Function at 0x405c40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51b114
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x27c0
call fcn.004fa540
mov eax, dword [0x5662f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x27ac], eax
mov dword [ebp - 4], 0
push 0
push eax
mov byte [ebp - 4], 2
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
mov dword [ebp - 0x27a8], eax
test edi, edi
je 0x40642f
mov esi, dword [0x56ee6c]
lea eax, [ebp - 0x27bc]
push eax
lea ebx, [ebp - 0x27a8]
call fcn.00406e10
cmp dword [ebp - 0x27bc], esi
je 0x405d57
mov eax, ebx
call fcn.00406c10
mov edx, dword [eax]
lea ecx, [ebp - 0x27c4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x405cfe
cmp dword [ebp - 0x27c4], 0x103
jne 0x405cfe
mov eax, dword [ebp - 0x27ac]
push 0
push eax
push edi
jmp 0x405c8f
lea eax, [ebp - 0x27a8]
call fcn.00406c10
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x27cc]
push edx
lea eax, [ebp - 0x27a8]
call fcn.00406ee0
mov esi, dword [ebp - 0x27cc]
mov ebx, dword [ebp - 0x27c8]
xor ecx, ecx
mov eax, esi
cmp eax, ebx
je 0x405d3d
mov eax, dword [eax]
inc ecx
jmp 0x405d34
mov eax, dword [0x56ee6c]
cmp esi, dword [eax]
jne 0x405eb0
cmp ebx, eax
jne 0x405eb0
call fcn.00407100
cmp byte [ebp + 0x28], 0
je 0x405ec8
sub esp, 0x1c
mov edi, esp
xor eax, eax
mov dword [ebp - 0x27b0], esp
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
lea ecx, [ebp + 0xc]
mov word [edi], ax
push ecx
or eax, 0xffffffff
call fcn.00404e20
mov ecx, dword [ebp - 0x27a8]
call fcn.004064a0
add esp, 0x1c
test eax, eax
jne 0x405ec8
mov edi, dword [ebp - 0x27a8]
lea esi, [ebp - 0x2794]
call fcn.00401bc0
push eax
lea ecx, [ebp - 0x2740]
mov byte [ebp - 4], 3
call fcn.00401140
add esp, 4
push eax
mov eax, str.Window_is_not_the_right_process_skipping
lea ecx, [ebp - 0x2778]
mov byte [ebp - 4], 4
call fcn.004031c0
add esp, 4
push eax
mov eax, 0x5491e4
lea ecx, [ebp - 0x275c]
mov byte [ebp - 4], 5
call fcn.004030d0
mov edi, 0x10
add esp, 4
cmp dword [ebp - 0x2748], edi
jb 0x405e12
mov edx, dword [ebp - 0x275c]
push edx
call fcn.004078b0
add esp, 4
xor ebx, ebx
mov esi, 0xf
mov dword [ebp - 0x2748], esi
mov dword [ebp - 0x274c], ebx
mov byte [ebp - 0x275c], bl
cmp dword [ebp - 0x2764], edi
jb 0x405e42
mov eax, dword [ebp - 0x2778]
push eax
call fcn.004078b0
add esp, 4
mov dword [ebp - 0x2764], esi
mov dword [ebp - 0x2768], ebx
mov byte [ebp - 0x2778], bl
cmp dword [ebp - 0x272c], edi
jb 0x405e6b
mov ecx, dword [ebp - 0x2740]
push ecx
call fcn.004078b0
add esp, 4
mov dword [ebp - 0x272c], esi
mov dword [ebp - 0x2730], ebx
mov byte [ebp - 0x2740], bl
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2780], 8
jb 0x405e99
mov edx, dword [ebp - 0x2794]
push edx
call fcn.004078b0
add esp, 4
mov eax, dword [ebp - 0x27ac]
mov ecx, dword [ebp - 0x27a8]
push ebx
push eax
push ecx
push ebx
jmp 0x405c91
cmp esi, ebx
je 0x405d57
push esi
mov esi, dword [esi]
lea edi, [ebp - 0x27d0]
call fcn.00407030
jmp 0x405eb0
mov esi, dword [ebp - 0x27a8]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40648d
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40648d
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x405fd7
mov edi, esi
lea esi, [ebp - 0x2794]
call fcn.00401bc0
push eax
lea ecx, [ebp - 0x275c]
mov byte [ebp - 4], 6
call fcn.00401140
add esp, 4
push eax
