Function at 0x40152d
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 0x13
mov byte [esp + 0xf], bl
call esi
test ah, ah
js 0x401550
push 0x91
call esi
test ah, ah
jns 0x401556
mov dword [0x4072d0], ebx
cmp dword [0x4072d0], ebx
jne 0x40157f
cmp byte [0x4075e5], bl
je 0x4018a2
push ebx
push ebx
push 0x10
push dword [0x4072a8]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4018a2
mov eax, dword [0x4072c0]
mov edx, dword [0x4072bc]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [eax + eax*4]
push ebp
lea ecx, [edx + ecx*4]
mov ebp, dword [ecx]
cmp ebp, 0x100
push edi
mov edi, dword [sym.imp.USER32.dll_mouse_event]
jb 0x401721
mov edx, 0x101
cmp ebp, edx
jbe 0x4016c6
mov edx, 0x200
cmp ebp, edx
je 0x401659
jbe 0x401721
cmp ebp, 0x202
jbe 0x401628
cmp ebp, 0x203
jbe 0x401721
cmp ebp, 0x205
ja 0x401721
xor eax, eax
push ebx
cmp ebp, 0x204
setne al
push ebx
push ebx
push ebx
lea eax, [eax*8 + 8]
push eax
call edi
mov eax, dword [0x4072c0]
mov edx, dword [0x4072bc]
lea ecx, [eax + eax*4]
cmp dword [edx + ecx*4], 0x201
sete cl
mov byte [0x4075e0], cl
jmp 0x401721
xor eax, eax
mov byte [0x4075e1], 1
mov ebp, 0x201
cmp dword [ecx], ebp
push ebx
setne al
push ebx
push ebx
push ebx
lea eax, [eax + eax + 2]
push eax
call edi
mov eax, dword [0x4072c0]
mov edx, dword [0x4072bc]
lea ecx, [eax + eax*4]
cmp dword [edx + ecx*4], ebp
jmp 0x40161a
push ebx
push ebx
push 1
call esi
mov edx, dword [0x4072bc]
mov ecx, eax
mov eax, dword [0x4072c0]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 8]
imul eax, eax, 0xffff
xor edx, edx
div ecx
push eax
push ebx
call esi
mov edx, dword [0x4072bc]
mov ecx, eax
mov eax, dword [0x4072c0]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 4]
imul eax, eax, 0xffff
xor edx, edx
div ecx
push eax
push 0x8001
call edi
mov eax, dword [0x4072c0]
mov ecx, dword [0x4072bc]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x40171c
mov cl, byte [ecx + 4]
cmp cl, 0xa0
mov byte [esp + 0x14], cl
je 0x401721
cmp ebp, edx
jne 0x4016db
push 2
pop edx
jmp 0x4016dd
xor edx, edx
cmp cl, 0x21
jb 0x4016e7
cmp cl, 0x2e
jbe 0x4016ff
cmp cl, 0x11
je 0x4016ff
cmp cl, 0x5b
je 0x4016ff
cmp cl, 0x5c
je 0x4016ff
cmp cl, 0x5d
je 0x4016ff
xor eax, eax
jmp 0x401702
xor eax, eax
inc eax
push ebx
or eax, edx
push eax
movzx eax, cl
push ebx
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [0x4072c0]
push dword [0x4072bc]
inc eax
mov dword [0x4072c0], eax
call fcn.0040440d
pop ecx
push 0x14
xor edx, edx
pop ecx
div ecx
mov ecx, dword [0x4072c0]
cmp ecx, eax
jae 0x401871
mov edx, dword [0x4072bc]
lea eax, [ecx + ecx*4]
lea edx, [edx + eax*4]
cmp dword [edx], ebx
je 0x401871
mov ebp, dword [0x407008]
cmp ebp, 0x64
jge 0x40183c
mov eax, dword [edx + 0xc]
sub eax, dword [edx - 8]
cmp ebp, 1
jne 0x401856
add eax, eax
jmp 0x40185f
mov edx, dword [0x4072bc]
lea eax, [ecx + ecx*4]
lea eax, [edx + eax*4]
cmp dword [eax], 0x200
mov dword [esp + 0x14], eax
jne 0x401848
push 6
xor edx, edx
mov eax, ecx
pop ebp
div ebp
test edx, edx
je 0x4017b7
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x14], 0x200
je 0x401835
push ebx
push ebx
push 1
call esi
mov edx, dword [0x4072bc]
mov ecx, eax
mov eax, dword [0x4072c0]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 8]
imul eax, eax, 0xffff
xor edx, edx
div ecx
push eax
push ebx
call esi
mov edx, dword [0x4072bc]
mov ecx, eax
mov eax, dword [0x4072c0]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*4 + 4]
imul eax, eax, 0xffff
xor edx, edx
div ecx
push eax
push 0x8001
call edi
mov eax, dword [0x4072c0]
mov ecx, dword [0x4072bc]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursorPos]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x4072c0]
mov byte [esp + 0x13], 1
inc ecx
mov dword [0x4072c0], ecx
cmp byte [0x4075e0], bl
je 0x401781
mov al, byte [esp + 0x13]
neg al
sbb eax, eax
and eax, 0x4a
inc eax
jmp 0x40185f
cmp ebp, 2
jl 0x40185f
xor edx, edx
div ebp
push ebx
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4018a0
cmp byte [0x4075e1], bl
je 0x401888
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [0x4072d0]
push ebx
push eax
push 0x111
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop ebp
pop esi
pop ebx
pop ecx
pop ecx
ret 8