Function at 0x40adf9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp byte [edi], 0
push ebx
jne 0x40ae24
cmp byte [edi + 1], 0
jne 0x40ae24
cmp byte [edi + 2], 0
jne 0x40ae24
cmp byte [edi + 3], 0
jne 0x40ae24
cmp byte [edi + 4], 0
je 0x40b039
mov eax, dword [esi + 0x20]
test eax, eax
je 0x40af50
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x40af50
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp byte [edi], 0
mov al, 0x80
je 0x40ae5b
xor byte [ebp - 0xf8], al
xor byte [ebp - 0x68], al
cmp byte [edi + 1], 0
je 0x40ae6a
xor byte [ebp - 0xf8], al
xor byte [ebp - 0x67], al
cmp byte [edi + 2], 0
je 0x40ae76
xor byte [ebp - 0xf7], al
cmp byte [edi + 3], 0
je 0x40ae82
xor byte [ebp - 0xf6], al
cmp byte [edi + 4], 0
je 0x40ae8e
xor byte [ebp - 0xad], al
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [edi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x40aeac
cmp byte [edi + 1], 0
je 0x40aec5
movzx eax, byte [esi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [esi + 0x20]
call ebx
cmp byte [edi + 2], 0
je 0x40aee4
movzx eax, byte [esi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [esi + 0x20]
call ebx
mov al, byte [edi + 3]
test al, al
je 0x40af2a
cmp byte [edi + 2], 0
jne 0x40af0d
cmp byte [esi + 0x1c], 0
jne 0x40af0d
movzx eax, byte [esi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x40af25
test al, al
je 0x40af2a
movzx eax, byte [esi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [esi + 0x20]
call ebx
cmp byte [edi + 4], 0
je 0x40b032
movzx eax, byte [esi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [esi + 0x20]
jmp 0x40b030
cmp byte [edi], 0
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
je 0x40af83
test byte [esi + 0xc], 4
mov al, byte [esi + 0x27]
mov byte [ebp - 4], al
je 0x40af75
push 2
push dword [ebp - 4]
mov cl, 0xa0
call fcn.0040b30d
jmp 0x40af83
push 0
push 2
push dword [ebp - 4]
push 0xa0
call ebx
cmp byte [edi + 1], 0
je 0x40afb1
test byte [esi + 0xc], 4
mov al, byte [esi + 0x28]
mov byte [ebp - 4], al
je 0x40afa3
push 2
push dword [ebp - 4]
mov cl, 0xa1
call fcn.0040b30d
jmp 0x40afb1
push 0
push 2
push dword [ebp - 4]
push 0xa1
call ebx
cmp byte [edi + 2], 0
je 0x40afdc
test byte [esi + 0xc], 4
mov al, byte [esi + 0x24]
mov byte [ebp - 4], al
je 0x40afd1
push 2
push dword [ebp - 4]
mov cl, 0x11
call fcn.0040b30d
jmp 0x40afdc
push 0
push 2
push dword [ebp - 4]
push 0x11
call ebx
cmp byte [edi + 3], 0
je 0x40b007
test byte [esi + 0xc], 4
mov al, byte [esi + 0x25]
mov byte [ebp - 4], al
je 0x40affc
push 2
push dword [ebp - 4]
mov cl, 0x12
call fcn.0040b30d
jmp 0x40b007
push 0
push 2
push dword [ebp - 4]
push 0x12
call ebx
cmp byte [edi + 4], 0
je 0x40b032
test byte [esi + 0xc], 4
mov al, byte [esi + 0x29]
mov byte [ebp - 4], al
je 0x40b027
push 2
push dword [ebp - 4]
mov cl, 0x5b
call fcn.0040b30d
jmp 0x40b032
push 0
push 2
push dword [ebp - 4]
push 0x5b
call ebx
mov ecx, esi
call fcn.0040b2ca
pop ebx
leave
ret