Function at 0x406dd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x471840]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 8]
movzx eax, byte [edx + 0x8d]
test eax, eax
jne 0x406e11
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx + 8]
call fcn.00425d20
jmp 0x407740
mov edx, dword [ebp - 0x4c]
cmp dword [edx + 0x164], 0xc8
jge 0x407740
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax + 0xaad]
test ecx, ecx
je 0x406e4e
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + 0x174]
call fcn.00436dc0
mov ecx, dword [ebp - 0x4c]
mov byte [ecx + 0xaad], al
jmp 0x407740
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx + 0x16c]
test eax, eax
jne 0x406e7c
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx + 0x16d]
test edx, edx
je 0x406e7c
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax + 0x16e]
test ecx, ecx
je 0x407691
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x144]
push eax
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx + 0x100]
call fcn.0040a280
mov edx, dword [ebp - 0x4c]
cmp dword [edx + 0x148], 1
jne 0x407675
push 0x7a
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
neg eax
sbb eax, eax
neg eax
je 0x406ed5
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx + 0xf1]
test edx, edx
je 0x406ed5
mov eax, dword [ebp - 0x4c]
mov dword [eax + 0x148], 0
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0x100]
push edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x144]
call fcn.00413610
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0x144]
push edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x100]
call fcn.0040bbd0
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx + 0x100]
call fcn.0040bb60
mov byte [0x472b88], 0
mov edx, dword [0x472c14]
mov eax, dword [edx + 0x144]
movzx ecx, byte [eax + 0x6b6]
test ecx, ecx
je 0x406f8b
push ecx
fld dword [0x472b8c]
fstp dword [esp]
push ecx
fld dword [0x472b9c]
fstp dword [esp]
push 1
mov edx, dword [0x472c14]
mov ecx, dword [edx + 0x144]
call fcn.00423fc0
mov eax, dword [0x472b84]
add eax, 1
mov dword [0x472b84], eax
cmp dword [0x472b84], 0x20
jle 0x406f8b
mov dword [0x472b84], 0
mov ecx, dword [0x472c14]
mov edx, dword [ecx + 0x144]
mov byte [edx + 0x6b6], 0
mov eax, dword [0x472c14]
mov ecx, dword [eax + 0x144]
movzx edx, byte [ecx + 0x6b7]
test edx, edx
je 0x40700d
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [0x472c14]
mov edx, dword [ecx + 0x144]
sub eax, dword [edx + 0x6bc]
cmp eax, 0x3e8
jbe 0x406fe8
push ecx
fld dword [0x472b90]
fstp dword [esp]
push ecx
fld dword [0x472b98]
fstp dword [esp]
push 2
mov eax, dword [0x472c14]
mov ecx, dword [eax + 0x144]
call fcn.00423fc0
jmp 0x40700d
mov ecx, dword [0x472c14]
mov edx, dword [ecx + 0x144]
mov byte [edx + 0x6b7], 0
mov eax, dword [0x472c14]
mov ecx, dword [eax + 0x144]
mov byte [ecx + 0x130], 0
mov dword [ebp - 0x18], 0
jmp 0x40701f
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x472c18]
jge 0x407185
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0xf4]
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], 5
ja case.default.0x407047
mov eax, dword [ebp - 0x50]
jmp dword [eax*4 + 0x407750]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0x144]
push edx
mov eax, dword [ebp - 0x18]
push ecx
fld dword [eax*4 + 0x470360]
fstp dword [esp]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + ecx*4 + 0x104]
call fcn.004407c0
jmp case.default.0x407047
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x144]
push ecx
mov edx, dword [ebp - 0x18]
push ecx
fld dword [edx*4 + 0x4703bc]
fstp dword [esp]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx + eax*4 + 0x104]
call fcn.004407c0
jmp case.default.0x407047
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x144]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
fld dword [ecx*4 + 0x47038c]
fstp dword [esp]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + edx*4 + 0x104]
call fcn.004407c0
jmp case.default.0x407047
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0x144]
push edx
mov eax, dword [ebp - 0x18]
push ecx
fld dword [eax*4 + 0x4703fc]
fstp dword [esp]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + ecx*4 + 0x104]
call fcn.004407c0
jmp case.default.0x407047
