Function at 0x640140
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.user32.dll_GetActiveWindow]
cmp eax, dword [ebp + 8]
jne 0x640563
mov eax, dword [ebp + 4]
lea ebx, [ebp + 0x6c]
lea edi, [ebp + 0x16c]
mov ecx, 0x40
mov esi, ebx
push ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push 0x100
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x6401b5
mov eax, dword [ebp + 4]
test eax, eax
je 0x64022e
mov edx, dword [eax]
push eax
call dword [edx + 0x1c]
test eax, eax
je 0x64019b
cmp eax, 1
jne 0x64022e
mov ecx, 0x40
xor eax, eax
lea edi, [ebp + 0x16c]
rep stosd dword es:[edi], eax
mov ecx, 0x40
mov edi, ebx
rep stosd dword es:[edi], eax
jmp 0x64022e
mov edx, 0xffffff94
mov dword [ebp + 0xa6c], 1
mov eax, ebx
lea ecx, [ebp + 0x66c]
sub edx, ebp
mov bl, byte [eax + 0x100]
test bl, bl
jne 0x6401e9
cmp byte [eax], 0
je 0x6401e9
mov dword [ecx - 0x400], 1
jmp 0x6401f3
mov dword [ecx - 0x400], 0
mov bl, byte [eax + 0x100]
test bl, bl
je 0x64020a
cmp byte [eax], 0
jne 0x64020a
mov dword [ecx], 1
jmp 0x640210
mov dword [ecx], 0
cmp byte [eax], 0
je 0x64021f
mov dword [ebp + 0xa6c], 0
add ecx, 4
inc eax
lea esi, [edx + eax]
cmp esi, 0x100
jl 0x6401ce
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x20]
lea esi, [ebp + 0x1c]
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
push eax
mov dword [ebp + 0x28], ecx
call dword [sym.imp.user32.dll_GetClientRect]
push esi
call dword [sym.imp.user32.dll_GetCursorPos]
mov ecx, dword [ebp + 8]
push esi
push ecx
call dword [sym.imp.user32.dll_ScreenToClient]
mov edx, dword [esi + 4]
mov eax, dword [esi]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.user32.dll_PtInRect]
test eax, eax
je 0x640563
mov edx, dword [ebp + 0xc]
mov edi, dword [sym.imp.user32.dll_GetAsyncKeyState]
push 1
mov dword [ebp + 0x10], edx
mov dword [ebp + 0xc], 0
call edi
and al, 0
test ax, ax
je 0x64029e
mov eax, dword [ebp + 0xc]
or al, 4
mov dword [ebp + 0xc], eax
push 4
call edi
and al, 0
test ax, ax
je 0x6402b1
mov eax, dword [ebp + 0xc]
or al, 0x20
mov dword [ebp + 0xc], eax
mov ebx, 2
push ebx
call edi
and al, 0
test ax, ax
je 0x6402c9
mov eax, dword [ebp + 0xc]
or ah, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov edi, ecx
and edi, 4
jne 0x6402df
mov eax, dword [ebp + 0xc]
test al, 4
je 0x6402df
or al, 1
mov dword [ebp + 0xc], eax
mov edx, ecx
and edx, 0x20
jne 0x6402f2
mov eax, dword [ebp + 0xc]
test al, 0x20
je 0x6402f2
or al, 8
mov dword [ebp + 0xc], eax
and ecx, 0x100
jne 0x640307
mov eax, dword [ebp + 0xc]
test ah, 1
je 0x640307
or al, 0x40
mov dword [ebp + 0xc], eax
test edi, edi
je 0x640317
mov eax, dword [ebp + 0xc]
test al, 4
jne 0x640317
or eax, ebx
mov dword [ebp + 0xc], eax
test edx, edx
je 0x640327
mov eax, dword [ebp + 0xc]
test al, 0x20
jne 0x640327
or al, 0x10
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x640338
mov eax, dword [ebp + 0xc]
test ah, 1
jne 0x640338
or al, 0x80
mov dword [ebp + 0xc], eax
mov al, byte [0x818820]
test al, 1
jne 0x640353
or al, 1
mov byte [0x818820], al
call dword [sym.imp.user32.dll_GetDoubleClickTime]
mov dword [0x818824], eax
test byte [ebp + 0xc], bl
je 0x6403e3
mov al, byte [0x818820]
test bl, al
jne 0x64037c
or al, bl
mov byte [0x818820], al
mov eax, dword [esi]
mov dword [0x818828], eax
mov ecx, dword [esi + 4]
mov dword [0x81882c], ecx
mov eax, dword [0x818828]
mov ecx, dword [esi]
sub eax, ecx
cdq
mov edi, eax
mov eax, dword [0x81882c]
xor edi, edx
sub edi, edx
mov edx, dword [ebp + 0x20]
sub eax, edx
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, ecx
mov dword [0x818828], edx
mov eax, dword [esi + 4]
mov dword [0x81882c], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov ecx, dword [0x818824]
mov edx, dword [0x818834]
add edx, ecx
cmp eax, edx
jae 0x6403d8
cmp edi, 5
jg 0x6403d8
cmp ebx, 5
jg 0x6403d8
mov eax, dword [ebp + 0xc]
or ah, 2
mov dword [ebp + 0xc], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [0x818834], eax
test byte [ebp + 0xc], 0x10
je 0x640474
mov al, byte [0x818820]
test al, 4
jne 0x64040d
or al, 4
mov byte [0x818820], al
mov eax, dword [esi]
mov dword [0x818818], eax
mov ecx, dword [esi + 4]
mov dword [0x81881c], ecx
mov eax, dword [0x818818]
mov ecx, dword [esi]
sub eax, ecx
cdq
mov edi, eax
mov eax, dword [0x81881c]
xor edi, edx
sub edi, edx
mov edx, dword [ebp + 0x20]
sub eax, edx
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, ecx
mov dword [0x818818], edx
mov eax, dword [esi + 4]
mov dword [0x81881c], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov ecx, dword [0x818824]
mov edx, dword [0x818838]
add edx, ecx
cmp eax, edx
jae 0x640469
cmp edi, 5
jg 0x640469
cmp ebx, 5
jg 0x640469
mov eax, dword [ebp + 0xc]
or ah, 4
mov dword [ebp + 0xc], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [0x818838], eax
test byte [ebp + 0xc], 0x80
je 0x640505
mov al, byte [0x818820]
test al, 8
jne 0x64049e
or al, 8
mov byte [0x818820], al
mov eax, dword [esi]
mov dword [0x818810], eax
mov ecx, dword [esi + 4]
mov dword [0x818814], ecx
mov eax, dword [0x818810]
mov ecx, dword [esi]
sub eax, ecx
cdq
mov edi, eax
mov eax, dword [0x818814]
xor edi, edx
sub edi, edx
mov edx, dword [ebp + 0x20]
sub eax, edx
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, ecx
mov dword [0x818810], edx
mov eax, dword [esi + 4]
mov dword [0x818814], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov ecx, dword [0x818824]
mov edx, dword [0x81883c]
add edx, ecx
cmp eax, edx
jae 0x6404fa
cmp edi, 5
jg 0x6404fa
cmp ebx, 5
jg 0x6404fa
mov eax, dword [ebp + 0xc]
or ah, 8
mov dword [ebp + 0xc], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [0x81883c], eax
mov eax, dword [ebp + 0xc]
test al, 4
je 0x640517
mov ecx, dword [esi]
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x34], ecx
mov dword [ebp + 0x38], edx
test al, 0x20
je 0x640526
mov ecx, dword [esi]
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x48], edx
test ah, 1
je 0x640536
mov ecx, dword [esi]
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x54], ecx
mov dword [ebp + 0x58], edx
test al, 1
je 0x640545
mov ecx, dword [esi]
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x2c], ecx
mov dword [ebp + 0x30], edx
test al, 8
je 0x640554
mov ecx, dword [esi]
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x40], edx
test al, 0x40
je 0x640563
mov eax, dword [esi]
mov ecx, dword [ebp + 0x20]
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x50], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret