Function at 0x40ea70
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d7f68
push eax
mov dword fs:[0], esp
sub esp, 0x17c
push ebx
push esi
push edi
mov edi, ecx
mov eax, 0x2000
xor esi, esi
test word [edi + 0x4148], ax
je 0x40eabe
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
mov byte [ebp - 0xd], 1
cmp ax, dx
je 0x40eac2
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x34]
call fcn.004bc8c0
lea eax, [ebp - 0x34]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.004b69a0
add esp, 8
test eax, eax
jl 0x40eaf6
lea ecx, [ebp - 0x34]
call fcn.004bc9d0
mov ecx, eax
call fcn.004bcc80
mov ebx, eax
mov dword [ebp - 0x28], ebx
cmp ebx, esi
jne 0x40eb07
mov ecx, 0xc3ff
and word [edi + 0x4148], cx
jmp 0x40ee26
mov ecx, ebx
call fcn.00488460
mov dword [ebp - 0x38], eax
movzx eax, word [edi + 0x4148]
push 0
push 1
lea edx, [ebp - 0x88]
push edx
and eax, 0x1400
push eax
mov ecx, ebx
call fcn.00488fc0
test eax, eax
je 0x40ee26
xor ebx, ebx
mov edx, 0x400
mov ecx, 1
mov word [ebp - 0x24], cx
mov dword [ebp - 0x14], 0x128
mov word [ebp - 0x1a], bx
test word [edi + 0x4148], dx
je 0x40ec19
mov ax, word [ebp + 8]
mov ecx, dword [ebp - 0x38]
movsx esi, ax
lea edx, [ecx - 0xd]
cmp esi, edx
jl 0x40eb86
movsx eax, word [edi + 0x4152]
add ecx, 0xfffffff4
cmp ecx, eax
jle 0x40eb82
mov ax, cx
mov word [ebp + 8], ax
mov cx, word [ebp + 0xa]
mov word [edi + 0x4154], cx
movzx ecx, word [edi + 0x4152]
cmp ax, cx
jge 0x40ebd9
movsx edx, ax
movsx esi, cx
mov ebx, 0x25
sub esi, edx
mov word [edi + 0x4152], ax
mov word [ebp - 0x1a], bx
xor eax, eax
jmp 0x40ebc0
movzx ecx, word [eax + str.CtrlLeft]
mov word [ebp + eax - 0x78], cx
add eax, 2
test cx, cx
jne 0x40ebc0
jmp 0x40ecc7
jle 0x40ee26
movsx esi, ax
movsx ecx, cx
mov ebx, 0x27
sub esi, ecx
mov word [edi + 0x4152], ax
mov word [ebp - 0x1a], bx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.CtrlRight]
mov word [ebp + eax - 0x78], cx
add eax, 2
test cx, cx
jne 0x40ec00
jmp 0x40ecc7
movzx ecx, word [edi + 0x4154]
mov ax, word [ebp + 0xa]
cmp ax, cx
mov dx, word [ebp + 8]
mov word [edi + 0x4152], dx
jge 0x40ec73
movsx esi, cx
movsx ecx, ax
sub esi, ecx
cmp byte [ebp - 0xd], 0
mov ebx, 0x26
mov word [ebp - 0x1a], bx
mov word [edi + 0x4154], ax
mov ecx, str.CtrlShiftUp
jne 0x40ec5c
mov ecx, str.CtrlUp
lea edx, [ebp - 0x78]
nop
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x40ec60
jmp 0x40ecb1
jle 0x40ecb1
movsx edx, cx
movsx esi, ax
mov ebx, 0x28
sub esi, edx
cmp byte [ebp - 0xd], 0
mov word [ebp - 0x1a], bx
mov word [edi + 0x4154], ax
mov ecx, str.CtrlShiftDown
jne 0x40ec9d
mov ecx, str.CtrlDown
lea edx, [ebp - 0x78]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x40eca0
cmp byte [ebp - 0xd], 0
je 0x40ecbe
mov dword [ebp - 0x14], 0x138
test bx, bx
je 0x40ee26
mov eax, dword [0x52fe30]
cmp byte [eax + 0x1128f], 2
jne 0x40edd7
mov ebx, dword [ebp - 0x28]
push 1
mov ecx, ebx
call fcn.00489030
test al, al
je 0x40ee26
mov ecx, dword [ebp + 8]
mov dword [edi + 0x4152], ecx
mov edx, 0x40
mov ecx, ebx
mov word [ebp - 0x188], dx
call fcn.0048cde0
test al, al
je 0x40ed6f
cmp esi, 1
jle 0x40ed41
lea eax, [ebp - 0x78]
push eax
push esi
lea ecx, [ebp - 0x186]
push str.for_RCounter__i_1__1_do_Keys___s___end
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea eax, [ebp - 0x188]
push eax
mov ecx, ebx
call fcn.0048ce20
jmp 0x40ee26
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0x186]
push str.Keys___s__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
lea eax, [ebp - 0x188]
push eax
mov ecx, ebx
call fcn.0048ce20
jmp 0x40ee26
cmp esi, 1
jle 0x40eda3
lea ecx, [ebp - 0x78]
push ecx
push esi
lea edx, [ebp - 0x186]
push str._Rep___i___s__End
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea eax, [ebp - 0x188]
push eax
mov ecx, ebx
call fcn.0048ce20
jmp 0x40ee26
xor eax, eax
jmp 0x40edb0
movzx ecx, word [ebp + eax - 0x78]
mov word [ebp + eax - 0x186], cx
add eax, 2
test cx, cx
jne 0x40edb0
push 0
lea eax, [ebp - 0x188]
push eax
mov ecx, ebx
call fcn.0048ce20
jmp 0x40ee26
movzx ecx, bx
push 0
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [ebp - 0x1c], si
mov esi, dword [ebp - 0x28]
push 0
lea edx, [ebp - 0x24]
push edx
mov ecx, esi
mov word [ebp - 0x18], ax
mov dword [ebp - 0x20], 1
call fcn.0048d7e0
push 0
lea ecx, [ebp - 0x24]
mov eax, 1
push ecx
mov ecx, esi
mov dword [ebp - 0x20], 0
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x14], 0x120
call fcn.0048d7e0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.004bc960
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4