Function at 0x402fe3
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [0x405818], ebx
push ebp
push esi
push edi
mov byte [esp + 0x13], bl
je 0x403314
mov ecx, dword [0x405820]
mov esi, dword [0x405814]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, 0x200
lea eax, [ecx + ecx*4]
lea ebp, [esi + eax*4]
mov eax, dword [esi + eax*4]
cmp eax, 0x100
jb 0x403191
cmp eax, 0x101
jbe 0x40312c
cmp eax, edx
je 0x4030ba
jbe 0x403191
cmp eax, 0x202
jbe 0x40309a
cmp eax, 0x203
jbe 0x403191
cmp eax, 0x205
ja 0x403191
xor ecx, ecx
cmp eax, 0x204
setne cl
dec ecx
push ebx
and ecx, 0xfffffff8
push ebx
push ebx
add ecx, 0x10
push ebx
push ecx
call dword [sym.imp.USER32.dll_mouse_event]
mov ecx, dword [0x405820]
mov esi, dword [0x405814]
lea eax, [ecx + ecx*4]
cmp dword [esi + eax*4], 0x201
sete byte [0x405a4c]
jmp 0x403191
mov byte [0x405a4d], 1
xor eax, eax
cmp dword [ebp], 0x201
push ebx
push ebx
push ebx
setne al
dec eax
push ebx
and al, 0xfe
add eax, 4
push eax
jmp 0x403072
push ebx
push ebx
push 1
call edi
mov edx, dword [0x405814]
mov ecx, eax
mov eax, dword [0x405820]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 8]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push ebx
call edi
mov edx, dword [0x405814]
mov ecx, eax
mov eax, dword [0x405820]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 4]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push 0x8001
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [0x405820]
mov ecx, dword [0x405814]
lea eax, [eax + eax*4]
push dword [ecx + eax*4 + 8]
lea eax, [ecx + eax*4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x403185
mov dl, byte [ebp + 4]
cmp dl, 0xa0
mov byte [esp + 0x14], dl
je 0x403191
cmp eax, 0x101
jne 0x403144
push 2
pop ecx
jmp 0x403146
xor ecx, ecx
cmp dl, 0x21
jb 0x403150
cmp dl, 0x2e
jbe 0x403168
cmp dl, 0x11
je 0x403168
cmp dl, 0x5b
je 0x403168
cmp dl, 0x5c
je 0x403168
cmp dl, 0x5d
je 0x403168
xor eax, eax
jmp 0x40316b
push 1
pop eax
or eax, ecx
push ebx
push eax
push ebx
movzx eax, dl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_keybd_event]
mov esi, dword [0x405814]
mov ecx, dword [0x405820]
inc ecx
cmp esi, ebx
mov dword [0x405820], ecx
je 0x4031b1
push esi
call fcn.0040334b
mov esi, dword [0x405814]
pop ecx
mov ecx, dword [0x405820]
jmp 0x4031b3
xor eax, eax
push 0x14
xor edx, edx
pop ebp
div ebp
cmp ecx, eax
jae 0x4032e5
lea eax, [ecx + ecx*4]
cmp dword [esi + eax*4], ebx
lea ebp, [esi + eax*4]
je 0x4032e5
mov al, byte [0x405a4e]
cmp al, 1
jne 0x4032cb
cmp byte [0x405a4c], bl
jne 0x4032ad
lea eax, [ecx + ecx*4]
cmp dword [esi + eax*4], 0x200
jne 0x4032ad
push 6
mov eax, ecx
xor edx, edx
pop ebp
div ebp
test edx, edx
je 0x403218
lea eax, [ecx + ecx*4 + 5]
cmp dword [esi + eax*4], 0x200
je 0x4032a1
push ebx
push ebx
push 1
call edi
mov edx, dword [0x405814]
mov ecx, eax
mov eax, dword [0x405820]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 8]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push ebx
call edi
mov edx, dword [0x405814]
mov ecx, eax
mov eax, dword [0x405820]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 4]
xor edx, edx
imul eax, eax, 0xffff
div ecx
push eax
push 0x8001
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [0x405820]
mov ecx, dword [0x405814]
lea eax, [eax + eax*4]
push dword [ecx + eax*4 + 8]
lea eax, [ecx + eax*4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursorPos]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x405814]
mov ecx, dword [0x405820]
mov byte [esp + 0x13], 1
inc ecx
mov dword [0x405820], ecx
jmp 0x4031de
mov al, byte [esp + 0x13]
push ebx
neg al
sbb eax, eax
and eax, 0x4a
inc eax
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x403314
mov ecx, dword [ebp + 0xc]
push ebx
sub ecx, dword [ebp - 8]
movzx eax, al
inc eax
neg eax
sbb eax, eax
and al, 0xfc
add eax, 5
imul ecx, eax
push ecx
jmp 0x4032bb
cmp byte [0x405a4d], bl
je 0x4032fc
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [0x405818]
push ebx
push eax
push 0x111
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 8