Function at 0x40dde0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ddc40
push 0x4d4d54
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x10b8
call fcn.004d4ce0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], 1
xor ebx, ebx
mov dword [ebp - 0x1084], ebx
mov dword [ebp - 0x1090], ebx
mov dword [ebp - 0x108c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1080], ebx
mov word [ebp - 0x1078], bx
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x1076]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jl 0x40e3a8
cmp eax, 0x1770
jg 0x40e3a8
push 1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
movsx eax, ax
shr eax, 0x10
jne 0x40e3a8
push 4
call esi
movsx ecx, ax
shr ecx, 0x10
jne 0x40e3a8
push 0x11
call esi
movsx edx, ax
shr edx, 0x10
jne 0x40e3a8
call fcn.0040bcb0
test eax, eax
jne 0x40e3a8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x1080]
push edx
push 0x4dfab8
push eax
call dword [ecx]
mov eax, dword [ebp - 0x1080]
cmp eax, ebx
je 0x40e3a8
xor esi, esi
cmp dword [0x73c1c0], ebx
je 0x40deef
push ebx
push ebx
push eax
call fcn.004405e0
add esp, 0xc
mov esi, eax
cmp esi, ebx
je 0x40e33b
push esi
call fcn.0040c170
add esp, 4
mov edi, eax
mov dword [ebp - 0x1094], edi
cmp esi, ebx
je 0x40df0a
mov eax, dword [esi]
push esi
call dword [eax + 8]
cmp edi, ebx
je 0x40e33b
push 1
lea ecx, [ebp - 0x1078]
push ecx
mov ecx, dword [edi + 4]
call fcn.004a0e30
push str.qzone.qq.com
lea edx, [ebp - 0x1078]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40e33b
cmp dword [edi + 0x10], 0x32
jg 0x40e33b
cmp dword [edi + 0x18], ebx
jne 0x40e33b
mov ecx, dword [edi + 4]
call fcn.004a0e00
test eax, eax
je 0x40e33b
push str.TheWorldAttributeBlocked
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x40df94
push eax
mov eax, dword [ebp - 0x1080]
push eax
call fcn.0040eae0
add esp, 8
cmp eax, 0xfffffffe
je 0x40e33b
cmp eax, 1
jg 0x40e33b
mov dword [ebp - 4], ebx
xor esi, esi
mov dword [ebp - 0x1084], esi
mov dword [ebp - 0x109c], ebx
cmp dword [ebp + 0xc], ebx
mov eax, dword [ebp - 0x1080]
mov ecx, dword [eax]
lea edx, [ebp - 0x10a4]
push edx
push eax
je 0x40dfc2
call dword [ecx + 0x250]
jmp 0x40dfc8
call dword [ecx + 0x248]
mov eax, dword [ebp - 0x109c]
cmp eax, ebx
je 0x40dff1
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
add esp, 4
mov esi, eax
mov dword [ebp - 0x1084], esi
mov eax, dword [ebp - 0x109c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x40e00e
mov eax, dword [ebp + 0x10]
cmp esi, eax
je 0x40e33b
test esi, esi
je 0x40e33b
test eax, eax
je 0x40e33b
mov eax, dword [ebp - 0x1080]
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push eax
call dword [ecx + 0x254]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40e33b
mov eax, dword [ebp - 0x1080]
mov ecx, dword [eax]
lea edx, [ebp - 0x10b4]
push edx
push eax
call dword [ecx + 0x248]
push str.absolute
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x40e33b
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x1080]
mov ecx, dword [eax]
lea edx, [ebp - 0x10b8]
push edx
push eax
call dword [ecx + 0x29c]
mov eax, dword [ebp - 0x10b8]
cmp eax, 0xf
jge 0x40e0ab
test eax, eax
jle 0x40e0ab
mov dword [ebp - 4], ebx
jmp 0x40e33b
mov eax, dword [ebp - 0x1080]
mov ecx, dword [eax]
lea edx, [ebp - 0x10b8]
push edx
push eax
call dword [ecx + 0x294]
mov eax, dword [ebp - 0x10b8]
cmp eax, 0xf
jge 0x40e0e4
test eax, eax
jle 0x40e0e4
mov dword [ebp - 4], ebx
jmp 0x40e33b
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40e0f5
push str.TheWorldAttributeLeft
jmp 0x40e0fa
push str.TheWorldAttributeTop
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x108c], eax
test eax, eax
je 0x40e33b
push eax
mov ecx, dword [ebp - 0x1080]
push ecx
call fcn.0040eae0
add esp, 8
mov edi, eax
cmp edi, 0xfffffffe
je 0x40e33b
cmp edi, ebx
jne 0x40e134
mov edi, 1
jmp 0x40e154
cmp edi, 1
jl 0x40e153
mov dword [ebp - 0x20], 0
jne 0x40e14c
mov dword [ebp - 0x1090], 1
mov edi, 2
jmp 0x40e154
inc edi
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x40e324
mov eax, dword [ebp - 0x1090]
test eax, eax
je 0x40e324
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1080]
push ecx
call fcn.0043e9a0
xor ebx, ebx
xor esi, esi
mov edx, dword [ebp - 0x1c]
push edx
call fcn.0043e8b0
add esp, 0x10
test eax, eax
je 0x40e2c0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0040ced0
add esp, 4
test eax, eax
je 0x40e2c0
mov dword [ebp - 0x10c4], ebx
mov dword [ebp - 0x10c0], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x10c0]
push edx
push eax
call dword [ecx + 0xd8]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x10c4]
push edx
push eax
call dword [ecx + 0xdc]
mov esi, dword [ebp - 0x10c0]
mov eax, esi
cdq
mov ecx, dword [ebp - 0x10c4]
idiv ecx
cmp eax, 0xa
jg 0x40e2a6
mov eax, ecx
cdq
idiv ecx
cmp eax, 0xa
jg 0x40e2a6
imul esi, ecx
cmp esi, 0x30d40
jg 0x40e2a6
mov esi, 1
mov dword [ebp - 0x10c8], ebx
lea eax, [ebp - 0x10d0]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [ebp - 0x10d0]
push ecx
mov edx, dword [ebp - 0x1094]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
push ebx
lea edx, [ebp - 0x10c8]
push edx
lea eax, [ebp - 0x10d0]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0043ebe0
add esp, 0x10
mov eax, dword [ebp - 0x10c8]
cmp eax, ebx
je 0x40e2c0
push eax
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00440860
add esp, 8
test eax, eax
je 0x40e298
push 0x7bc
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x1080]
push ecx
call fcn.0040eb80
add esp, 0xc
xor esi, esi
mov eax, dword [ebp - 0x10c8]
mov edx, dword [eax]
push eax
call dword [edx + 8]
jmp 0x40e2c0
push 0x7bc
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x1080]
push ecx
call fcn.0040eb80
add esp, 0xc
xor esi, esi
cmp esi, ebx
je 0x40e31b
mov edx, dword [ebp - 0x1080]
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov esi, dword [ebp - 0x1094]
mov ecx, esi
call fcn.0040dd00
test eax, eax
je 0x40e305
push 0x7bc
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x1080]
push eax
call fcn.0040eb80
add esp, 0xc
mov ecx, esi
call fcn.0040cb20
jmp 0x40e33b
mov eax, dword [ebp - 0x1080]
mov ecx, dword [eax]
push str.hidden
push eax
call dword [ecx + 0x214]
jmp 0x40e324
xor edi, edi
mov dword [ebp - 0x20], 1
push edi
mov edx, dword [ebp - 0x108c]
push edx
mov eax, dword [ebp - 0x1080]
push eax
call fcn.0040eb80
add esp, 0xc
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e348
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x40e355
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x108c]
test eax, eax
je 0x40e36a
push eax
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
jmp 0x40e370
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40e37a
push eax
call esi
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40e384
push eax
call esi
mov eax, dword [ebp - 0x1080]
test eax, eax
je 0x40e394
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret