edi, [edi + ecx*2]
mov ecx, dword [esi]
dec edi
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x64]
call eax
test al, al
je case.0x40a06f.9
mov ecx, dword [esi]
push 0
push edi
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x308], 0
je case.0x40a06f.9
push 2
mov ecx, esi
call fcn.00467700
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x308], 0
je case.0x40a06f.9
push 3
mov ecx, esi
call fcn.00467700
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
call dword [eax + 0x78]
test eax, eax
je case.0x40a06f.9
mov eax, dword [0x56be3c]
cmp byte [eax + 0xa8], 0
je 0x40a348
cmp byte [esi + 0x304], 0
jne 0x40a348
cmp dword [esi + 0x308], 1
jne case.0x40a06f.9
push 0xffffffffffffffff
xor edx, edx
mov ecx, esi
call fcn.00405030
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
call dword [eax + 0x78]
test eax, eax
je case.0x40a06f.9
mov ecx, dword [esi + 0x60]
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.004178a0
test al, al
je case.0x40a06f.9
push dword [esp + 0x14]
xor edx, edx
mov ecx, esi
push dword [esp + 0x14]
call fcn.00405330
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
call fcn.00467700
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret