Function at 0x40e8d0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47bd36
mov eax, dword fs:[0]
push eax
mov eax, 0x2800
call fcn.00462c30
mov eax, dword [0x4ade78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4af2c0]
imul eax, eax
cdq
mov ecx, 0xe
idiv ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2800], ebx
cmp edx, 0xa
jne 0x40e942
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x4af2c0]
mov edx, 7
test eax, eax
cmove ecx, edx
mov dword [0x4af2c0], ecx
test ebx, ebx
jne 0x40e94e
lea eax, [ebx + 1]
jmp 0x40eec4
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebx + 0x10], 0
jne 0x40ed34
mov byte [ebp - 0x27f9], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [ebx + 4]
movzx ebx, byte [ebp - 0x27f9]
push 0x43
push 0
push 0
push 0
cmp ecx, eax
mov eax, dword [ebp - 0x2800]
push 0
push dword [eax]
mov edx, 1
push ecx
cmove ebx, edx
call dword [sym.imp.USER32.dll_SetWindowPos]
test bl, bl
mov ebx, dword [ebp - 0x2800]
je 0x40ed27
cmp byte [ebx + 8], 0
je 0x40ed27
push dword [ebx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x40ed27
mov esi, dword [0x4af2c0]
mov byte [ebp - 0x27f9], al
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0xf
idiv ecx
cmp edx, 7
jne 0x40e9ef
dec esi
mov dword [0x4af2c0], esi
push 0xff
lea eax, [ebp - 0x2757]
push 0
push eax
mov byte [ebp - 0x2758], 0
call fcn.00462e00
mov edi, dword [sym.imp.USER32.dll_GetKeyboardState]
add esp, 0xc
lea eax, [ebp - 0x2758]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
test eax, eax
je 0x40ea38
test byte [ebp - 0x2746], 0x80
jne 0x40ea38
push 0
push 1
push 0
push 0x12
call esi
push dword [ebx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x40ea6b
lea eax, [ebp - 0x2758]
push eax
call edi
test eax, eax
je 0x40ea64
test byte [ebp - 0x2746], 0x80
jne 0x40ea64
push 0
push 3
push 0
push 0x12
call esi
mov byte [ebp - 0x27f9], 1
mov esi, dword [0x4af2c0]
mov eax, esi
imul eax, esi
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 0xa
jne 0x40eaeb
xor esi, esi
call fcn.00461e71
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0x2800], xmm0
cmp esi, 0x34
jb 0x40ea85
xor ecx, ecx
mov eax, 0x33
cmp ecx, eax
jge 0x40eadf
lea esp, [esp]
movsd xmm0, qword [ebp + eax*8 - 0x27f8]
movsd xmm1, qword [ebp + eax*8 - 0x2800]
comisd xmm0, xmm1
jbe 0x40eada
movsd qword [ebp + eax*8 - 0x27f8], xmm1
movsd qword [ebp + eax*8 - 0x2800], xmm0
dec eax
cmp eax, ecx
jg 0x40eab0
inc ecx
cmp ecx, 0x34
jl 0x40eaa3
mov esi, dword [0x4af2c0]
cmp byte [ebp - 0x27f9], 0
jne 0x40ed27
mov eax, esi
imul eax, esi
imul eax, esi
and eax, 0x8000000f
jns 0x40eb0c
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 6
jne 0x40eb73
test esi, esi
je 0x40eb73
mov ecx, esi
and ecx, 0x80000001
jns 0x40eb24
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x40eb31
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x40eb38
lea esi, [esi*2 + 1]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*2]
sub ecx, eax
mov dword [0x4af2c0], esi
sub ecx, 0
je 0x40eb62
sub ecx, 2
je 0x40eb65
dec ecx
je 0x40eb66
jmp 0x40eb6f
add esi, 2
inc esi
add esi, 2
mov dword [0x4af2c0], esi
test esi, esi
jne 0x40eb15
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x280c]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x2800], 0
mov dword [ebp - 0x280c], 0
mov dword [ebp - 0x2808], 0
call esi
mov edi, eax
lea eax, [ebp - 0x2808]
push eax
push dword [ebx]
call esi
push 1
push eax
push edi
mov dword [ebp - 0x2804], eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [ebp - 0x2800]
push eax
push 0
push 0x2000
call esi
push 3
push 0
push 0
push 0x2001
call esi
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [ebx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x40ec20
push 3
push dword [ebp - 0x2800]
push 0
push 0x2001
call esi
push 0
push dword [ebp - 0x2804]
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov byte [ebp - 0x27f9], 1
mov eax, dword [0x4af2c0]
imul eax, eax
cdq
mov ecx, 0x13
idiv ecx
cmp edx, 3
jne 0x40ec53
push 4
call fcn.00460a63
mov esi, eax
call fcn.00461e71
mov dword [esi], eax
push esi
mov dword [0x4af2c0], eax
call fcn.00460a34
add esp, 8
cmp byte [ebp - 0x27f9], 0
jne 0x40ed27
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2800], eax
push dword [ebx]
lea eax, [ebp - 0x2800]
push str._windowswitchwithtab_d
push eax
mov dword [ebp - 4], 0
call fcn.00404500
mov esi, dword [ebp - 0x2800]
add esi, 0xfffffff0
add esp, 8
mov ecx, dword [esi]
mov dword [ebp - 0x2804], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x40ecc6
cmp ecx, dword [esi]
jne 0x40ecc6
mov edi, esi
mov ecx, 1
lock xadd dword [eax], ecx
inc ecx
jmp 0x40ecf6
mov eax, dword [ecx]
push 1
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
jne 0x40ecda
call fcn.00408840
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 4]
inc ecx
push ecx
lea eax, [esi + 0x10]
push eax
push ecx
lea eax, [edi + 0x10]
push eax
call fcn.00462094
add esp, 0x10
mov ecx, dword [ebp - 0x2804]
lea eax, [edi + 0x10]
mov dword [ecx], eax
call fcn.00457240
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ed27
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x40ee49
mov ecx, dword [0x4af2c0]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov esi, 0xd
idiv esi
lea eax, [esi - 0xc]
cmp edx, 9
jne 0x40ed5d
test ecx, ecx
cmove ecx, eax
mov dword [0x4af2c0], ecx
call fcn.0040ce60
test al, al
jne 0x40ed70
call fcn.00461e71
mov dword [0x4af2c0], eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40ee49
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2800], eax
push dword [ebx + 4]
lea eax, [ebp - 0x2800]
push str._windowswitch_d
push eax
mov dword [ebp - 4], 1
call fcn.00404500
mov esi, dword [ebp - 0x2800]
add esi, 0xfffffff0
add esp, 8
mov ecx, dword [esi]
mov dword [ebp - 0x2804], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x40ede8
cmp ecx, dword [esi]
jne 0x40ede8
mov edi, esi
mov ecx, 1
lock xadd dword [eax], ecx
inc ecx
jmp 0x40ee18
mov eax, dword [ecx]
push 1
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
jne 0x40edfc
call fcn.00408840
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 4]
inc ecx
push ecx
lea eax, [esi + 0x10]
push eax
push ecx
lea eax, [edi + 0x10]
push eax
call fcn.00462094
add esp, 0x10
mov ecx, dword [ebp - 0x2804]
lea eax, [edi + 0x10]
mov dword [ecx], eax
call fcn.00457240
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ee49
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0040ce30
test al, al
jne 0x40eeb9
xor eax, eax
push 0x2646
push eax
mov word [ebp - 0x2658], ax
lea eax, [ebp - 0x2656]
push eax
call fcn.00462e00
add esp, 0xc
xor edi, edi
xor esi, esi
xor edx, edx
test edi, edi
je 0x40ee9e
test edx, edx
je 0x40ee9e
lea eax, [edx + esi]
lea ecx, [edx + esi]
mov ax, word [ebp + eax*2 - 0x26e4]
inc ax
add ax, word [ebp + ecx*2 - 0x265a]
mov word [ebp + ecx*2 - 0x2658], ax
inc edx
cmp edx, 0x46
jl 0x40ee76
add esi, 0x46
inc edi
cmp esi, 0x1324
jl 0x40ee74
movsx eax, word [ebp - 0x12]
mov dword [0x4af2c0], eax
push ebx
call fcn.00460a34
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret