Function at 0x40b540
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x437888]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x10], edi
cmp eax, 0x40
jae 0x40c123
mov byte [esp + eax + 0x18], 0
inc eax
cmp eax, 0x40
jl 0x40b563
xor eax, eax
cmp eax, 0x20
jae 0x40c123
mov byte [esp + eax + 0x5c], 0
inc eax
cmp eax, 0x20
jl 0x40b579
xor esi, esi
test ecx, ecx
jne 0x40ba3f
cmp dword [0x43ab64], esi
je 0x40b6bb
cmp edx, 0x100
je 0x40b5b4
cmp edx, 0x104
jne 0x40b677
mov ecx, dword [edi + 8]
mov esi, dword [edi + 4]
movzx edi, byte [edi]
and ecx, 1
je 0x40b5c8
or edi, 0x800
mov eax, esi
shl eax, 0x10
or edi, eax
xor eax, eax
cmp eax, 0x40
jae 0x40c123
mov byte [esp + eax + 0x18], 0
inc eax
cmp eax, 0x40
jl 0x40b5d4
mov ebx, dword [sym.imp.user32.dll_GetKeyNameTextA]
lea eax, [esp + 0x18]
shl ecx, 8
and esi, 0xff
push 0x38
or ecx, esi
push eax
shl ecx, 0x10
push ecx
call ebx
cmp byte [esp + 0x18], 0
jne 0x40b636
push 0x38
lea eax, [esp + 0x1c]
shl esi, 0x10
push eax
push esi
call ebx
cmp byte [esp + 0x18], 0
jne 0x40b636
movzx eax, di
push eax
push 0x433630
lea eax, [esp + 0x20]
push 0x3f
push eax
call fcn.0041d632
add esp, 0x10
lea eax, [esp + 0x18]
mov dword [0x43ad04], edi
push eax
push 0x443
push dword [0x43b03c]
call dword [sym.imp.user32.dll_SetDlgItemTextA]
push 0xffffffffffffffff
push 0
push 0xb1
push 0x443
push dword [0x43b03c]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_PostMessageA]
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
cmp eax, 0x90
je 0x40b6a5
cmp eax, 0x91
je 0x40b6a5
cmp eax, 0x14
je 0x40b6a5
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 4
cmp dword [0x43ab6c], esi
jne 0x40ba7a
cmp dword [0x43a7e8], esi
jne 0x40ba7a
cmp dword [0x43acfc], esi
jne 0x40ba7a
cmp dword [0x43ac9c], esi
jne 0x40ba7a
mov ecx, dword [edi]
cmp edx, 0x100
je 0x40b768
cmp edx, 0x104
je 0x40b768
cmp edx, 0x101
je 0x40b711
cmp edx, 0x105
jne 0x40b7c9
cmp ecx, 0x11
je 0x40b760
cmp ecx, 0xa2
je 0x40b760
cmp ecx, 0xa3
je 0x40b760
cmp ecx, 0x10
je 0x40b758
cmp ecx, 0xa0
je 0x40b758
cmp ecx, 0xa1
je 0x40b758
cmp ecx, 0x12
je 0x40b750
cmp ecx, 0xa4
je 0x40b750
cmp ecx, 0xa5
jne 0x40b7c9
mov dword [0x43aa24], esi
jmp 0x40b7c9
mov dword [0x43ad08], esi
jmp 0x40b7c9
mov dword [0x43b020], esi
jmp 0x40b7c9
cmp ecx, 0x11
je 0x40b7bf
cmp ecx, 0xa2
je 0x40b7bf
cmp ecx, 0xa3
je 0x40b7bf
cmp ecx, 0x10
je 0x40b7b3
cmp ecx, 0xa0
je 0x40b7b3
cmp ecx, 0xa1
je 0x40b7b3
cmp ecx, 0x12
je 0x40b7a7
cmp ecx, 0xa4
je 0x40b7a7
cmp ecx, 0xa5
jne 0x40b7c9
mov dword [0x43aa24], 1
jmp 0x40b7c9
mov dword [0x43ad08], 1
jmp 0x40b7c9
mov dword [0x43b020], 1
mov eax, dword [0x43aa24]
movzx ebx, cl
lea edi, [eax + eax]
or edi, dword [0x43ad08]
add edi, edi
or edi, dword [0x43b020]
test cl, cl
je 0x40ba3f
mov eax, dword [esp + 0x10]
test byte [eax + 8], 1
je 0x40b7fa
or ebx, 0x800
mov eax, dword [0x43ad04]
test eax, eax
je 0x40b83e
and eax, 0x8ff
cmp ebx, eax
jne 0x40b83e
cmp edx, 0x100
je 0x40b834
cmp edx, 0x104
je 0x40b834
cmp edx, 0x101
je 0x40b82c
cmp edx, 0x105
jne 0x40b83e
mov dword [0x43ac8c], esi
jmp 0x40b83e
mov dword [0x43ac8c], 1
mov ecx, dword [0x43ad0c]
test ecx, ecx
je 0x40b8bf
mov eax, ecx
and eax, 0x8ff
cmp ebx, eax
jne 0x40b8bf
shr ecx, 8
and ecx, 7
cmp edx, 0x101
je 0x40b869
cmp edx, 0x105
jne 0x40b87c
mov eax, dword [0x43a188]
test eax, eax
cmove eax, dword [0x43a130]
mov dword [0x43a188], eax
test ecx, ecx
jne 0x40b89c
cmp edx, 0x100
je 0x40b890
cmp edx, 0x104
jne 0x40b8bf
mov dword [0x43a18c], 1
jmp 0x40b8bf
cmp ecx, edi
jne 0x40b8bf
cmp edx, 0x100
je 0x40b8b0
cmp edx, 0x104
jne 0x40b8ba
mov dword [0x43a18c], 1
mov esi, 1
mov ecx, dword [0x43acd8]
test ecx, ecx
je 0x40b940
mov eax, ecx
and eax, 0x8ff
cmp ebx, eax
jne 0x40b940
shr ecx, 8
and ecx, 7
cmp edx, 0x101
je 0x40b8ea
cmp edx, 0x105
jne 0x40b8fd
mov eax, dword [0x43a39c]
test eax, eax
cmove eax, dword [0x43a130]
mov dword [0x43a39c], eax
test ecx, ecx
jne 0x40b91d
cmp edx, 0x100
je 0x40b911
cmp edx, 0x104
jne 0x40b940
mov dword [0x43a3a8], 1
jmp 0x40b940
cmp ecx, edi
jne 0x40b940
cmp edx, 0x100
je 0x40b931
cmp edx, 0x104
jne 0x40b93b
mov dword [0x43a3a8], 1
mov esi, 1
mov ecx, dword [0x43aca8]
test ecx, ecx
je 0x40b9c1
mov eax, ecx
and eax, 0x8ff
cmp ebx, eax
jne 0x40b9c1
shr ecx, 8
and ecx, 7
cmp edx, 0x101
je 0x40b96b
cmp edx, 0x105
jne 0x40b97e
mov eax, dword [0x43a398]
test eax, eax
cmove eax, dword [0x43a130]
mov dword [0x43a398], eax
test ecx, ecx
jne 0x40b99e
cmp edx, 0x100
je 0x40b992
cmp edx, 0x104
jne 0x40b9c1
mov dword [0x43a3a0], 1
jmp 0x40b9c1
cmp ecx, edi
jne 0x40b9c1
cmp edx, 0x100
je 0x40b9b2
cmp edx, 0x104
jne 0x40b9bc
mov dword [0x43a3a0], 1
mov esi, 1
mov ecx, dword [0x43ac94]
test ecx, ecx
je 0x40ba1d
mov eax, ecx
and eax, 0x8ff
cmp ebx, eax
jne 0x40ba1d
shr ecx, 8
and ecx, 7
cmp edx, 0x101
je 0x40b9ec
cmp edx, 0x105
jne 0x40b9ff
mov eax, dword [0x43a394]
test eax, eax
cmove eax, dword [0x43a130]
mov dword [0x43a394], eax
test ecx, ecx
jne 0x40ba55
cmp edx, 0x100
je 0x40ba13
cmp edx, 0x104
jne 0x40ba1d
mov dword [0x43a3a4], 1
test esi, esi
je 0x40ba3f
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, eax
mov eax, dword [0x43b668]
sub ecx, dword [eax + 0x258]
xor eax, eax
cmp ecx, 0x3e8
cmova esi, eax
mov ecx, dword [esp + 0x7c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 4
cmp ecx, edi
jne 0x40ba1d
cmp edx, 0x100
je 0x40ba69
cmp edx, 0x104
jne 0x40ba73
mov dword [0x43a3a4], 1
mov esi, 1
jmp 0x40ba21
cmp edx, 0x100
je 0x40bc37
cmp edx, 0x104
je 0x40bc37
cmp edx, 0x101
je 0x40baa6
cmp edx, 0x105
jne 0x40b677
mov ecx, dword [edi]
cmp ecx, 0xa0
jb 0x40bab8
cmp ecx, 0xb9
jbe 0x40bac4
lea eax, [ecx - 0x10]
cmp eax, 2
ja 0x40b677
cmp ecx, 0x11
je 0x40bb13
cmp ecx, 0xa2
je 0x40bb13
cmp ecx, 0xa3
je 0x40bb13
cmp ecx, 0x10
je 0x40bb0b
cmp ecx, 0xa0
je 0x40bb0b
cmp ecx, 0xa1
je 0x40bb0b
cmp ecx, 0x12
je 0x40bb03
cmp ecx, 0xa4
je 0x40bb03
cmp ecx, 0xa5
jne 0x40bb19
mov dword [0x43aa24], esi
jmp 0x40bb19
mov dword [0x43ad08], esi
jmp 0x40bb19
mov dword [0x43b020], esi
mov eax, dword [0x43aa24]
lea ecx, [esp + 0x18]
push 0
lea esi, [eax + eax]
or esi, dword [0x43ad08]
add esi, esi
or esi, dword [0x43b020]
push esi
call fcn.0040b480
cmp dword [0x43aa3c], 0
jne 0x40bc24
cmp dword [0x43ab6c], 0
je 0x40bb80
lea eax, [esp + 0x18]
push eax
push 0x440
push dword [0x43b03c]
call dword [sym.imp.user32.dll_SetDlgItemTextA]
push 0xffffffffffffffff
push 0
push 0xb1
push 0x440
push dword [0x43b03c]
jmp 0x40bc17
cmp dword [0x43a7e8], 0
je 0x40bbb5
lea eax, [esp + 0x18]
push eax
push 0x438
push dword [0x43b034]
call dword [sym.imp.user32.dll_SetDlgItemTextA]
push 0xffffffffffffffff
push 0
push 0xb1
push 0x438
push dword [0x43b034]
jmp 0x40bc17
cmp dword [0x43ac9c], 0
je 0x40bbe4
lea eax, [esp + 0x18]
push eax
push 0x42e
push dword [0x43b040]
call dword [sym.imp.user32.dll_SetDlgItemTextA]
push 0xffffffffffffffff
push 0
push 0xb1
push 0x42e
jmp 0x40bc11
cmp dword [0x43acfc], 0
je 0x40bc24
lea eax, [esp + 0x18]
push eax
push 0x42f
push dword [0x43b040]
call dword [sym.imp.user32.dll_SetDlgItemTextA]
push 0xffffffffffffffff
push 0
push 0xb1
push 0x42f
push dword [0x43b040]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_PostMessageA]
test esi, esi
jne 0x40b677
mov dword [0x43aa3c], esi
jmp 0x40b677
mov ebx, dword [edi]
mov eax, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], edx
cmp ebx, 0x11
je 0x40bc9e
cmp ebx, 0xa2
je 0x40bc9e
cmp ebx, 0xa3
je 0x40bc9e
cmp ebx, 0x10
je 0x40bc92
cmp ebx, 0xa0
je 0x40bc92
cmp ebx, 0xa1
je 0x40bc92
cmp ebx, 0x12
je 0x40bc86
cmp ebx, 0xa4
je 0x40bc86
cmp ebx, 0xa5
jne 0x40bca8
mov dword [0x43aa24], 1
jmp 0x40bca8
mov dword [0x43ad08], 1
jmp 0x40bca8
mov dword [0x43b020], 1
mov eax, dword [0x43aa24]
mov byte [esp + 0x18], 0
lea esi, [eax + eax]
or esi, dword [0x43ad08]
add esi, esi
or esi, dword [0x43b020]
je 0x40bd2a
cmp esi, 1
jne 0x40bcd1
push 0x4335d8
jmp 0x40bd17
cmp esi, 2
jne 0x40bcdd
