Function at 0x406a13
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push fcn.00406a13
xor esi, esi
mov ecx, 0x22
push esi
dec ecx
jne 0x406a28
push 0
push 0x14
push 2
push 0x1080010
push 0
lea ebx, [ebp - 0xfc]
call fcn.00467eb6
mov word [0x470a80], 0
mov word [0x470ac4], 0
push 0x28
call dword [sym.imp.USER32.DLL_GetKeyState]
call fcn.0046d0ef
cwde
mov si, ax
xor eax, eax
movsx ecx, si
cmp ecx, eax
jge 0x406aa1
xor eax, eax
mov ecx, 2
add ecx, dword [ebp - 0xfc]
movsx ecx, word [ecx]
cmp ecx, eax
jne 0x406aa1
mov eax, 2
add eax, dword [ebp - 0xfc]
mov word [eax], 1
mov word [0x470ac4], 1
xor eax, eax
movsx ecx, si
cmp ecx, eax
jle 0x406ade
mov eax, 1
mov ecx, 2
add ecx, dword [ebp - 0xfc]
movsx ecx, word [ecx]
cmp ecx, eax
jne 0x406ade
mov eax, 2
add eax, dword [ebp - 0xfc]
mov word [eax], 0
mov word [0x470ac4], 1
cmp dword [0x470a8c], 0x26
jne 0x406af0
mov word [0x470ac4], 2
cmp dword [0x470a8c], 0x27
jne 0x406b02
mov word [0x470ac4], 3
push 0x25
call dword [sym.imp.USER32.DLL_GetKeyState]
call fcn.0046d0ef
cwde
mov si, ax
xor eax, eax
movsx ecx, si
cmp ecx, eax
jge 0x406b4d
xor eax, eax
mov ecx, 8
add ecx, dword [ebp - 0xfc]
movsx ecx, word [ecx]
cmp ecx, eax
jne 0x406b4d
mov eax, 8
add eax, dword [ebp - 0xfc]
mov word [eax], 1
mov word [0x470ac4], 4
xor eax, eax
movsx ecx, si
cmp ecx, eax
jle 0x406b8a
mov eax, 1
mov ecx, 8
add ecx, dword [ebp - 0xfc]
movsx ecx, word [ecx]
cmp ecx, eax
jne 0x406b8a
mov eax, 8
add eax, dword [ebp - 0xfc]
mov word [eax], 0
mov word [0x470ac4], 4
cmp dword [0x470a8c], 0x21
jne 0x406b9c
mov word [0x470ac4], 5
cmp dword [0x470a8c], 0x22
jne 0x406bae
mov word [0x470ac4], 6
cmp dword [0x470a8c], 0x23
jne 0x406bc0
mov word [0x470ac4], 7
push 0x24
call dword [sym.imp.USER32.DLL_GetKeyState]
call fcn.0046d0ef
cwde
mov si, ax
xor eax, eax
movsx ecx, si
cmp ecx, eax
jge 0x406c0b
xor eax, eax
mov ecx, 0x10
add ecx, dword [ebp - 0xfc]
movsx ecx, word [ecx]
cmp ecx, eax
jne 0x406c0b
mov eax, 0x10
add eax, dword [ebp - 0xfc]
mov word [eax], 1
mov word [0x470ac4], 8
xor eax, eax
movsx ecx, si
cmp ecx, eax
jle 0x406c48
mov eax, 1
mov ecx, 0x10
add ecx, dword [ebp - 0xfc]
movsx ecx, word [ecx]
cmp ecx, eax
jne 0x406c48
mov eax, 0x10
add eax, dword [ebp - 0xfc]
mov word [eax], 0
mov word [0x470ac4], 8
cmp dword [0x470a8c], 0x2d
jne 0x406c6b
fld qword [0x470aa4]
ficomp word [str.PB_DLL_Shell]
fnstsw ax
sahf
je 0x406c6b
mov word [0x470ac4], 9
cmp dword [0x470a8c], 0x2e
jne 0x406c7d
mov word [0x470ac4], 0xa
mov eax, 0xa
movsx ecx, word [0x470ac4]
cmp ecx, eax
mov eax, 0xffffffff
je 0x406c93
inc eax
cmp dword [0x470a8c], 8
mov ecx, 0xffffffff
je 0x406ca2
inc ecx
or eax, ecx
test eax, eax
je 0x406ccd
mov edx, dword [0x470aa0]
call fcn.0046d792
mov edx, 0x474054
call fcn.0046d7a6
call fcn.0046d04d
jne 0x406ccd
mov word [0x470a80], 1
cmp dword [0x470a8c], 0x90
jne 0x406ce2
mov word [0x470ac4], 0xd
push 0x12
call dword [sym.imp.USER32.DLL_GetKeyState]
call fcn.0046d0ef
cwde
mov si, ax
xor eax, eax
movsx ecx, si
cmp ecx, eax
jge 0x406d2d
xor eax, eax
mov ecx, 0x16
add ecx, dword [ebp - 0xfc]
movsx ecx, word [ecx]
cmp ecx, eax
jne 0x406d2d
mov eax, 0x16
add eax, dword [ebp - 0xfc]
mov word [eax], 1
mov word [0x470ac4], 0xb
xor eax, eax
movsx ecx, si
cmp ecx, eax
jle 0x406d6a
mov eax, 1
mov ecx, 0x16
add ecx, dword [ebp - 0xfc]
movsx ecx, word [ecx]
cmp ecx, eax
jne 0x406d6a
mov eax, 0x16
add eax, dword [ebp - 0xfc]
mov word [eax], 0
mov word [0x470ac4], 0xb
mov edx, dword [0x470aa0]
call fcn.0046d792
mov eax, 1
mov edx, 0x473eac
call fcn.0046d7a6
call fcn.00468e33
cmp eax, 0
jne 0x406da0
cmp dword [0x470a8c], 0x20
jne 0x406da0
mov word [0x470a80], 1
cmp dword [0x470a8c], 0x78
jne 0x406db2
mov word [0x470ac4], 0xf
cmp dword [0x470a8c], 0x72
jne 0x406dc4
mov word [0x470ac4], 0x11
cmp dword [0x470a8c], 0x73
jne 0x406dd6
mov word [0x470ac4], 0x10
cmp dword [0x470a8c], 0x70
jne 0x406de8
mov word [0x470ac4], 0x12
push 0x70
call dword [sym.imp.USER32.DLL_GetKeyState]
call fcn.0046d0ef
cwde
mov si, ax
xor eax, eax
movsx ecx, si
cmp ecx, eax
jle 0x406e1b
mov eax, 1
movsx ecx, word [0x471370]
cmp ecx, eax
jne 0x406e1b
mov word [0x471370], 0
xor eax, eax
movsx ecx, si
cmp ecx, eax
jg 0x406e3a
xor eax, eax
movsx ecx, word [0x471370]
cmp ecx, eax
jne 0x406e3a
mov word [0x471370], 1
cmp dword [0x470a8c], 9
jne 0x406e55
mov word [str._Kalendert], 0
mov word [0x471374], 0
cmp dword [0x470a8c], 0x75
jne 0x406e67
mov word [0x470ac4], 0x15
cmp dword [0x470a8c], 0x76
jne 0x406e79
jmp 0x4a0c20
cmp dword [0x470a8c], 0x74
jne 0x406e8b
mov word [0x470ac4], 0x16
cmp dword [0x470a8c], 0x7e
jne 0x406e9d
mov word [0x470a80], 1
cmp dword [0x470a8c], 0x1b
jne 0x406ee3
xor eax, eax
movsx ecx, word [0x471374]
cmp ecx, eax
jne 0x406ec1
mov dword [0x470a8c], 0x7e
mov eax, 1
movsx ecx, word [0x471374]
cmp ecx, eax
jne 0x406eda
mov word [0x471374], 0
mov word [0x470ac4], 0xc
mov eax, 1