mov eax, str.Window_doesnt_have_a_window_name_skipping
lea ecx, [ebp - 0x2778]
mov byte [ebp - 4], 7
call fcn.004031c0
add esp, 4
push eax
mov eax, 0x5491e4
lea ecx, [ebp - 0x2740]
mov byte [ebp - 4], 8
call fcn.004030d0
mov edi, 0x10
add esp, 4
cmp dword [ebp - 0x272c], edi
jb 0x405f67
mov edx, dword [ebp - 0x2740]
push edx
call fcn.004078b0
add esp, 4
xor ebx, ebx
mov esi, 0xf
mov dword [ebp - 0x272c], esi
mov dword [ebp - 0x2730], ebx
mov byte [ebp - 0x2740], bl
cmp dword [ebp - 0x2764], edi
jb 0x405f97
mov eax, dword [ebp - 0x2778]
push eax
call fcn.004078b0
add esp, 4
mov dword [ebp - 0x2764], esi
mov dword [ebp - 0x2768], ebx
mov byte [ebp - 0x2778], bl
cmp dword [ebp - 0x2748], edi
jb 0x405fc0
mov ecx, dword [ebp - 0x275c]
push ecx
call fcn.004078b0
add esp, 4
mov dword [ebp - 0x2748], esi
mov dword [ebp - 0x274c], ebx
mov byte [ebp - 0x275c], bl
jmp 0x405e7d
cmp byte [ebp + 0x2c], 0
je 0x406077
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x406077
lea edx, [ebp - 0x27b8]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x406077
lea eax, [ebp - 0x27b8]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x406077
lea ecx, [ebp - 0x27a4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x406077
mov eax, dword [ebp - 0x27b8]
test eax, eax
jle 0x406077
cmp eax, dword [ebp - 0x279c]
jge 0x406077
mov eax, dword [ebp - 0x27b4]
test eax, eax
jle 0x406077
cmp eax, dword [ebp - 0x2798]
jge 0x406077
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x27b0], esp
push str.Window_is_being_dragged_r_n
call fcn.004057b0
call fcn.00401c60
mov edx, dword [ebp - 0x27ac]
add esp, 0x1c
push 0
push edx
push esi
jmp 0x405c8f
mov edi, dword [ebp - 0x27a8]
lea esi, [ebp - 0x2794]
call fcn.00401bc0
push eax
lea ecx, [ebp - 0x275c]
mov byte [ebp - 4], 9
call fcn.00401140
add esp, 4
push eax
mov eax, str.Launching_new_ad_window_for
lea ecx, [ebp - 0x2778]
mov byte [ebp - 4], 0xa
call fcn.004031c0
add esp, 4
push eax
mov eax, 0x5491e4
lea ecx, [ebp - 0x2740]
mov byte [ebp - 4], 0xb
call fcn.004030d0
mov ebx, 0x10
add esp, 4
cmp dword [ebp - 0x272c], ebx
jb 0x4060e7
mov eax, dword [ebp - 0x2740]
push eax
call fcn.004078b0
add esp, 4
xor edi, edi
mov esi, 0xf
mov dword [ebp - 0x272c], esi
mov dword [ebp - 0x2730], edi
mov byte [ebp - 0x2740], 0
cmp dword [ebp - 0x2764], ebx
jb 0x406118
mov ecx, dword [ebp - 0x2778]
push ecx
call fcn.004078b0
add esp, 4
mov dword [ebp - 0x2764], esi
mov dword [ebp - 0x2768], edi
mov byte [ebp - 0x2778], 0
cmp dword [ebp - 0x2748], ebx
jb 0x406142
mov edx, dword [ebp - 0x275c]
push edx
call fcn.004078b0
add esp, 4
mov ebx, 8
mov byte [ebp - 4], 2
mov dword [ebp - 0x2748], esi
mov dword [ebp - 0x274c], edi
mov byte [ebp - 0x275c], 0
cmp dword [ebp - 0x2780], ebx
jb 0x406175
mov eax, dword [ebp - 0x2794]
push eax
call fcn.004078b0
add esp, 4
mov edi, dword [ebp - 0x27a8]
lea esi, [ebp - 0x2794]
call fcn.00401bc0
mov edi, dword [0x568780]
cmp dword [0x568794], ebx
jae 0x406199
mov edi, 0x568780
cmp dword [ebp + 0x44], ebx
jb 0x4061a9
mov ecx, dword [ebp + 0x30]
mov dword [ebp - 0x27b0], ecx
jmp 0x4061b2
lea edx, [ebp + 0x30]
mov dword [ebp - 0x27b0], edx
cmp dword [eax + 0x14], ebx
jb 0x4061bb
mov esi, dword [eax]
jmp 0x4061bd
mov esi, eax
mov edx, dword [0x56872c]
cmp dword [0x568740], ebx
jae 0x4061d0
mov edx, 0x56872c
mov ecx, dword [0x568710]
cmp dword [0x568724], ebx
jae 0x4061e3
mov ecx, 0x568710
mov eax, dword [0x56838c]
cmp dword [0x5683a0], ebx
jae 0x4061f5
mov eax, 0x56838c
push edi
mov edi, dword [ebp - 0x27b0]
push edi
push esi
push edx
push ecx
push eax
lea edx, [ebp - 0x2724]
call fcn.004074b0
add esp, 0x18
cmp dword [ebp - 0x2780], ebx
jb 0x406226
mov eax, dword [ebp - 0x2794]
push eax
call fcn.004078b0
add esp, 4
mov ecx, dword [0x568764]
cmp dword [0x568778], ebx
jae 0x406239
mov ecx, 0x568764
lea edx, [ebp - 0x27c0]
push edx
lea edx, [ebp - 0x2724]
call fcn.00401980
xor ebx, ebx
add esp, 4
cmp eax, ebx
jne 0x4063bd
push 0x20
mov edi, 0xf
push str.Failed_to_launch_new_ad_window_r_n
lea ecx, [ebp - 0x2740]
mov dword [ebp - 0x272c], edi
mov dword [ebp - 0x2730], ebx
mov byte [ebp - 0x2740], bl
call fcn.004056b0
mov esi, 0x10
cmp dword [ebp - 0x272c], esi
jb 0x40629d
mov eax, dword [ebp - 0x2740]
push eax
call fcn.004078b0
add esp, 4
push 0x568764
lea ecx, [ebp - 0x2794]
call fcn.00401140
add esp, 4
push eax
mov eax, str.Path:
lea ecx, [ebp - 0x2778]
mov byte [ebp - 4], 0xc
call fcn.004031c0
add esp, 4
push eax
mov eax, 0x548fe4
lea ecx, [ebp - 0x2740]
mov byte [ebp - 4], 0xd
call fcn.004030d0
add esp, 4
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], esi
jb 0x4062ed
mov edx, dword [eax]
jmp 0x4062ef
mov edx, eax
mov eax, edx
mov dword [ebp - 0x2748], edi
mov dword [ebp - 0x274c], ebx
mov byte [ebp - 0x275c], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406307
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x275c]
call fcn.004056b0
mov esi, 0x10
cmp dword [ebp - 0x2748], esi
jb 0x406339
mov ecx, dword [ebp - 0x275c]
push ecx
call fcn.004078b0
add esp, 4
mov dword [ebp - 0x2748], edi
mov dword [ebp - 0x274c], ebx
mov byte [ebp - 0x275c], 0
cmp dword [ebp - 0x272c], esi
jb 0x406363
mov edx, dword [ebp - 0x2740]
push edx
call fcn.004078b0
add esp, 4
mov dword [ebp - 0x272c], edi
mov dword [ebp - 0x2730], ebx
mov byte [ebp - 0x2740], 0
cmp dword [ebp - 0x2764], esi
jb 0x40638d
mov eax, dword [ebp - 0x2778]
push eax
call fcn.004078b0
add esp, 4
mov byte [ebp - 4], 2
mov dword [ebp - 0x2764], edi
mov dword [ebp - 0x2768], ebx
mov byte [ebp - 0x2778], 0
cmp dword [ebp - 0x2780], esi
jb 0x4063d8
mov ecx, dword [ebp - 0x2794]
push ecx
call fcn.004078b0
add esp, 4
jmp 0x4063d8
lea eax, [ebp - 0x27a8]
call fcn.00406c10
mov edx, dword [ebp - 0x27c0]
mov edi, 0xf
mov dword [eax], edx
lea esi, [edi + 1]
push 0x1d
push str.Checking_for_another_window_r_n
lea ecx, [ebp - 0x2740]
mov dword [ebp - 0x272c], edi
mov dword [ebp - 0x2730], ebx
mov byte [ebp - 0x2740], 0
call fcn.004056b0
cmp dword [ebp - 0x272c], esi
jb 0x406414
mov eax, dword [ebp - 0x2740]
push eax
call fcn.004078b0
add esp, 4
mov ecx, dword [ebp - 0x27ac]
mov edx, dword [ebp - 0x27a8]
push ebx
push ecx
push edx
push ebx
jmp 0x405c91
mov esi, 8
cmp dword [ebp + 0x20], esi
jb 0x406445
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004078b0
add esp, 4
xor edx, edx
mov dword [ebp + 0x20], 7
mov dword [ebp + 0x1c], 0
mov word [ebp + 0xc], dx
cmp dword [ebp + 0x44], esi
jb 0x40646a
mov eax, dword [ebp + 0x30]
push eax
call fcn.004078b0
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004f5f9c
mov esp, ebp
pop ebp
ret 0x44
mov eax, dword [ebp - 0x27ac]
push 0
push eax
push esi
jmp 0x405c8f