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x144]
push ecx
mov edx, dword [ebp - 0x18]
push ecx
fld dword [edx*4 + 0x470454]
fstp dword [esp]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx + eax*4 + 0x104]
call fcn.004407c0
jmp case.default.0x407047
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x144]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
fld dword [ecx*4 + 0x4704c4]
fstp dword [esp]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + edx*4 + 0x104]
call fcn.004407c0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + ecx*4 + 0x104]
add ecx, 0x380
call fcn.004087b0
test eax, eax
je 0x407180
mov byte [0x472b88], 1
jmp 0x407016
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax + 0x16]
mov edx, dword [ebp - 0x4c]
cmp dword [edx + 0xab0], ecx
je 0x40726f
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax + 0x16]
mov edx, dword [ebp - 0x4c]
mov dword [edx + 0xab0], ecx
mov eax, dword [ebp - 0x4c]
add eax, 0xc
push eax
mov ecx, dword [0x472c14]
mov edx, dword [ecx + 0x34]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.00404a10
add esp, 0xc
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
movzx ecx, word [ebp - 0x2e]
imul ecx, ecx, 0x5a0
movzx edx, word [ebp - 0x2c]
imul edx, edx, 0x3c
add ecx, edx
movzx eax, word [ebp - 0x2a]
add ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0x34]
movzx eax, byte [edx + 0x49]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
imul ecx, ecx, 0x5a0
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x1c]
jle 0x407244
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x40726f
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx + 0x170]
call fcn.0040c3f0
movzx edx, al
test edx, edx
jne 0x40726f
push 1
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x170]
call fcn.0040c410
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx + 0x170]
call fcn.0040c3f0
movzx edx, al
test edx, edx
je 0x407292
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x170]
call fcn.0040c2f0
push 5
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 4]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 0x10]
call eax
movzx ecx, al
test ecx, ecx
je 0x40731f
mov edx, dword [ebp - 0x4c]
mov byte [edx + 0xaac], 1
fld dword [0x471108]
fcomp qword [0x461210]
fnstsw ax
test ah, 0x41
jne 0x4072e0
fld dword [0x471108]
fsub qword [0x461250]
fstp dword [0x471108]
jmp 0x4072e8
fldz
fstp dword [0x471108]
mov dword [0x472b80], 0
push 1
fld dword [0x471108]
fmul qword [0x461278]
call fcn.0044e7e0
push eax
push 0x940
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 4]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x54]
call edx
push 4
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 4]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x10]
call edx
movzx eax, al
test eax, eax
je 0x4073a2
mov ecx, dword [ebp - 0x4c]
mov byte [ecx + 0xaac], 1
fld dword [0x471108]
fcomp qword [0x4613f8]
fnstsw ax
test ah, 5
jp 0x40736b
fld dword [0x471108]
fadd qword [0x461250]
fstp dword [0x471108]
mov dword [0x472b80], 0
push 1
fld dword [0x471108]
fmul qword [0x461278]
call fcn.0044e7e0
push eax
push 0x940
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 4]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x54]
call ecx
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx + 0xaac]
test eax, eax
je 0x407526
mov ecx, dword [0x472b80]
add ecx, 1
mov dword [0x472b80], ecx
cmp dword [0x472b80], 0x1e
jae 0x407512
push ecx
fld dword [0x472c30]
fstp dword [esp]
push ecx
fld dword [0x472c2c]
fstp dword [esp]
push ecx
fldz
fstp dword [esp]
fld dword [0x472c30]
fmul qword [0x4611f0]
fstp dword [ebp - 0x54]
fld dword [ebp - 0x54]
push ecx
fstp dword [esp]
fld dword [0x472c2c]
fmul qword [0x4611f8]
fstp dword [ebp - 0x58]
fld dword [ebp - 0x58]
push ecx
fstp dword [esp]
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x60]
mov ecx, dword [eax + 0x3fc]
call fcn.004494f0
push ecx
fld dword [0x472c30]
fstp dword [esp]
push ecx
fld dword [0x472c2c]
fstp dword [esp]
push ecx
fldz
fstp dword [esp]
fld dword [0x472c30]
fmul qword [0x4613f0]
fstp dword [ebp - 0x5c]
fld dword [ebp - 0x5c]
push ecx
fstp dword [esp]
fld dword [0x472c2c]
fmul qword [0x4611f8]
fstp dword [ebp - 0x60]