movsx ecx, word [0x470ac4]
cmp ecx, eax
mov eax, 0xffffffff
je 0x406ef9
inc eax
mov ecx, 2
mov dword [ebp - 0x2c], eax
movsx eax, word [0x470ac4]
cmp eax, ecx
mov eax, 0xffffffff
je 0x406f12
inc eax
or eax, dword [ebp - 0x2c]
mov ecx, 6
mov dword [ebp - 0x2c], eax
movsx eax, word [0x470ac4]
cmp eax, ecx
mov eax, 0xffffffff
je 0x406f2e
inc eax
or eax, dword [ebp - 0x2c]
mov ecx, 5
mov dword [ebp - 0x2c], eax
movsx eax, word [0x470ac4]
cmp eax, ecx
mov eax, 0xffffffff
je 0x406f4a
inc eax
or eax, dword [ebp - 0x2c]
test eax, eax
je 0x406f68
xor eax, eax
movsx ecx, word [0x47141c]
cmp ecx, eax
jne 0x406f68
mov dword [0x470a8c], 0x1b
mov eax, 0xb
movsx ecx, word [0x470ac4]
cmp ecx, eax
jne 0x406fa5
mov edx, dword [0x470ab8]
call fcn.0046d792
mov eax, 1
mov ebx, 0x46f020
call fcn.0046d62c
call fcn.00468e33
cmp eax, 0
jne 0x406fa5
mov word [0x470ac4], 0
xor eax, eax
movsx ecx, word [0x470ac4]
cmp ecx, eax
jne 0x4070fb
xor eax, eax
movsx ecx, word [0x47141c]
cmp ecx, eax
jne 0x4070fb
cmp dword [0x470a8c], 0x79
je 0x4070fb
mov edx, dword [0x470aa0]
call fcn.0046d792
mov eax, 1
mov ebx, 0x46f020
call fcn.0046d62c
call fcn.00468e33
cmp eax, 0
jne 0x407045
mov eax, 1
mov ebx, 0x46f020
call fcn.0046d62c
mov dword [ebp - 0x2c], eax
call fcn.0046d77a
cmp eax, dword [ebp - 0x2c]
jne 0x407045
mov edx, dword [0x470aac]
call fcn.0046d792
mov eax, 1
mov ebx, 0x46f020
call fcn.0046d62c
call fcn.00468e33
cmp eax, 0
jne 0x407045
mov word [0x470a80], 1
xor eax, eax
movsx ecx, word [0x470a80]
cmp ecx, eax
jne 0x4070fb
fld qword [0x470aa4]
ficomp word [str.PB_DLL_Shell]
fnstsw ax
sahf
ja 0x4070fb
mov eax, 1
mov ebx, 0x46f020
call fcn.0046d62c
mov dword [ebp - 0x2c], eax
call fcn.0046d77a
cmp eax, dword [ebp - 0x2c]
jne 0x4070fb
mov edx, dword [0x470aac]
call fcn.0046d792
mov eax, 1
mov ebx, 0x46f020
call fcn.0046d62c
call fcn.00468e33
cmp eax, 0
mov eax, 0xffffffff
je 0x4070b5
inc eax
mov edx, 0x473eac
call fcn.0046d7a6
mov ecx, 1
mov ebx, 0x46f020
call fcn.0046d62c
xchg ecx, eax
call fcn.00468e33
cmp eax, 0
mov eax, 0xffffffff
jne 0x4070df
inc eax
or ecx, eax
test ecx, ecx
je 0x4070fb
xor eax, eax
movsx ecx, word [0x470ac4]
cmp ecx, eax
jne 0x4070fb
mov word [0x470a80], 1
cmp dword [0x470a8c], 2
jne 0x407126
fldz
mov edx, dword [0x4713d8]
call fcn.0046d792
call fcn.0046c02f
fcompp
fnstsw ax
sahf
jne 0x407126
mov word [0x470a80], 1
call fcn.0046d6c2
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret