Function at 0x4068f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x98], 0
jg 0x40690e
call fcn.00436a07
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x40693e
push 0
lea ecx, [edi + 0x9c]
push 0x5b71db
call fcn.00403010
mov dword [edi + 0xb0], 0
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ebx, dword [edi + 0xa0]
push esi
mov esi, dword [edi + 0xa4]
add ebx, 2
push 0
adc esi, 0
call fcn.00582f22
add esp, 4
cmp edx, esi
jl 0x406984
jg 0x406966
cmp eax, ebx
jb 0x406984
mov eax, dword [edi + 0x9c]
lea ecx, [edi + 0x9c]
cmp dword [eax - 0xc], 0
jle 0x406984
push 0
push 0x5b71db
call fcn.00403010
mov eax, dword [edi + 0xa8]
lea esi, [edi + 0x9c]
cmp eax, dword [edi + 0x98]
je 0x4069a6
push 0
push 0x5b71db
mov ecx, esi
call fcn.00403010
mov eax, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x20]
mov dword [ebp - 0xc], eax
call eax
cmp dword [edi + 0xac], eax
je 0x4069d2
push 0
push 0x5b71db
mov ecx, esi
call fcn.00403010
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x4069e4
mov dword [edi + 0xb0], 0
mov eax, dword [edi + 0x98]
push 0
mov dword [edi + 0xa8], eax
call fcn.00582f22
mov dword [edi + 0xa0], eax
add esp, 4
mov eax, dword [esi]
mov dword [edi + 0xa4], edx
cmp dword [eax - 0xc], 1
jne 0x406a20
mov cl, byte [ebp + 8]
cmp byte [eax], cl
jne 0x406a20
inc dword [edi + 0xb0]
jmp 0x406b52
cmp dword [edi + 0xb0], 0
mov edx, 1
mov dword [ebp - 8], 0
jle 0x406b02
nop dword [eax]
mov edx, dword [esi]
mov ecx, dword [edx - 0xc]
test ecx, ecx
js 0x406bfe
mov al, byte [edx]
lea ebx, [ecx + 1]
mov byte [ebp - 1], al
xor eax, eax
test ebx, ebx
cmovns eax, ebx
cmp eax, ecx
cmovle ecx, eax
mov dword [ebp - 0x10], ecx
test ebx, ebx
js 0x406bfe
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, ebx
or ecx, eax
jge 0x406a85
push ebx
mov ecx, esi
call fcn.00402f70
mov ecx, dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [esi]
sub edx, ecx
lea eax, [ecx + eax]
mov dword [ebp - 0x10], eax
lea ecx, [eax + 1]
je 0x406ac3
test ecx, ecx
jne 0x406ab4
call fcn.0057c978
mov dword [eax], 0x16
call fcn.0057c87a
mov eax, 0x16
jmp 0x406ac5
test eax, eax
je 0x406a9d
push edx
push eax
push ecx
call fcn.00578e20
add esp, 0xc
xor eax, eax
push eax
call fcn.00404ab0
mov eax, dword [ebp - 0x10]
add esp, 4
mov cl, byte [ebp - 1]
mov byte [eax], cl
mov eax, dword [esi]
cmp ebx, dword [eax - 8]
jg 0x406bfe
mov dword [eax - 0xc], ebx
mov eax, dword [esi]
mov byte [ebx + eax], 0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [edi + 0xb0]
jl 0x406a40
mov edx, 1
mov dword [edi + 0xb0], 0
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x10], ecx
lea ebx, [ecx + 1]
test ebx, ebx
js 0x406bfe
sub edx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, ebx
or edx, eax
jge 0x406b36
push ebx
mov ecx, esi
call fcn.00402f70
mov ecx, dword [ebp - 0x10]
mov eax, dword [esi]
mov dl, byte [ebp + 8]
mov byte [ecx + eax], dl
mov eax, dword [esi]
cmp ebx, dword [eax - 8]
jg 0x406bfe
mov dword [eax - 0xc], ebx
mov eax, dword [esi]
mov byte [ebx + eax], 0
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x20]
call dword [ebp - 0xc]
mov edx, dword [edi + 0x98]
mov ebx, eax
xor eax, eax
test ebx, ebx
cmovs ebx, eax
test edx, edx
jns 0x406b80
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x198]
mov edx, eax
mov ecx, dword [edi]
push esi
mov eax, dword [ecx + 0x248]
mov ecx, dword [esi]
mov dword [ebp + 8], eax
cmp dword [ecx - 0xc], 1
mov ecx, edi
jne 0x406ba0
lea eax, [ebx + 1]
push eax
push edx
call dword [ebp + 8]
jmp 0x406ba4
push ebx
push edx
call eax
mov dword [edi + 0xac], eax
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x406907
push 2
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.0043d3b5
push 2
push 2
push dword [edi + 0xac]
mov ecx, edi
call fcn.0043d3b5
push 1
push 1
push dword [edi + 0xac]
mov ecx, edi
call fcn.0043d3b5
push 0
push dword [edi + 0xac]
push 0x1013
push dword [edi + 0x20]
call dword [ebp - 0xc]
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.00401ec0
int3