Function at 0x40aac0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x28]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x34]
cmp ebp, 0x11f
ja 0x40af44
cmp ebp, 0x11f
je 0x40af1c
cmp ebp, 0x100
ja 0x40ac33
je 0x40ab77
lea eax, [ebp - 5]
cmp eax, 0x1b
ja case.default.0x40af65
xor ecx, ecx
mov cl, byte [eax + 0x40b2d4]
jmp dword [ecx*4 + 0x40b2c0]
mov ecx, edi
call fcn.0040bae0
jmp case.default.0x40af65
cmp dx, 1
jne case.default.0x40af65
push 0
mov ecx, edi
call fcn.0040b930
test eax, eax
je case.default.0x40af65
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 0x10
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ebp
push ecx
call dword [edi + 0x15bc]
mov ecx, edi
mov esi, eax
call fcn.004200a0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor esi, esi
call ebx
test ax, ax
jge 0x40ab8d
mov esi, 1
push 0x11
call ebx
test ax, ax
jge 0x40ab99
or esi, 2
mov ecx, dword [esp + 0x34]
xor eax, eax
xor edx, edx
mov dl, byte [eax + str.___.]
cmp ecx, edx
je 0x40abb3
inc eax
cmp eax, 0x13
jb 0x40ab9f
jmp 0x40abc9
inc eax
push esi
push eax
mov ecx, edi
call fcn.004233c0
test eax, eax
jne case.default.0x40af65
mov ecx, dword [esp + 0x34]
lea eax, [ecx - 0xd]
cmp eax, 0x1a
ja case.default.0x40af65
xor ecx, ecx
mov cl, byte [eax + 0x40b304]
jmp dword [ecx*4 + 0x40b2f0]
mov ecx, edi
call fcn.0041ff10
jmp case.default.0x40af65
mov edx, dword [edi + 0x30]
mov ecx, edi
dec edx
push edx
call fcn.00420070
jmp case.default.0x40af65
mov eax, dword [edi + 0x30]
mov ecx, edi
inc eax
push eax
call fcn.00420070
jmp case.default.0x40af65
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x40ac27
push 1
mov ecx, edi
call fcn.0041e050
jmp case.default.0x40af65
mov ecx, edi
call fcn.0041e090
jmp case.default.0x40af65
mov eax, ebp
sub eax, 0x102
je 0x40aef2
sub eax, 0xf
je 0x40acf3
sub eax, 2
jne case.default.0x40af65
mov eax, ecx
dec eax
je 0x40ac6c
sub eax, 2
jne case.default.0x40af65
mov ecx, edi
call fcn.004231c0
jmp case.default.0x40af65
mov eax, dword [edi + 0x1520]
test eax, eax
jne 0x40acde
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, dword [esp + 0x2c]
cmp esi, eax
jne 0x40acd5
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jl 0x40acd5
cmp eax, dword [esp + 0x20]
jg 0x40acd5
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jl 0x40acd5
cmp eax, dword [esp + 0x24]
jle 0x40acde
push 1
mov ecx, edi
call fcn.0041f850
push 1
mov ecx, edi
call fcn.00422af0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov eax, ecx
and eax, 0xffff
cmp eax, 0x4e4a
jg 0x40ae21
je 0x40ae15
add eax, 0xffffb1c7
cmp eax, 0x10
ja case.default.0x40af65
xor ecx, ecx
mov cl, byte [eax + 0x40b344]
jmp dword [ecx*4 + 0x40b320]
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x40ad44
push 1
mov ecx, edi
call fcn.0041e050
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, edi
call fcn.0041e090
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [edi + 0x1490]
xor edx, edx
test ecx, ecx
sete dl
push 2
mov ecx, edi
mov dword [edi + 0x1490], edx
mov dword [edi + 0x1494], 0
call fcn.0041ff40
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
push 0
push 0x8000
mov ecx, edi
call fcn.0041fd60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
push 0
push 0x20000
mov ecx, edi
call fcn.0041fd60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, edi
call fcn.0041ff10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [edi + 0x30]
mov ecx, edi
inc eax
push eax
call fcn.00420070
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [edi + 0x30]
dec ecx
push ecx
mov ecx, edi
call fcn.00420070
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
push 0
mov ecx, edi
call fcn.00420070
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
lea edx, [edi + 0x15dc]
push edx
jmp 0x40ad8b
cmp eax, 0xe122
jg 0x40aead
je 0x40ae9d
cmp eax, 0x4e4e
jg 0x40ae82
je 0x40ae6f
sub eax, 0x4e4b
je 0x40ae56
dec eax
jne case.default.0x40af65
call fcn.00408b20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [edi + 0x44]
xor eax, eax
test ecx, ecx
sete al
mov dword [edi + 0x44], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, edi
call fcn.0041fe80
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
cmp eax, 0xe120
jne case.default.0x40af65
push 0
push 7
mov ecx, edi
call fcn.004233c0
jmp case.default.0x40af65
push 0
push 0xa
mov ecx, edi
call fcn.004233c0
jmp case.default.0x40af65
sub eax, 0xe123
je 0x40aee2
sub eax, 2
je 0x40aed2
sub eax, 5
jne case.default.0x40af65
push 0
push 0xc
mov ecx, edi
call fcn.004233c0
jmp case.default.0x40af65
push 0
push 0xb
mov ecx, edi
call fcn.004233c0
jmp case.default.0x40af65
push 0
push 9
mov ecx, edi
call fcn.004233c0
jmp case.default.0x40af65
cmp ecx, 9
je case.default.0x40af65
cmp ecx, 0xd
je case.default.0x40af65
cmp ecx, 8
je case.default.0x40af65
push 0
push ecx
mov ecx, edi
call fcn.004233c0
jmp case.default.0x40af65
mov eax, ecx
shr eax, 0x10
test al, 0x10
je case.default.0x40af65
and ecx, 0xffff
push ecx
push edx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
mov ecx, edi
call fcn.0040a860
jmp case.default.0x40af65
cmp ebp, 0x215
ja 0x40b1cb
je 0x40b1b0
lea eax, [ebp - 0x200]
cmp eax, 4
ja case.default.0x40af65
jmp dword [eax*4 + 0x40b358]
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
movsx edx, ax
shr eax, 0x10
movsx eax, ax
push ecx
mov ecx, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.0041f6e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [edi + 0x15c4]
test eax, eax
je 0x40afb7
push 1
mov ecx, edi
call fcn.0040b930
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
movsx edx, ax
shr eax, 0x10
mov dword [esp + 0x10], edx
and ecx, 1
movsx eax, ax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x1c], eax
call fcn.0041f500
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 0x38]
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ecx
push eax
mov ecx, edi
mov dword [esp + 0x18], edx
call fcn.0041f7d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [edi + 0x5d0]
mov ebp, 1
test eax, eax
je 0x40b033
mov ebp, dword [esp + 0x38]
mov ebx, 0x79
jmp 0x40b066
mov eax, dword [edi + 0x4c]
mov ebx, 0x74
test eax, eax
jne 0x40b066
mov eax, dword [edi + 0xac]
test eax, eax
je 0x40b066
mov eax, dword [edi + 0x14a0]
test eax, eax
jne 0x40b057
xor ebp, ebp
jmp 0x40b066
mov edx, dword [edi + 0x48]
xor ecx, ecx
cmp edx, ebp
setle cl
add ecx, 2
mov ebp, ecx
mov eax, dword [edi + 0x15d0]
mov edx, ebx
and edx, 0xffff
push edx
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push 0
push eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
cmp bx, 0x74
mov esi, eax
jne 0x40b148
mov ebx, dword [sym.imp.USER32.dll_DeleteMenu]
cmp ebp, 1
je 0x40b0aa
push 0
push 0x4e4d
push esi
call ebx
cmp ebp, 2
je 0x40b0f5
push 0x400
push 9
push esi
call ebx
push 0x400
push 6
push esi
call ebx
push 0
push 0x4e47
push esi
call ebx
push 0
push 0x4e4b
push esi
call ebx
push 0
push 0x4e39
push esi
call ebx
push 0
push 0x4e48
push esi
call ebx
push 0
push 0x4e49
push esi
call ebx
cmp ebp, 1
je 0x40b0fe
test ebp, ebp
jne 0x40b148
push 0x400
push 4
push esi
call ebx
push 0
push 0x4e3c
push esi
call ebx
push 0
push 0x4e42
push esi
call ebx
push 0
push 0x4e4e
push esi
call ebx
push 0
push 0x4e3e
push esi
call ebx
push 0
push 0x4e4a
push esi
call ebx
test ebp, ebp
jne 0x40b148
push 0x400
push 1
push esi
call ebx
push esi
mov ecx, edi
call fcn.0040a860
mov eax, dword [esp + 0x38]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [esp + 0x10], ecx
mov dword [edi + 0x15dc], ecx
mov dword [edi + 0x15e0], eax
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
push ecx
push edi
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push edi
push 0
push edx
push eax
push 2
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.USER32.dll_DestroyMenu]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov esi, dword [edi + 0x15d4]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, esi
je case.default.0x40af65
push 0
mov ecx, edi
call fcn.0041f850
jmp case.default.0x40af65
mov eax, ebp
sub eax, 0x30f
je 0x40b24b
sub eax, 2
je 0x40b1f9
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ebp
push ecx
call dword [edi + 0x15bc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
cmp eax, edi
je case.0x40ab0f.7
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
call fcn.0040bd30
call fcn.0040bdc0
mov ebx, dword [sym.imp.GDI32.dll_SelectPalette]
push 0
push eax
push esi
call ebx
push esi
mov ebp, eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 1
push ebp
push esi
call ebx
push esi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
call fcn.0040bc60
mov ebx, eax
test ebx, ebx
je case.0x40ab0f.7
mov ebp, dword [esp + 0x2c]
push ebp
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
mov esi, eax
push 0
push ebx
push esi
call edi
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
call fcn.0040bd30
call fcn.0040bdc0
push 0
push eax
push esi
call edi
push esi
call dword [sym.imp.GDI32.dll_RealizePalette]
mov edx, dword [esp + 0x38]
push 1
push edx
push esi
call edi
push esi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 0x10