fld dword [ebp - 0x60]
push ecx
fstp dword [esp]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0x60]
mov ecx, dword [edx + 0x400]
call fcn.004494f0
fldz
fstp dword [ebp - 0x38]
jmp 0x407491
fld dword [ebp - 0x38]
fadd qword [0x461250]
fstp dword [ebp - 0x38]
fld dword [ebp - 0x38]
fld dword [0x471108]
fcompp
fnstsw ax
test ah, 0x41
jne 0x407510
push ecx
fld dword [0x472c30]
fstp dword [esp]
push ecx
fld dword [0x472c30]
fstp dword [esp]
push ecx
fldz
fstp dword [esp]
fld dword [0x472c30]
fmul qword [0x4613e8]
fstp dword [ebp - 0x64]
fld dword [ebp - 0x64]
push ecx
fstp dword [esp]
fld dword [0x472c2c]
fmul qword [0x4613e0]
fld dword [ebp - 0x38]
fmul qword [0x461340]
fmul dword [0x472c2c]
faddp st(1)
fstp dword [ebp - 0x68]
fld dword [ebp - 0x68]
push ecx
fstp dword [esp]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x60]
mov ecx, dword [ecx + 0x404]
call fcn.004494f0
jmp 0x407485
jmp 0x407526
mov edx, dword [ebp - 0x4c]
mov byte [edx + 0xaac], 0
mov dword [0x472b80], 0
push 2
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 4]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x10]
call edx
movzx eax, al
test eax, eax
je 0x40757b
mov ecx, dword [ebp - 0x4c]
cmp dword [ecx + 0xabc], 0
jne 0x40755e
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [ebp - 0x4c]
mov dword [edx + 0xabc], eax
mov eax, dword [ebp - 0x4c]
mov byte [eax + 0xf8], 1
mov ecx, dword [ebp - 0x4c]
mov dword [ecx + 0xabc], 0
call dword [sym.imp.WINMM.dll_timeGetTime]
push 7
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 4]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x10]
call edx
movzx eax, al
test eax, eax
je 0x4075ba
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0xab8]
add edx, 1
and edx, 0x80000001
jns 0x4075b1
dec edx
or edx, 0xfffffffe
inc edx
mov eax, dword [ebp - 0x4c]
mov dword [eax + 0xab8], edx
mov ecx, dword [ebp - 0x4c]
cmp dword [ecx + 0xab8], 1
jne 0x4075d1
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + 0x60]
call fcn.004326c0
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax + 0xf8]
test ecx, ecx
je 0x4075ea
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + 0x60]
call fcn.00432680
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x168], 0x3c
jle 0x407645
mov ecx, dword [ebp - 0x4c]
mov dword [ecx + 0x148], 0
mov edx, dword [ebp - 0x4c]
mov byte [edx + 0xf8], 0
mov byte [0x472b88], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x34]
push ecx
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + 0x60]
call fcn.004344d0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 4]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0xf0]
call edx
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax + 0xf8]
test ecx, ecx
je 0x407673
movzx edx, byte [0x472b88]
test edx, edx
jne 0x407673
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x168]
add ecx, 1
mov edx, dword [ebp - 0x4c]
mov dword [edx + 0x168], ecx
jmp 0x40768c
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x148], 0
jne 0x40768c
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx + 0x60]
call fcn.0042aa50
jmp 0x407740
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x60]
mov ecx, dword [eax + 0x48c]
add ecx, 1
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x60]
mov dword [eax + 0x48c], ecx
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx + 0x60]
call fcn.00434bc0
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + 0x60]
call fcn.00434d60
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x60]
call fcn.0042daf0
movzx ecx, al
test ecx, ecx
je 0x407740
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + 0x60]
call fcn.00434f90
mov eax, dword [ebp - 0x4c]
mov byte [eax + 0x16c], 1
push 1
mov ecx, dword [ebp - 0x4c]
add ecx, 0x16c
push ecx
push 0x941
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 4]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x50]
call ecx
mov edx, dword [ebp - 0x4c]
mov byte [edx + 0x16d], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x60]
mov dword [ecx + 0x4a0], 0
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + 0x60]
call fcn.00434d60
mov eax, dword [ebp - 0x4c]
mov dword [eax + 0x148], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f061
mov esp, ebp
pop ebp
ret