Function at 0x40aae0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x28]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x34]
cmp ebp, 0x11f
ja 0x40af64
cmp ebp, 0x11f
je 0x40af3c
cmp ebp, 0x100
ja 0x40ac53
je 0x40ab97
lea eax, [ebp - 5]
cmp eax, 0x1b
ja case.default.0x40af85
xor ecx, ecx
mov cl, byte [eax + 0x40b2f4]
jmp dword [ecx*4 + 0x40b2e0]
mov ecx, edi
call fcn.0040bb00
jmp case.default.0x40af85
cmp dx, 1
jne case.default.0x40af85
push 0
mov ecx, edi
call fcn.0040b950
test eax, eax
je case.default.0x40af85
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 0x10
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ebp
push ecx
call dword [edi + 0x15bc]
mov ecx, edi
mov esi, eax
call fcn.004201b0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor esi, esi
call ebx
test ax, ax
jge 0x40abad
mov esi, 1
push 0x11
call ebx
test ax, ax
jge 0x40abb9
or esi, 2
mov ecx, dword [esp + 0x34]
xor eax, eax
xor edx, edx
mov dl, byte [eax + str.___.]
cmp ecx, edx
je 0x40abd3
inc eax
cmp eax, 0x13
jb 0x40abbf
jmp 0x40abe9
inc eax
push esi
push eax
mov ecx, edi
call fcn.00423500
test eax, eax
jne case.default.0x40af85
mov ecx, dword [esp + 0x34]
lea eax, [ecx - 0xd]
cmp eax, 0x1a
ja case.default.0x40af85
xor ecx, ecx
mov cl, byte [eax + 0x40b324]
jmp dword [ecx*4 + 0x40b310]
mov ecx, edi
call fcn.00420020
jmp case.default.0x40af85
mov edx, dword [edi + 0x30]
mov ecx, edi
dec edx
push edx
call fcn.00420180
jmp case.default.0x40af85
mov eax, dword [edi + 0x30]
mov ecx, edi
inc eax
push eax
call fcn.00420180
jmp case.default.0x40af85
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x40ac47
push 1
mov ecx, edi
call fcn.0041e140
jmp case.default.0x40af85
mov ecx, edi
call fcn.0041e180
jmp case.default.0x40af85
mov eax, ebp
sub eax, 0x102
je 0x40af12
sub eax, 0xf
je 0x40ad13
sub eax, 2
jne case.default.0x40af85
mov eax, ecx
dec eax
je 0x40ac8c
sub eax, 2
jne case.default.0x40af85
mov ecx, edi
call fcn.00423300
jmp case.default.0x40af85
mov eax, dword [edi + 0x1520]
test eax, eax
jne 0x40acfe
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, dword [esp + 0x2c]
cmp esi, eax
jne 0x40acf5
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jl 0x40acf5
cmp eax, dword [esp + 0x20]
jg 0x40acf5
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jl 0x40acf5
cmp eax, dword [esp + 0x24]
jle 0x40acfe
push 1
mov ecx, edi
call fcn.0041f960
push 1
mov ecx, edi
call fcn.00422c30
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov eax, ecx
and eax, 0xffff
cmp eax, 0x4e4a
jg 0x40ae41
je 0x40ae35
add eax, 0xffffb1c7
cmp eax, 0x10
ja case.default.0x40af85
xor ecx, ecx
mov cl, byte [eax + 0x40b364]
jmp dword [ecx*4 + 0x40b340]
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x40ad64
push 1
mov ecx, edi
call fcn.0041e140
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, edi
call fcn.0041e180
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [edi + 0x1490]
xor edx, edx
test ecx, ecx
sete dl
push 2
mov ecx, edi
mov dword [edi + 0x1490], edx
mov dword [edi + 0x1494], 0
call fcn.00420050
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
push 0
push 0x8000
mov ecx, edi
call fcn.0041fe70
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
push 0
push 0x20000
mov ecx, edi
call fcn.0041fe70
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, edi
call fcn.00420020
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [edi + 0x30]
mov ecx, edi
inc eax
push eax
call fcn.00420180
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [edi + 0x30]
dec ecx
push ecx
mov ecx, edi
call fcn.00420180
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
push 0
mov ecx, edi
call fcn.00420180
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
lea edx, [edi + 0x15dc]
push edx
jmp 0x40adab
cmp eax, 0xe122
jg 0x40aecd
je 0x40aebd
cmp eax, 0x4e4e
jg 0x40aea2
je 0x40ae8f
sub eax, 0x4e4b
je 0x40ae76
dec eax
jne case.default.0x40af85
call fcn.00408b40
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [edi + 0x44]
xor eax, eax
test ecx, ecx
sete al
mov dword [edi + 0x44], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, edi
call fcn.0041ff90
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
cmp eax, 0xe120
jne case.default.0x40af85
push 0
push 7
mov ecx, edi
call fcn.00423500
jmp case.default.0x40af85
push 0
push 0xa
mov ecx, edi
call fcn.00423500
jmp case.default.0x40af85
sub eax, 0xe123
je 0x40af02
sub eax, 2
je 0x40aef2
sub eax, 5
jne case.default.0x40af85
push 0
push 0xc
mov ecx, edi
call fcn.00423500
jmp case.default.0x40af85
push 0
push 0xb
mov ecx, edi
call fcn.00423500
jmp case.default.0x40af85
push 0
push 9
mov ecx, edi
call fcn.00423500
jmp case.default.0x40af85
cmp ecx, 9
je case.default.0x40af85
cmp ecx, 0xd
je case.default.0x40af85
cmp ecx, 8
je case.default.0x40af85
push 0
push ecx
mov ecx, edi
call fcn.00423500
jmp case.default.0x40af85
mov eax, ecx
shr eax, 0x10
test al, 0x10
je case.default.0x40af85
and ecx, 0xffff
push ecx
push edx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
mov ecx, edi
call fcn.0040a880
jmp case.default.0x40af85
cmp ebp, 0x215
ja 0x40b1eb
je 0x40b1d0
lea eax, [ebp - 0x200]
cmp eax, 4
ja case.default.0x40af85
jmp dword [eax*4 + 0x40b378]
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
movsx edx, ax
shr eax, 0x10
movsx eax, ax
push ecx
mov ecx, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.0041f7f0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [edi + 0x15c4]
test eax, eax
je 0x40afd7
push 1
mov ecx, edi
call fcn.0040b950
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
movsx edx, ax
shr eax, 0x10
mov dword [esp + 0x10], edx
and ecx, 1
movsx eax, ax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x1c], eax
call fcn.0041f610
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 0x38]
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ecx
push eax
mov ecx, edi
mov dword [esp + 0x18], edx
call fcn.0041f8e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [edi + 0x5d0]
mov ebp, 1
test eax, eax
je 0x40b053
mov ebp, dword [esp + 0x38]
mov ebx, 0x79
jmp 0x40b086
mov eax, dword [edi + 0x4c]
mov ebx, 0x74
test eax, eax
jne 0x40b086
mov eax, dword [edi + 0xac]
test eax, eax
je 0x40b086
mov eax, dword [edi + 0x14a0]
test eax, eax
jne 0x40b077
xor ebp, ebp
jmp 0x40b086
mov edx, dword [edi + 0x48]
xor ecx, ecx
cmp edx, ebp
setle cl
add ecx, 2
mov ebp, ecx
mov eax, dword [edi + 0x15d0]
mov edx, ebx
and edx, 0xffff
push edx
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push 0
push eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
cmp bx, 0x74
mov esi, eax
jne 0x40b168
mov ebx, dword [sym.imp.USER32.dll_DeleteMenu]
cmp ebp, 1
je 0x40b0ca
push 0
push 0x4e4d
push esi
call ebx
cmp ebp, 2
je 0x40b115
push 0x400
push 9
push esi
call ebx
push 0x400
push 6
push esi
call ebx
push 0
push 0x4e47
push esi
call ebx
push 0
push 0x4e4b
push esi
call ebx
push 0
push 0x4e39
push esi
call ebx
push 0
push 0x4e48
push esi
call ebx
push 0
push 0x4e49
push esi
call ebx
cmp ebp, 1
je 0x40b11e
test ebp, ebp
jne 0x40b168
push 0x400
push 4
push esi
call ebx
push 0
push 0x4e3c
push esi
call ebx
push 0
push 0x4e42
push esi
call ebx
push 0
push 0x4e4e
push esi
call ebx
push 0
push 0x4e3e
push esi
call ebx
push 0
push 0x4e4a
push esi
call ebx
test ebp, ebp
jne 0x40b168
push 0x400
push 1
push esi
call ebx
push esi
mov ecx, edi
call fcn.0040a880
mov eax, dword [esp + 0x38]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [esp + 0x10], ecx
mov dword [edi + 0x15dc], ecx
mov dword [edi + 0x15e0], eax
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
push ecx
push edi
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push edi
push 0
push edx
push eax
push 2
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.USER32.dll_DestroyMenu]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov esi, dword [edi + 0x15d4]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, esi
je case.default.0x40af85
push 0
mov ecx, edi
call fcn.0041f960
jmp case.default.0x40af85
mov eax, ebp
sub eax, 0x30f
je 0x40b26b
sub eax, 2
je 0x40b219
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ebp
push ecx
call dword [edi + 0x15bc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
cmp eax, edi
je case.0x40ab2f.7
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
call fcn.0040bd50
call fcn.0040bde0
mov ebx, dword [sym.imp.GDI32.dll_SelectPalette]
push 0
push eax
push esi
call ebx
push esi
mov ebp, eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 1
push ebp
push esi
call ebx
push esi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
call fcn.0040bc80
mov ebx, eax
test ebx, ebx
je case.0x40ab2f.7
mov ebp, dword [esp + 0x2c]
push ebp
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
mov esi, eax
push 0
push ebx
push esi
call edi
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
call fcn.0040bd50
call fcn.0040bde0
push 0
push eax
push esi
call edi
push esi
call dword [sym.imp.GDI32.dll_RealizePalette]
mov edx, dword [esp + 0x38]
push 1
push edx
push esi
call edi
push esi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 0x10