Function at 0x404398
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, edx
mov ebx, eax
mov edi, dword [0x408664]
call sub.user32.dll_GetForegroundWindow
mov edx, dword [0x40866c]
cmp eax, dword [edx]
jne 0x4043fc
test esi, esi
je 0x4043fc
mov dword [0x40862c], 0xffffffff
mov dx, word [esi + 4]
add dx, 0xa
mov ax, word [esi]
add ax, 0xa
call fcn.00404324
mov eax, 1
call fcn.004042fc
push 0
push 0xbb8
push 0x3f6
mov eax, dword [0x40866c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetTimer
jmp 0x404413
cmp dword [0x40862c], 0
je 0x404413
xor eax, eax
mov dword [0x40862c], eax
xor eax, eax
call fcn.004042fc
test ebx, ebx
jl case.0x404492.74
cmp ebx, 0x67
jg case.0x404492.74
push 0x4047dc
imul esi, ebx, 0xd
mov eax, dword [edi + esi*4]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
je 0x40444b
push 0x4047e8
mov eax, dword [edi + esi*4]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x404457
mov eax, ebx
call fcn.004047f4
jmp case.0x404492.74
cmp dword [edi + esi*4 + 0x24], 0xe0
jne 0x404535
imul edx, ebx, 0xd
mov eax, dword [edi + edx*4 + 0x28]
cmp eax, 0x47
jb 0x404522
imul ecx, ebx, 0xd
cmp eax, 0x53
ja 0x404522
imul edx, ebx, 0xd
mov edx, eax
add edx, 0xffffffb9
cmp edx, 0xc
ja case.0x404492.74
jmp dword [edx*4 + 0x404499]
mov esi, 0x24
jmp 0x404511
mov esi, 0x26
jmp 0x404511
mov esi, 0x21
jmp 0x404511
mov esi, 0x25
jmp 0x404511
mov esi, 0x27
jmp 0x404511
mov esi, 0x23
jmp 0x404511
mov esi, 0x28
jmp 0x404511
mov esi, 0x22
jmp 0x404511
mov esi, 0x2d
jmp 0x404511
mov esi, 0x2e
imul edx, ebx, 0xd
mov edx, eax
mov eax, esi
call fcn.00404a64
jmp case.0x404492.74
push 1
mov eax, dword [edi + edx*4 + 0x28]
push eax
call sub.user32.dll_MapVirtualKeyA
mov esi, eax
or eax, 0xffffffff
jmp 0x404565
imul eax, ebx, 0xd
mov eax, dword [edi + eax*4 + 0x24]
cmp eax, 0x47
jb 0x404556
imul edx, ebx, 0xd
cmp eax, 0x53
ja 0x404556
imul edx, ebx, 0xd
call fcn.00404890
jmp case.0x404492.74
push 1
imul edx, ebx, 0xd
push eax
call sub.user32.dll_MapVirtualKeyA
mov esi, eax
xor eax, eax
imul ebp, ebx, 0xd
mov edx, dword [edi + ebp*4 + 0x10]
cmp edx, 0xc
ja case.0x404575.3
jmp dword [edx*4 + 0x40457c]
xor edx, edx
mov ax, 0x2c
call fcn.00404ac4
jmp case.0x404492.74
cmp dword [0x408628], 0xffffffff
jne 0x4045ee
mov dx, word [edi + ebp*4 + 0x24]
mov ax, 0x11
call fcn.00404b1c
mov edx, 2
mov eax, ebx
call fcn.00405424
mov dword [0x408628], ebx
jmp case.0x404492.74
mov dx, word [edi + ebp*4 + 0x24]
mov ax, 0x11
call fcn.00404b58
xor edx, edx
mov eax, dword [0x408628]
call fcn.00405424
mov dword [0x408628], 0xffffffff
jmp case.0x404492.74
cmp dword [0x408620], 0xffffffff
jne 0x404642
mov dx, word [edi + ebp*4 + 0x24]
mov ax, 0x10
call fcn.00404b1c
mov edx, 2
mov eax, ebx
call fcn.00405424
mov dword [0x408620], ebx
jmp 0x404666
mov dx, word [edi + ebp*4 + 0x24]
mov ax, 0x10
call fcn.00404b58
xor edx, edx
mov eax, dword [0x408620]
call fcn.00405424
mov dword [0x408620], 0xffffffff
call fcn.004054d0
jmp case.0x404492.74
cmp dword [0x408624], 0xffffffff
jne 0x40469a
mov dx, 0x38
mov ax, 0x12
call fcn.00404b1c
mov edx, 2
mov eax, ebx
call fcn.00405424
mov dword [0x408624], ebx
jmp 0x4046bd
mov dx, 0x38
mov ax, 0x12
call fcn.00404b58
xor edx, edx
mov eax, dword [0x408624]
call fcn.00405424
mov dword [0x408624], 0xffffffff
call fcn.004054d0
jmp case.0x404492.74
push 0x14
call sub.user32.dll_GetKeyState
test al, 1
jne 0x4046e0
mov edx, 2
mov eax, ebx
call fcn.00405424
jmp 0x4046e9
xor edx, edx
mov eax, ebx
call fcn.00405424
mov dx, word [edi + ebp*4 + 0x24]
mov eax, esi
call fcn.00404ac4
call fcn.004054d0
jmp case.0x404492.74
push 0x90
call sub.user32.dll_GetKeyState
test al, 1
jne 0x40471b
mov edx, 2
mov eax, ebx
call fcn.00405424
jmp 0x404724
xor edx, edx
mov eax, ebx
call fcn.00405424
mov dx, 0x45
mov ax, 0x90
call fcn.00404ac4
call fcn.004054d0
jmp case.0x404492.74
push 0x91
call sub.user32.dll_GetKeyState
test al, 1
jne 0x404757
mov edx, 2
mov eax, ebx
call fcn.00405424
jmp 0x404760
xor edx, edx
mov eax, ebx
call fcn.00405424
mov dx, 0x46
mov ax, 0x91
call fcn.00404ac4
jmp case.0x404492.74
test eax, eax
je 0x404780
mov edx, dword [edi + ebp*4 + 0x28]
mov eax, esi
call fcn.00404a64
jmp case.0x404492.74
test esi, esi
jne 0x4047c6
imul eax, ebx, 0xd
cmp dword [edi + eax*4 + 0x24], 0xe1
jne 0x4047c6
push 0x11
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
je 0x4047b3
imul eax, ebx, 0xd
mov dx, word [edi + eax*4 + 0x2c]
mov ax, 3
call fcn.00404ac4
jmp case.0x404492.74
imul eax, ebx, 0xd
mov dx, word [edi + eax*4 + 0x24]
mov ax, 0x13
call fcn.00404ac4
jmp case.0x404492.74
imul eax, ebx, 0xd
mov dx, word [edi + eax*4 + 0x24]
mov eax, esi
call fcn.00404ac4
pop ebp
pop edi
pop esi
pop ebx
ret