Function at 0x40cf00
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x40d01e
cmp dword [0x4c69d8], 0
je 0x40cf2b
mov al, byte [0x4c3e8f]
jmp 0x40d018
cmp dword [0x4c50a0], 0
je 0x40cf3e
mov al, byte [0x4c4f6d]
jmp 0x40d018
push 0xa0
xor bl, bl
call esi
mov ecx, 0x8000
test cx, ax
je 0x40cf53
mov bl, 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x40cf67
or bl, 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x40cf7b
or bl, 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x40cf8f
or bl, 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x40cfa3
or bl, 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x40cfb7
or bl, 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x40cfc8
or bl, 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x40cfd9
or bl, 0x80
cmp dword [0x4c50a0], 0
je 0x40d016
mov al, bl
not al
and al, byte [0x4c4f6d]
je 0x40d016
mov cl, byte [0x4c4f6f]
not al
and byte [0x4c4f6d], al
and byte [0x4c4f6e], al
and cl, al
mov al, cl
mov byte [0x4c4f6f], cl
mov ecx, 0x4c4f90
call fcn.00411500
mov al, bl
movzx edi, al
and edi, 0xffffffc0
cmp dword [0x4c69d8], 0
je 0x40d032
mov bl, byte [0x4c3e8f]
jmp 0x40d11e
cmp dword [0x4c50a0], 0
je 0x40d046
mov bl, byte [0x4c4f6d]
jmp 0x40d11e
push 0xa0
xor bl, bl
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d05b
mov bl, 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x40d06f
or bl, 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d083
or bl, 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x40d097
or bl, 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d0ab
or bl, 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x40d0bf
or bl, 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d0d0
or bl, 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x40d0e1
or bl, 0x80
cmp dword [0x4c50a0], 0
je 0x40d11e
mov al, bl
not al
and al, byte [0x4c4f6d]
je 0x40d11e
mov cl, byte [0x4c4f6f]
not al
and byte [0x4c4f6d], al
and byte [0x4c4f6e], al
and cl, al
mov al, cl
mov byte [0x4c4f6f], cl
mov ecx, 0x4c4f90
call fcn.00411500
mov ebp, 1
push ebp
xor esi, esi
push esi
push esi
push ebx
push edi
mov eax, 0xffc3d44f
call fcn.00410d00
mov eax, dword [0x4c140c]
add esp, 0x14
cmp dword [0x4c69d8], ebp
jne 0x40d2cb
movzx ecx, byte [eax + 0xf2]
mov esi, 0xffc3d44d
sub esi, ecx
mov ecx, dword [0x4c3ea0]
cmp ecx, dword [0x4c3e9c]
jne 0x40d17f
call fcn.00410720
mov ecx, dword [0x4c3ea0]
test eax, eax
je 0x40d206
cmp dword [0x4c69d8], ebp
jne 0x40d1bb
mov eax, dword [0x4c3ea4]
lea edx, [ecx*8]
sub edx, ecx
lea eax, [eax + edx*4]
xor edx, edx
or byte [0x4c3e8e], 1
mov word [eax + 4], dx
movzx edx, word [esp + 0x4c]
mov dword [eax], ebp
mov word [eax + 6], dx
mov dword [eax + 8], 4
mov dword [eax + 0x10], esi
mov dword [eax + 0xc], 0
jmp 0x40d1fe
mov di, word [esp + 0x4c]
mov eax, dword [0x4c3ea4]
lea eax, [eax + ecx*8]
test di, di
jne 0x40d1d8
mov dword [eax], 0
mov dword [eax + 4], esi
jmp 0x40d1fe
mov dl, byte [0x4c3e8f]
test dl, 3
jne 0x40d1f0
test dl, 0xc
je 0x40d1f0
mov dword [eax], 0x104
jmp 0x40d1f6
mov dword [eax], 0x100
mov byte [eax + 6], 0
mov word [eax + 4], di
add ecx, ebp
mov dword [0x4c3ea0], ecx
mov edx, dword [0x4c140c]
movzx eax, byte [edx + 0xf2]
mov esi, 0xffc3d44d
sub esi, eax
cmp ecx, dword [0x4c3e9c]
jne 0x40d235
call fcn.00410720
test eax, eax
je 0x40d33b
mov ecx, dword [0x4c3ea0]
mov eax, dword [0x4c3ea4]
cmp dword [0x4c69d8], ebp
jne 0x40d287
or byte [0x4c3e8e], 1
lea edx, [ecx*8]
sub edx, ecx
lea eax, [eax + edx*4]
xor edx, edx
pop edi
mov word [eax + 4], dx
movzx edx, word [esp + 0x48]
mov dword [eax + 0x10], esi
pop esi
add ecx, ebp
mov dword [eax], ebp
pop ebp
mov word [eax + 6], dx
mov dword [eax + 8], 6
mov dword [eax + 0xc], 0
mov dword [0x4c3ea0], ecx
pop ebx
add esp, 0x38
ret
mov dx, word [esp + 0x4c]
lea eax, [eax + ecx*8]
test dx, dx
jne 0x40d2ad
pop edi
mov dword [eax + 4], esi
pop esi
add ecx, ebp
pop ebp
mov dword [eax], 0
mov dword [0x4c3ea0], ecx
pop ebx
add esp, 0x38
ret
pop edi
pop esi
add ecx, ebp
pop ebp
mov dword [eax], 0x101
mov byte [eax + 6], 0
mov word [eax + 4], dx
mov dword [0x4c3ea0], ecx
pop ebx
add esp, 0x38
ret
xor ecx, ecx
mov word [esp + 0x14], cx
mov cx, word [esp + 0x4c]
mov word [esp + 0x16], cx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], esi
movzx edx, byte [eax + 0xf2]
mov edi, 0xffc3d44d
sub edi, edx
xor edx, edx
mov word [esp + 0x32], cx
mov word [esp + 0x30], dx
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], 6
mov dword [esp + 0x38], esi
movzx eax, byte [eax + 0xf2]
push 0x1c
lea edx, [esp + 0x14]
mov ecx, 0xffc3d44d
push edx
sub ecx, eax
push 2
mov dword [esp + 0x48], ecx
call dword [sym.imp.USER32.dll_SendInput]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret