Function at 0x406760
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00402300
mov byte [ebp - 0xd], al
mov byte [ebp - 5], 0
xor ecx, ecx
mov word [ebp - 4], cx
xor edx, edx
mov word [ebp - 2], dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x1000
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 6
ja case.default.0x4067ad
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x407128]
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x7d]
test ecx, ecx
je 0x4067c9
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x4067e6
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x7c]
test eax, eax
je 0x4067de
mov ecx, dword [ebp - 0x14]
call fcn.00407a20
jmp 0x4067e6
mov ecx, dword [ebp - 0x14]
call fcn.004079b0
mov byte [ebp - 5], 1
jmp case.default.0x4067ad
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x658], 0
je 0x406833
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edx, dword [ebp - 0x14]
sub eax, dword [edx + 0x658]
cmp eax, 0xfa
ja 0x406833
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401d40
push 0
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 5], 1
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x658], 0
jmp case.default.0x4067ad
mov ecx, dword [ebp - 0x14]
add ecx, 0x640
call fcn.00401720
test eax, eax
jne 0x40685c
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov byte [ebp - 5], 1
jmp case.default.0x4067ad
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401a90
test eax, eax
je 0x406886
push 0
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x40688e
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov byte [ebp - 5], 1
movzx edx, byte [ebp - 5]
test edx, edx
jne case.0x406c7d.1
cmp dword [ebp + 0xc], 0
jne 0x406c4d
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x4068f5
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x7f]
test edx, edx
jne 0x4068f0
movzx eax, byte [ebp - 0xd]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401b20
test eax, eax
je 0x4068e4
push 0
push 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4068ec
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov byte [ebp - 5], 1
jmp case.0x406a82.1
cmp dword [ebp + 0x10], 0x30
jb 0x406901
cmp dword [ebp + 0x10], 0x39
jbe 0x406915
cmp dword [ebp + 0x10], 0x60
jb 0x406a5f
cmp dword [ebp + 0x10], 0x69
ja 0x406a5f
cmp dword [ebp + 0x10], 0x30
jb 0x40692c
cmp dword [ebp + 0x10], 0x39
ja 0x40692c
mov eax, dword [ebp + 0x10]
sub eax, 0x30
mov byte [ebp - 6], al
jmp 0x406935
mov ecx, dword [ebp + 0x10]
sub ecx, 0x60
mov byte [ebp - 6], cl
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.00403560
movzx edx, al
test edx, edx
je 0x406a5a
mov eax, dword [ebp - 0x14]
mov cl, byte [eax + 0x84]
mov byte [ebp - 0x1c], cl
cmp byte [ebp - 0x1c], 0
je 0x406972
cmp byte [ebp - 0x1c], 1
je 0x406a16
cmp byte [ebp - 0x1c], 2
je 0x406972
jmp 0x406a56
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.00403580
movzx edx, ax
movzx eax, byte [ebp - 6]
add edx, eax
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.004034b0
mov dword [ebp - 0xc], eax
movzx ecx, byte [ebp - 6]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x640
call fcn.00401600
test eax, eax
je 0x406a0c
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x84]
test eax, eax
jne 0x4069ca
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401c10
jmp 0x4069fa
mov ecx, dword [ebp - 0xc]
and ecx, 0x1f1f1f1f
mov dword [ebp - 0xc], ecx
je 0x4069ec
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401cb0
jmp 0x4069fa
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401c80
push 0
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x406a14
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x406a56
movzx edx, byte [ebp - 6]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.00403630
movzx eax, al
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401dc0
test eax, eax
je 0x406a4e
push 0
push 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x406a56
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov byte [ebp - 5], 1
jmp case.0x406a82.1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0x1a
ja case.0x406a82.1
mov edx, dword [ebp - 0x20]
movzx eax, byte [edx + 0x40715c]
jmp dword [eax*4 + 0x407144]
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.00403130
movzx ecx, al
test ecx, ecx
je 0x406b94
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x82]
test eax, eax
jne 0x406b94
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx + 0x84]
mov byte [ebp - 0x24], dl
cmp byte [ebp - 0x24], 0
je 0x406ad8
cmp byte [ebp - 0x24], 1
je 0x406b36
cmp byte [ebp - 0x24], 2
je 0x406b64
jmp 0x406b80
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401ec0
test eax, eax
jne 0x406b34
mov ecx, dword [ebp - 0x14]
add ecx, 0x640
call fcn.00401630
test eax, eax
jne 0x406b0e
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401f80
test eax, eax
je 0x406b1e
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401c10
jmp 0x406b34
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401c40
jmp 0x406b80
push 0
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401dc0
test eax, eax
jne 0x406b62
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401c40
jmp 0x406b80
push 1
mov ecx, dword [ebp - 0x14]
add ecx, 0x640
call fcn.00401490
test eax, eax
jne 0x406b80
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 5], 1
jmp case.0x406a82.1
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401b90
push 0
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 5], 1
jmp case.0x406a82.1
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401c10
push 0
push 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 5], 1
jmp case.0x406a82.1
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x640
call fcn.00401520
test eax, eax
je 0x406c0a
push 0
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x406c12
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov byte [ebp - 5], 1
jmp case.0x406a82.1
push 1
mov ecx, dword [ebp - 0x14]
add ecx, 0x640
call fcn.00401490
test eax, eax
jne 0x406c34
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 5], 1
jmp case.0x406c7d.1
cmp dword [ebp + 0xc], 4
jne case.0x406c7d.1
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x20
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x9f
ja case.0x406c7d.1
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + 0x40718c]
jmp dword [ecx*4 + 0x407178]
mov ecx, dword [ebp - 0x14]
add ecx, 0x5e4
call fcn.00401d90
push 0
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 5], 1
jmp case.0x406c7d.1
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.00403130
movzx ecx, al
test ecx, ecx
je 0x406cfd
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x82]
test eax, eax
jne 0x406cfd
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x640
call fcn.00401520
test eax, eax
je 0x406cf1
push 0
push 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x406cf9
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov byte [ebp - 5], 1
jmp case.0x406c7d.1
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.00403130
movzx eax, al
test eax, eax
je 0x406d52
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x82]
test edx, edx
jne 0x406d52
push 1
mov ecx, dword [ebp - 0x14]
add ecx, 0x640
call fcn.00401490
test eax, eax
jne 0x406d3e
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 5], 1
jmp case.0x406c7d.1
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.00403130
movzx edx, al
test edx, edx
je case.0x406c7d.1
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x82]
test ecx, ecx
jne case.0x406c7d.1
mov ecx, dword [ebp - 0x14]
add ecx, 0x640
call fcn.004015b0
test eax, eax
jne 0x406d8e
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 5], 1
movzx ecx, byte [ebp - 5]
test ecx, ecx
jne 0x40710a
cmp dword [ebp + 0xc], 0
jne 0x406f2c
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x406dff
movzx eax, byte [ebp - 0xd]
cmp eax, 0x1a
jg 0x406dd8
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jne 0x406dea
movzx edx, byte [ebp - 0xd]
mov ax, word [edx*2 + 0x4180e6]
mov word [ebp - 4], ax
jmp 0x406dfa
movzx ecx, byte [ebp - 0xd]
mov dx, word [ecx*2 + 0x41808e]
mov word [ebp - 4], dx
jmp 0x406f27
cmp dword [ebp + 0x10], 0x30
jb 0x406e1f
cmp dword [ebp + 0x10], 0x39
ja 0x406e1f
mov eax, dword [ebp + 0x10]
mov cx, word [eax*2 + 0x4180c6]
mov word [ebp - 4], cx
jmp 0x406f27
cmp dword [ebp + 0x10], 0x60
jb 0x406e3f
cmp dword [ebp + 0x10], 0x69
ja 0x406e3f
mov edx, dword [ebp + 0x10]
mov ax, word [edx*2 + 0x418066]
mov word [ebp - 4], ax
jmp 0x406f27
cmp dword [ebp + 0x10], 0x20
jne 0x406e53
mov ecx, 0x3000
mov word [ebp - 4], cx
jmp 0x406f27
cmp dword [ebp + 0x10], 0xba
jne 0x406e6a
mov edx, 0xff1b
mov word [ebp - 4], dx
jmp 0x406f27
cmp dword [ebp + 0x10], 0xbf
jne 0x406e81
mov eax, 0xff0f
mov word [ebp - 4], ax
jmp 0x406f27
cmp dword [ebp + 0x10], 0xc0
jne 0x406e98
mov ecx, 0x2018
mov word [ebp - 4], cx
jmp 0x406f27
cmp dword [ebp + 0x10], 0xdc
jne 0x406eac
mov edx, 0xff3c
mov word [ebp - 4], dx
jmp 0x406f27
cmp dword [ebp + 0x10], 0xbb
jne 0x406ec0
mov eax, 0xff1d
mov word [ebp - 4], ax
jmp 0x406f27
cmp dword [ebp + 0x10], 0xbd
jne 0x406ed4
mov ecx, 0xff0d
mov word [ebp - 4], cx
jmp 0x406f27
cmp dword [ebp + 0x10], 0x6b
jne 0x406ee5
mov edx, 0xff0b
mov word [ebp - 4], dx
jmp 0x406f27
cmp dword [ebp + 0x10], 0x6d
jne 0x406ef6
mov eax, 0xff0d
mov word [ebp - 4], ax
jmp 0x406f27
cmp dword [ebp + 0x10], 0x6a
jne 0x406f07
mov ecx, 0xff0a
mov word [ebp - 4], cx
jmp 0x406f27
cmp dword [ebp + 0x10], 0x6f
jne 0x406f18
mov edx, 0xff0f
mov word [ebp - 4], dx
jmp 0x406f27
cmp dword [ebp + 0x10], 0x6e
jne 0x406f27
mov eax, 0xff0e
mov word [ebp - 4], ax
jmp 0x4070f0
cmp dword [ebp + 0xc], 4
jne 0x4070f0
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
je 0x406ff3
movzx edx, byte [ebp - 0xd]
cmp edx, 0x1a
jg 0x406ff3
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x7f]
test ecx, ecx
jne 0x406fbf
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x7e]
test eax, eax
je 0x406f98
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jne 0x406f86
movzx edx, byte [ebp - 0xd]
mov ax, word [edx*2 + 0x4180e6]
mov word [ebp - 4], ax
jmp 0x406f96
movzx ecx, byte [ebp - 0xd]
mov dx, word [ecx*2 + 0x41808e]
mov word [ebp - 4], dx
jmp 0x406fbd
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jne 0x406fb2
movzx ecx, byte [ebp - 0xd]
add ecx, 0x60
mov word [ebp - 4], cx
jmp 0x406fbd
movzx edx, byte [ebp - 0xd]
add edx, 0x40
mov word [ebp - 4], dx
jmp 0x406fee
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jne 0x406fde
movzx ecx, byte [ebp - 0xd]
mov dx, word [ecx*2 + 0x41808e]
mov word [ebp - 4], dx
jmp 0x406fee
movzx eax, byte [ebp - 0xd]
mov cx, word [eax*2 + 0x4180e6]
mov word [ebp - 4], cx
jmp 0x4070f0
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x407010
movzx eax, byte [ebp - 0xd]
mov cx, word [eax*2 + 0x41808e]
mov word [ebp - 4], cx
jmp 0x4070f0
cmp dword [ebp + 0x10], 0x30
jb 0x407030
cmp dword [ebp + 0x10], 0x39
ja 0x407030
mov edx, dword [ebp + 0x10]
mov ax, word [edx*2 + 0x41806e]
mov word [ebp - 4], ax
jmp 0x4070f0
cmp dword [ebp + 0x10], 0xbf
jne 0x407047
mov ecx, 0xff1f
mov word [ebp - 4], cx
jmp 0x4070f0
cmp dword [ebp + 0x10], 0xba
jne 0x40705e
mov edx, 0xff1a
mov word [ebp - 4], dx
jmp 0x4070f0
cmp dword [ebp + 0x10], 0xc0
jne 0x407072
mov eax, 0xff5e
mov word [ebp - 4], ax
jmp 0x4070f0
cmp dword [ebp + 0x10], 0xdc
jne 0x407086
mov ecx, 0xff5c
mov word [ebp - 4], cx
jmp 0x4070f0
cmp dword [ebp + 0x10], 0xbb
jne 0x40709a
mov edx, 0xff0b
mov word [ebp - 4], dx
jmp 0x4070f0
cmp dword [ebp + 0x10], 0xbd
jne 0x4070ae
mov eax, 0xff3f
mov word [ebp - 4], ax
jmp 0x4070f0
cmp dword [ebp + 0x10], 0x6b
jne 0x4070bf
mov ecx, 0xff0b
mov word [ebp - 4], cx
jmp 0x4070f0
cmp dword [ebp + 0x10], 0x6d
jne 0x4070d0
mov edx, 0xff0d
mov word [ebp - 4], dx
jmp 0x4070f0
cmp dword [ebp + 0x10], 0x6a
jne 0x4070e1
mov eax, 0xff0a
mov word [ebp - 4], ax
jmp 0x4070f0
cmp dword [ebp + 0x10], 0x6f
jne 0x4070f0
mov ecx, 0xff0f
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
test edx, edx
je 0x40710a
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x640
call fcn.004016f0
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x530
call fcn.00402520
mov esp, ebp
pop ebp
ret 0xc