Function at 0x40ac90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4525d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x464080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
sub ecx, 0x54
call fcn.0040bb80
movzx eax, al
test eax, eax
jne 0x40acd0
jmp 0x40aee8
mov cx, word [ebp + 8]
mov word [ebp - 0x10], cx
mov ecx, dword [ebp - 0x18]
add ecx, 0x134
call fcn.00419570
mov edx, dword [ebp - 0x18]
cmp eax, dword [edx + 0x160]
jl 0x40ad0b
movzx eax, word [ebp - 0x10]
cmp eax, 8
je 0x40ad0b
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x154], 0
jne 0x40ad0b
jmp 0x40aee8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x40ad23
jmp 0x40aee8
movzx eax, word [ebp - 0x10]
cmp eax, 9
jne 0x40ad31
jmp 0x40aee8
movzx ecx, word [ebp - 0x10]
cmp ecx, 0xd
jne 0x40ad5a
mov edx, dword [ebp - 0x18]
sub edx, 0x54
push edx
push 0
push 0xfcd
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax - 0x28]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40aee8
movzx edx, word [ebp - 0x10]
cmp edx, 8
jne 0x40adce
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x154], 0
jle 0x40ad7c
mov ecx, dword [ebp - 0x18]
sub ecx, 0x54
call fcn.0040b680
jmp 0x40adcc
mov ecx, dword [ebp - 0x18]
add ecx, 0x134
call fcn.00419570
test eax, eax
jle 0x40adcc
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x13c], 0
jle 0x40adcc
push 1
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x13c]
sub eax, 1
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x134
call fcn.004106d0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x13c]
sub edx, 1
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x13c], edx
jmp 0x40ae45
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x154], 0
jle 0x40ade5
mov ecx, dword [ebp - 0x18]
sub ecx, 0x54
call fcn.0040b680
mov ecx, dword [ebp - 0x18]
add ecx, 0x134
call fcn.00419570
mov edx, dword [ebp - 0x18]
cmp eax, dword [edx + 0x13c]
jne 0x40ae13
movzx eax, word [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x134
call fcn.00410bd0
jmp 0x40ae30
movzx ecx, word [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x13c]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x134
call fcn.00410790
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x13c]
add edx, 1
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x13c], edx
mov ecx, dword [ebp - 0x18]
sub ecx, 0x54
call fcn.0040a300
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x13c]
sub eax, dword [edx + 0x130]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x130]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x134
call fcn.00410910
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x18]
sub ecx, 0x54
call fcn.0040a040
mov esi, eax
mov edx, dword [ebp - 0x18]
add esi, dword [edx + 0x140]
mov eax, dword [ebp - 0x18]
add esi, dword [eax - 0x48]
call fcn.00401000
mov dword [eax + 0x3a4], esi
push 0
mov ecx, dword [ebp - 0x18]
sub ecx, 0x54
call fcn.00401600
mov ecx, dword [ebp - 0x18]
sub ecx, 0x54
push ecx
push 0
push 0xfb9
mov edx, dword [ebp - 0x18]
mov eax, dword [edx - 0x28]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004063a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8