Function at 0x40b948
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x15c
mov eax, 0x50cfce
call fcn.004f41e2
mov edi, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp dword [0x5a227c], esi
je 0x40bc04
and dword [ebp - 0x150], 0
mov dword [0x5a227c], esi
cmp esi, dword [0x5a22a4]
je 0x40b993
mov eax, dword [0x5a2c8c]
test eax, eax
je 0x40b98f
cmp esi, eax
je 0x40b993
xor ebx, ebx
jmp 0x40b996
xor ebx, ebx
inc ebx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
mov dword [ebp - 0x144], eax
test ebx, ebx
jne 0x40bbfa
test esi, esi
je 0x40bc04
lea eax, [ebp - 0x150]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x2c
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x140], 0x30
push ebx
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
lea ecx, [edi + 0x978]
call fcn.00432d85
test al, al
je 0x40bc04
mov ecx, dword [edi + 0x4568]
test ecx, ecx
je 0x40bc04
mov eax, dword [ebp - 0x150]
cmp eax, dword [edi + 0x456c]
jne 0x40bc04
cmp esi, ecx
je 0x40baba
push 0x7f
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jne 0x40ba43
mov word [ebp - 0x110], ax
push 4
mov ecx, str.WorkerW
lea eax, [ebp - 0x110]
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ba75
test dx, dx
je 0x40ba71
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ba75
add eax, esi
add ecx, esi
test dx, dx
jne 0x40ba51
mov eax, ebx
jmp 0x40ba7a
sbb eax, eax
or eax, 1
test eax, eax
je 0x40baba
mov ecx, str.Progman
lea eax, [ebp - 0x110]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40baad
test dx, dx
je 0x40baa9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40baad
add eax, esi
add ecx, esi
test dx, dx
jne 0x40ba89
mov eax, ebx
jmp 0x40bab2
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40bc04
lea ecx, [ebp - 0x168]
call fcn.004d840a
test dword [ebp - 0x144], 0x8000
mov dword [ebp - 4], ebx
je 0x40badf
mov dword [edi + 0x4570], ebx
jmp 0x40bbed
cmp dword [edi + 0x4570], ebx
je 0x40bbed
lea eax, [ebp - 0x168]
push ebx
push eax
call fcn.004d3e20
pop ecx
pop ecx
test eax, eax
js 0x40bbed
mov ecx, dword [ebp - 0x164]
lea eax, [ebp - 0x144]
push eax
call fcn.004dbbd8
mov eax, dword [ebp - 0x144]
test ax, ax
js 0x40bbed
mov cx, word [ebp - 0x142]
test cx, cx
js 0x40bbed
movsx ecx, cx
push ecx
mov ecx, dword [ebp - 0x164]
cwde
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.004db561
mov ecx, dword [ebp - 0x164]
lea eax, [ebp - 0x14c]
push 1
push eax
push ebx
lea ecx, [ecx + 0xc]
call fcn.004cfc3f
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push dword [ebp - 0x148]
push dword [ebp - 0x14c]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, dword [0x5a22a4]
jne 0x40bbed
lea eax, [ebp - 0x158]
mov dword [edi + 0x3f08], 1
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0x148]
mov edi, dword [sym.imp.USER32.dll_SetCursorPos]
push dword [ebp - 0x14c]
call edi
mov esi, dword [sym.imp.USER32.dll_mouse_event]
push ebx
push ebx
push dword [ebp - 0x148]
push dword [ebp - 0x14c]
push 0x8002
call esi
push ebx
push ebx
push dword [ebp - 0x148]
push dword [ebp - 0x14c]
push 0x8004
call esi
push dword [ebp - 0x154]
push dword [ebp - 0x158]
call edi
lea ecx, [ebp - 0x168]
call fcn.004d84a5
jmp 0x40bc04
mov dword [edi + 0x4570], 1
call fcn.004f418c
ret 4