Function at 0x40c780
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4979b0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4cc06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ecx
cmp eax, 0x14
ja 0x40c92e
je case.default.0x40cbfa
dec eax
cmp eax, 7
ja case.default.0x40c94d
jmp dword [eax*4 + 0x40cc70]
push esi
mov esi, dword [sym.imp.USER32.dll_SetClipboardViewer]
call esi
mov dword [edi + 0x1cc], eax
mov eax, dword [edi + 4]
mov dword [edi + 0x94], eax
push eax
mov dword [edi + 0x1b8], eax
call esi
jmp case.default.0x40cbfa
mov ecx, edi
call fcn.0040d7d0
mov byte [edi + 0xc0], 1
jmp case.default.0x40cbfa
mov edi, dword [edi + 0x84]
push str.Process_focus_restoration_in_the_RfbKeySym_class
push dword [edi + 0x210]
call fcn.00431900
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 8
mov dword [ebp - 0x1c], 0x12a2a311
xor esi, esi
mov dword [ebp - 0x18], 0xa110a4a5
mov byte [ebp - 0x14], 0xa0
nop dword [eax + eax]
mov al, byte [ebp + esi - 0x1c]
mov byte [ebp - 0x20], al
movzx eax, al
push eax
call ebx
sar ax, 8
mov ecx, edi
mov byte [ebp - 0x24], al
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call fcn.00437c70
inc esi
cmp esi, 9
jl 0x40c850
jmp case.default.0x40cbfa
mov esi, dword [edi + 0x84]
mov word [edi + 0x1d0], 0
push str.Process_focus_loss_in_the_RfbKeySym_class
push dword [esi + 0x210]
call fcn.00431900
add esp, 8
mov ecx, esi
push 0
push 0x11
call fcn.00437c70
push 0
push 0xa3
mov ecx, esi
call fcn.00437c70
push 0
push 0xa2
mov ecx, esi
call fcn.00437c70
push 0
push 0x12
mov ecx, esi
call fcn.00437c70
push 0
push 0xa4
mov ecx, esi
call fcn.00437c70
push 0
push 0xa5
mov ecx, esi
call fcn.00437c70
push 0
push 0x10
mov ecx, esi
call fcn.00437c70
push 0
push 0xa1
mov ecx, esi
call fcn.00437c70
push 0
push 0xa0
mov ecx, esi
call fcn.00437c70
push 0
push 0x5b
mov ecx, esi
call fcn.00437c70
push 0
push 0x5c
mov ecx, esi
call fcn.00437c70
jmp case.default.0x40cbfa
cmp eax, 0x114
ja 0x40cb86
je 0x40cb17
add eax, 0xffffff00
cmp eax, 7
ja case.default.0x40c94d
jmp dword [eax*4 + 0x40cc90]
mov esi, dword [edi + 0x1d8]
mov eax, dword [esi + 0x28]
lea ecx, [esi + 0x28]
call dword [eax + 4]
mov bl, byte [esi + 0xc]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x28]
mov eax, dword [esi + 0x28]
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
test bl, bl
jne case.default.0x40cbfa
mov ecx, dword [ebp - 0x28]
mov edi, dword [ecx + 0x84]
cmp byte [edi + 0x20b], bl
je case.default.0x40cbfa
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x20]
movzx ebx, ax
mov esi, ebx
push esi
push str.processCharEvent___function_called_with_alowed_processing:_charCode___4.4x__addKeyData___x
push dword [edi + 0x210]
call fcn.00431960
add esp, 0x10
cmp byte [edi + 0x20c], 0
je 0x40ca1d
mov byte [edi + 0x20c], 0
cmp byte [edi + 0x1aa], 0
jl 0x40c9df
cmp byte [edi + 0x1ab], 0
jl 0x40c9df
xor cl, cl
jmp 0x40c9e1
mov cl, 1
cmp byte [edi + 0x1ac], 0
jl 0x40c9f7
cmp byte [edi + 0x1ad], 0
jl 0x40c9f7
xor al, al
jmp 0x40c9f9
mov al, 1
test cl, cl
je 0x40ca24
test al, al
je 0x40ca24
push str.Release_the_ctrl_and_alt_modifiers_before_send_dead_combination
push dword [edi + 0x210]
call fcn.00431960
add esp, 8
mov ecx, edi
call fcn.00437b70
jmp 0x40ca24
mov byte [edi + 0x20b], 0
lea eax, [ebp - 0x24]
push eax
push ebx
call fcn.0043c480
test al, al
je 0x40ca4e
mov eax, dword [edi]
mov ecx, edi
mov esi, dword [ebp - 0x24]
push 1
push esi
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
push 0
push esi
call dword [eax + 4]
jmp case.default.0x40cbfa
push esi
push str.Cant_translate_the__4.4x_unicode_character_to_an_rfb_symbol_to_send_it
push dword [edi + 0x210]
call fcn.00431870
add esp, 0xc
jmp case.default.0x40cbfa
mov esi, dword [edi + 0x1d8]
mov eax, dword [esi + 0x28]
lea ecx, [esi + 0x28]
call dword [eax + 4]
mov bl, byte [esi + 0xc]
mov dword [ebp - 4], 1
lea ecx, [esi + 0x28]
mov eax, dword [esi + 0x28]
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
test bl, bl
jne case.default.0x40cbfa
mov eax, dword [ebp - 0x24]
mov ecx, 0xe5
movzx edx, ax
mov eax, dword [ebp - 0x20]
mov ebx, eax
shr ebx, 0x1f
not bl
and bl, 1
cmp dx, cx
jne 0x40cad8
shr eax, 0x10
movzx ecx, al
shr eax, 8
test al, 1
push 3
lea eax, [ecx + 0xe000]
cmove eax, ecx
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx edx, ax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
cmp dx, 0x11
jne 0x40caf9
push eax
mov byte [ecx + 0x1d0], bl
mov ecx, dword [ecx + 0x84]
push edx
call fcn.00437370
jmp case.default.0x40cbfa
cmp dx, 0x12
jne 0x40cb05
mov byte [ecx + 0x1d1], bl
mov ecx, dword [ecx + 0x84]
push eax
push edx
call fcn.00437370
jmp case.default.0x40cbfa
movzx eax, si
cmp eax, 5
ja case.default.0x40cbfa
jmp dword [eax*4 + 0x40ccb0]
shr esi, 0x10
lea ecx, [edi + 0x94]
push esi
call fcn.0042f510
jmp 0x40cc41
push 5
lea ecx, [edi + 0x94]
call fcn.0042f6d0
jmp 0x40cc41
push 0
lea ecx, [edi + 0x94]
call fcn.0042f6d0
jmp 0x40cc41
push 5
lea ecx, [edi + 0x94]
call fcn.0042f780
jmp 0x40cc41
push 0
lea ecx, [edi + 0x94]
call fcn.0042f780
jmp 0x40cc41
sub eax, 0x115
je 0x40cbf2
sub eax, 0x1f3
je 0x40cbd0
sub eax, 5
je 0x40cba0
xor al, al
jmp 0x40cc50
mov eax, dword [edi + 0x1cc]
cmp esi, eax
jne 0x40cbb5
mov dword [edi + 0x1cc], ecx
jmp case.default.0x40cbfa
test eax, eax
je case.default.0x40cbfa
push ecx
push esi
push 0x30d
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x40cbfa
mov ecx, edi
call fcn.0040cf60
push dword [ebp - 0x20]
mov bl, al
push esi
push 0x308
push dword [edi + 0x1cc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, bl
jmp 0x40cc50
movzx eax, si
cmp eax, 5
ja case.default.0x40cbfa
jmp dword [eax*4 + 0x40ccc8]
shr esi, 0x10
lea ecx, [edi + 0x94]
push esi
call fcn.0042f4a0
jmp 0x40cc41
push 5
lea ecx, [edi + 0x94]
call fcn.0042f620
jmp 0x40cc41
push 0
lea ecx, [edi + 0x94]
call fcn.0042f620
jmp 0x40cc41
push 5
jmp 0x40cc36
push 0
lea ecx, [edi + 0x94]
call fcn.0042f580
push 1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471ca0
mov esp, ebp
pop ebp
ret 0xc