push 0x4335e0
jmp 0x40bd17
cmp esi, 3
jne 0x40bce9
push 0x4335e8
jmp 0x40bd17
cmp esi, 4
jne 0x40bcf5
push 0x4335f4
jmp 0x40bd17
cmp esi, 5
jne 0x40bd01
push 0x4335fc
jmp 0x40bd17
cmp esi, 6
jne 0x40bd0d
push 0x433608
jmp 0x40bd17
cmp esi, 7
jne 0x40bd2a
push 0x433614
lea eax, [esp + 0x1c]
push 0x3f
push eax
call fcn.0041d64e
mov edx, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [sym.imp.user32.dll_SetDlgItemTextA]
cmp ebx, 0xa0
jb 0x40bd40
cmp ebx, 0xb9
jbe 0x40bd4c
lea eax, [ebx - 0x10]
cmp eax, 2
ja 0x40be95
test esi, esi
je 0x40c0cd
cmp dword [0x43aa3c], 0
jne 0x40b677
cmp dword [0x43ab6c], 0
je 0x40bd85
mov esi, dword [sym.imp.user32.dll_PostMessageA]
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x43aca8], 0
jmp 0x40c0e6
cmp dword [0x43a7e8], 0
je 0x40bddd
mov esi, dword [sym.imp.user32.dll_PostMessageA]
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x43ac94], 0
cmp dword [0x43a7e8], 0
je 0x40bdfc
lea eax, [esp + 0x18]
push eax
push 0x438
push dword [0x43b034]
call ecx
push 0xffffffffffffffff
push 0
push 0xb1
push 0x438
push dword [0x43b034]
call ebx
push eax
call esi
jmp 0x40b677
cmp dword [0x43ac9c], 0
je 0x40be35
mov esi, dword [sym.imp.user32.dll_PostMessageA]
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x43ad0c], 0
cmp dword [0x43ac9c], 0
je 0x40be58
lea eax, [esp + 0x18]
push eax
push 0x42e
push dword [0x43b040]
call ecx
push 0xffffffffffffffff
push 0
push 0xb1
push 0x42e
push dword [0x43b040]
call ebx
push eax
call esi
jmp 0x40b677
cmp dword [0x43acfc], 0
je 0x40b677
mov esi, dword [sym.imp.user32.dll_PostMessageA]
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x43acd8], 0
cmp dword [0x43acfc], 0
je 0x40b677
lea eax, [esp + 0x18]
push eax
push 0x42f
push dword [0x43b040]
call ecx
push 0xffffffffffffffff
push 0
push 0xb1
push 0x42f
push dword [0x43b040]
call ebx
push eax
call esi
jmp 0x40b677
movzx edi, bl
and edx, 1
je 0x40bea3
or edi, 0x800
mov ebx, dword [esp + 0x14]
mov eax, ebx
shl eax, 8
and ebx, 0xff
or eax, esi
shl edx, 8
shl eax, 8
or edx, ebx
or edi, eax
shl edx, 0x10
push 0x1f
lea eax, [esp + 0x60]
push eax
push edx
call dword [sym.imp.user32.dll_GetKeyNameTextA]
cmp byte [esp + 0x5c], 0
jne 0x40bf06
push 0x1f
lea eax, [esp + 0x60]
shl ebx, 0x10
push eax
push ebx
call dword [sym.imp.user32.dll_GetKeyNameTextA]
cmp byte [esp + 0x5c], 0
jne 0x40bf06
movzx eax, di
push eax
push 0x433630
lea eax, [esp + 0x64]
push 0x1f
push eax
call fcn.0041d632
add esp, 0x10
lea eax, [esp + 0x5c]
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.0040b480
xor eax, eax
test esi, esi
setne al
cmp dword [0x43ab6c], 0
mov dword [0x43aa3c], eax
je 0x40bf8b
lea eax, [esp + 0x18]
mov dword [0x43aca8], edi
push eax
mov eax, dword [sym.imp.user32.dll_SetDlgItemTextA]
push 0x440
push dword [0x43b03c]
call eax
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
push 0xffffffffffffffff
push 0
push 0xb1
push 0x440
push dword [0x43b03c]
call ebx
mov esi, dword [sym.imp.user32.dll_PostMessageA]
push eax
call esi
mov ecx, dword [0x43b03c]
mov edx, 0x441
call fcn.0040fa00
mov edi, dword [esp + 0x10]
mov ecx, dword [sym.imp.user32.dll_SetDlgItemTextA]
jmp 0x40c0d9
cmp dword [0x43a7e8], 0
je 0x40bff5
lea eax, [esp + 0x18]
mov dword [0x43ac94], edi
push eax
mov eax, dword [sym.imp.user32.dll_SetDlgItemTextA]
push 0x438
push dword [0x43b034]
call eax
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
push 0xffffffffffffffff
push 0
push 0xb1
push 0x438
push dword [0x43b034]
call ebx
mov esi, dword [sym.imp.user32.dll_PostMessageA]
push eax
call esi
mov ecx, dword [0x43b034]
mov edx, 0x437
call fcn.0040fa00
mov edi, dword [esp + 0x10]
mov ecx, dword [sym.imp.user32.dll_SetDlgItemTextA]
jmp 0x40c0d9
cmp dword [0x43ac9c], 0
je 0x40c05c
lea eax, [esp + 0x18]
mov dword [0x43ad0c], edi
push eax
mov eax, dword [sym.imp.user32.dll_SetDlgItemTextA]
push 0x42e
push dword [0x43b040]
call eax
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
push 0xffffffffffffffff
push 0
push 0xb1
push 0x42e
push dword [0x43b040]
call ebx
mov esi, dword [sym.imp.user32.dll_PostMessageA]
push eax
call esi
mov ecx, dword [0x43b040]
mov edx, 0x42c
call fcn.0040fa00
mov edi, dword [esp + 0x10]
mov ecx, dword [sym.imp.user32.dll_SetDlgItemTextA]
jmp 0x40c0d9
cmp dword [0x43acfc], 0
je 0x40c0c3
lea eax, [esp + 0x18]
mov dword [0x43acd8], edi
push eax
mov eax, dword [sym.imp.user32.dll_SetDlgItemTextA]
push 0x42f
push dword [0x43b040]
call eax
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
push 0xffffffffffffffff
push 0
push 0xb1
push 0x42f
push dword [0x43b040]
call ebx
mov esi, dword [sym.imp.user32.dll_PostMessageA]
push eax
call esi
mov ecx, dword [0x43b040]
mov edx, 0x42d
call fcn.0040fa00
mov edi, dword [esp + 0x10]
mov ecx, dword [sym.imp.user32.dll_SetDlgItemTextA]
jmp 0x40c0d9
mov edi, dword [esp + 0x10]
mov ecx, dword [sym.imp.user32.dll_SetDlgItemTextA]
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
mov esi, dword [sym.imp.user32.dll_PostMessageA]
cmp dword [0x43aa3c], 0
jne 0x40b677
cmp dword [0x43ab6c], 0
je 0x40bda4
lea eax, [esp + 0x18]
push eax
push 0x440
push dword [0x43b03c]
call ecx
push 0xffffffffffffffff
push 0
push 0xb1
push 0x440
push dword [0x43b03c]
call ebx
push eax
call esi
jmp 0x40b677
call fcn.0041dbcb
int3