Function at 0x40eb90
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0xffffff00
cmp eax, 6
push esi
ja case.0x40eba8.257
jmp dword [eax*4 + 0x40ee50]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push ebx
push edi
push 0x10
call esi
movsx ecx, ax
push 0x11
mov dword [ebp + 8], ecx
call esi
movsx edx, ax
push 0x12
mov dword [ebp - 4], edx
call esi
mov edi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyA]
movsx eax, ax
push 0
push edi
mov dword [ebp - 8], eax
call ebx
push 2
push edi
mov byte [ebp + 0xc], al
call ebx
test al, al
pop edi
mov byte [ebp - 0xc], al
pop ebx
jne 0x40ed22
mov cl, byte [ebp + 0xc]
cmp cl, 0x47
jb 0x40ecd6
cmp cl, 0x53
ja 0x40ecd6
mov eax, dword [ebp - 8]
test eax, eax
jl case.0x40eba8.257
test dword [ebp + 0x10], 0x1000000
jne 0x40ec30
push 0x90
call esi
test al, 1
jne case.0x40eba8.257
mov esi, dword [ebp + 0xc]
and esi, 0xff
shl esi, 8
cmp esi, 0x4800
jne 0x40ec59
mov eax, dword [ebp + 8]
test eax, eax
jge 0x40ed7d
mov esi, 0x4838
jmp 0x40ed7d
cmp esi, 0x5000
jne 0x40ec76
mov eax, dword [ebp + 8]
test eax, eax
jge 0x40ed7d
mov esi, 0x5032
jmp 0x40ed7d
cmp esi, 0x4b00
jne 0x40eca4
mov eax, dword [ebp + 8]
test eax, eax
jge 0x40ec8f
mov esi, 0x4b34
jmp 0x40ed7d
mov eax, dword [ebp - 4]
test eax, eax
jge 0x40ed7d
mov esi, 0x7300
jmp 0x40ed7d
cmp esi, 0x4d00
jne 0x40ed7d
mov eax, dword [ebp + 8]
test eax, eax
jge 0x40ecc1
mov esi, 0x4d36
jmp 0x40ed7d
mov eax, dword [ebp - 4]
test eax, eax
jge 0x40ed7d
mov esi, 0x7400
jmp 0x40ed7d
cmp cl, 0x3b
jb 0x40ed22
cmp cl, 0x44
ja 0x40ed22
mov eax, dword [ebp + 8]
test eax, eax
jge 0x40ecf8
mov esi, dword [ebp + 0xc]
and esi, 0xff
add esi, 0x19
jmp 0x40ed7a
mov eax, dword [ebp - 4]
test eax, eax
jge 0x40ed0d
mov esi, dword [ebp + 0xc]
and esi, 0xff
add esi, 0x23
jmp 0x40ed7a
mov eax, dword [ebp - 8]
test eax, eax
mov esi, dword [ebp + 0xc]
jge 0x40ed5e
and esi, 0xff
add esi, 0x2d
jmp 0x40ed7a
mov ecx, dword [ebp - 4]
test ecx, ecx
jge 0x40ed4c
cmp al, 0x41
jb 0x40ed4c
cmp al, 0x5a
ja 0x40ed4c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
and ecx, 0xff
shl ecx, 8
and edx, 0xff
lea esi, [ecx + edx - 0x40]
jmp 0x40ed7d
mov ecx, dword [ebp - 8]
test ecx, ecx
jge case.0x40eba8.257
cmp al, 0x41
jb 0x40ed66
cmp al, 0x5a
ja 0x40ed66
mov esi, dword [ebp + 0xc]
and esi, 0xff
jmp 0x40ed7a
cmp al, 0x30
jb case.0x40eba8.257
cmp al, 0x39
ja case.0x40eba8.257
mov esi, dword [ebp + 0xc]
and esi, 0xff
add esi, 0x76
shl esi, 8
push esi
call fcn.0040e890
add esp, 4
test eax, eax
je 0x40ee2a
call fcn.0044edd0
push 0xffffffffffffffff
call fcn.0044dd60
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
movsx eax, byte [ebp + 0xc]
push eax
call fcn.0040e8a0
add esp, 4
test eax, eax
je 0x40ee45
call fcn.0044edd0
push 0xffffffffffffffff
call fcn.0044dd60
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
lea eax, [esi - 3]
cmp eax, 0x18
ja case.0x40ede5.7
xor ecx, ecx
mov cl, byte [eax + 0x40ee80]
jmp dword [ecx*4 + 0x40ee6c]
mov esi, 0xe08
jmp 0x40ee2a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
test ax, ax
setge dl
dec edx
and edx, 0xfffffff7
add edx, 0xf09
mov esi, edx
jmp 0x40ee2a
mov esi, 0x1c0d
jmp 0x40ee2a
mov esi, 0x11b
jmp 0x40ee2a
cmp esi, 0x1b
jbe 0x40ee45
and esi, 0xff
mov eax, dword [0x49f2e8]
cmp eax, 0x400
jl 0x40ee38
xor eax, eax
mov dword [eax*4 + 0x49f2ec], esi
inc eax
mov dword [0x49f2e8], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret