Function at 0x40adb7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp byte [edi], 0
push ebx
jne 0x40ade2
cmp byte [edi + 1], 0
jne 0x40ade2
cmp byte [edi + 2], 0
jne 0x40ade2
cmp byte [edi + 3], 0
jne 0x40ade2
cmp byte [edi + 4], 0
je 0x40aff7
mov eax, dword [esi + 0x20]
test eax, eax
je 0x40af0e
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x40af0e
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp byte [edi], 0
mov al, 0x80
je 0x40ae19
xor byte [ebp - 0xf8], al
xor byte [ebp - 0x68], al
cmp byte [edi + 1], 0
je 0x40ae28
xor byte [ebp - 0xf8], al
xor byte [ebp - 0x67], al
cmp byte [edi + 2], 0
je 0x40ae34
xor byte [ebp - 0xf7], al
cmp byte [edi + 3], 0
je 0x40ae40
xor byte [ebp - 0xf6], al
cmp byte [edi + 4], 0
je 0x40ae4c
xor byte [ebp - 0xad], al
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [edi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x40ae6a
cmp byte [edi + 1], 0
je 0x40ae83
movzx eax, byte [esi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [esi + 0x20]
call ebx
cmp byte [edi + 2], 0
je 0x40aea2
movzx eax, byte [esi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [esi + 0x20]
call ebx
mov al, byte [edi + 3]
test al, al
je 0x40aee8
cmp byte [edi + 2], 0
jne 0x40aecb
cmp byte [esi + 0x1c], 0
jne 0x40aecb
movzx eax, byte [esi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x40aee3
test al, al
je 0x40aee8
movzx eax, byte [esi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [esi + 0x20]
call ebx
cmp byte [edi + 4], 0
je 0x40aff0
movzx eax, byte [esi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [esi + 0x20]
jmp 0x40afee
cmp byte [edi], 0
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
je 0x40af41
test byte [esi + 0xc], 4
mov al, byte [esi + 0x27]
mov byte [ebp - 4], al
je 0x40af33
push 2
push dword [ebp - 4]
mov cl, 0xa0
call fcn.0040b2cb
jmp 0x40af41
push 0
push 2
push dword [ebp - 4]
push 0xa0
call ebx
cmp byte [edi + 1], 0
je 0x40af6f
test byte [esi + 0xc], 4
mov al, byte [esi + 0x28]
mov byte [ebp - 4], al
je 0x40af61
push 2
push dword [ebp - 4]
mov cl, 0xa1
call fcn.0040b2cb
jmp 0x40af6f
push 0
push 2
push dword [ebp - 4]
push 0xa1
call ebx
cmp byte [edi + 2], 0
je 0x40af9a
test byte [esi + 0xc], 4
mov al, byte [esi + 0x24]
mov byte [ebp - 4], al
je 0x40af8f
push 2
push dword [ebp - 4]
mov cl, 0x11
call fcn.0040b2cb
jmp 0x40af9a
push 0
push 2
push dword [ebp - 4]
push 0x11
call ebx
cmp byte [edi + 3], 0
je 0x40afc5
test byte [esi + 0xc], 4
mov al, byte [esi + 0x25]
mov byte [ebp - 4], al
je 0x40afba
push 2
push dword [ebp - 4]
mov cl, 0x12
call fcn.0040b2cb
jmp 0x40afc5
push 0
push 2
push dword [ebp - 4]
push 0x12
call ebx
cmp byte [edi + 4], 0
je 0x40aff0
test byte [esi + 0xc], 4
mov al, byte [esi + 0x29]
mov byte [ebp - 4], al
je 0x40afe5
push 2
push dword [ebp - 4]
mov cl, 0x5b
call fcn.0040b2cb
jmp 0x40aff0
push 0
push 2
push dword [ebp - 4]
push 0x5b
call ebx
mov ecx, esi
call fcn.0040b288
pop ebx
leave
ret