Function at 0x403d96
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x12c
mov eax, dword [0x4b000c]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push esi
push edi
lea eax, [esp + 0x34]
mov esi, edx
push eax
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
lea eax, [esp + 0x2c]
mov edi, esi
push eax
lea eax, [esp + 0x3c]
shr edi, 0x10
push eax
and edi, 0x1ff
push edi
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
test eax, eax
jle 0x403666
mov al, byte [esp + 0x28]
cmp al, 0x60
je 0x403649
cmp al, 0x7e
je 0x403649
cmp al, 0xb2
jne 0x403666
pop edi
pop esi
mov eax, 0x13f
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
lea eax, [ebx - 8]
cmp eax, 0x7f
ja case.0x403679.10
movzx eax, byte [eax + 0x403ef0]
jmp dword [eax*4 + 0x403e08]
push 0
push 0xa1
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
xor ecx, ecx
cmp edi, eax
pop edi
sete cl
pop esi
pop ebx
lea eax, [ecx + 0x11f]
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
test esi, 0x1000000
je 0x4036d7
pop edi
pop esi
mov eax, 0x122
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
push 0
push 0
mov esi, eax
lea eax, [esp + 0x18]
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x403723
mov eax, dword [esp + 0x10]
cmp eax, 0x100
je 0x403708
cmp eax, 0x104
jne 0x403723
cmp dword [esp + 0x14], 0x12
jne 0x403723
test dword [esp + 0x18], 0x1000000
je 0x403723
cmp dword [esp + 0x1c], esi
je 0x403deb
pop edi
pop esi
mov eax, 0x121
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
and esi, 0x1000000
neg esi
pop edi
sbb esi, esi
neg esi
lea eax, [esi + 0x123]
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
and esi, 0x1000000
neg esi
pop edi
sbb esi, esi
and esi, 0x18
lea eax, [esi + 0x126]
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x101
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x125
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x127
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x12c
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x12d
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x12a
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x12b
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x128
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x129
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x11d
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x11b
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x11e
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x11c
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x102
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x103
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x104
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x105
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x106
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x107
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x108
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x109
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x10a
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x10b
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x10c
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x10d
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x10e
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x10f
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x110
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x111
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x112
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x113
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x114
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x115
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x116
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x117
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, pe_nt_image_headers32
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x119
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x20
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x12e
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x12f
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x130
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x131
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x132
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x133
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x134
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x135
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x136
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x137
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x138
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x139
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x13a
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x13b
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
pop edi
pop esi
mov eax, 0x13c
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
push 2
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp dword [0xc0da24], 0
movzx eax, ax
push eax
je 0x403db4
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x403dba
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, eax
cmp ecx, 0x20
jb 0x403dc6
cmp ecx, 0x7e
jbe 0x403dd1
lea eax, [ecx - 0xa0]
cmp eax, 0x5f
ja 0x403deb
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret
mov ecx, dword [esp + 0x134]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046ad4d
add esp, 0x12c
ret