Function at 0x40bd0e
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48cdb8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4bf454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
cmp eax, 0x14
ja 0x40bcad
je case.default.0x40bf29
dec eax
cmp eax, 7
ja case.default.0x40bccc
jmp dword [eax*4 + 0x40bf94]
mov eax, dword [edi + 4]
lea ecx, [edi + 0x1b0]
push eax
mov dword [edi + 0x94], eax
call fcn.00460ea0
jmp case.default.0x40bf29
call fcn.0040c980
mov byte [edi + 0xc0], 1
jmp case.default.0x40bf29
mov ecx, dword [edi + 0x84]
call fcn.00449c30
jmp case.default.0x40bf29
mov ecx, dword [edi + 0x84]
mov word [edi + 0x1cc], 0
call fcn.004499d0
jmp case.default.0x40bf29
cmp eax, 0x114
ja 0x40be1e
je 0x40bdac
add eax, 0xffffff00
cmp eax, 7
ja case.default.0x40bccc
jmp dword [eax*4 + 0x40bfb4]
mov esi, dword [edi + 0x1d4]
lea ecx, [ebp - 0x14]
lea eax, [esi + 0x28]
push eax
call fcn.0044c870
mov bl, byte [esi + 0xc]
lea ecx, [ebp - 0x14]
call fcn.0044c890
test bl, bl
jne case.default.0x40bf29
push dword [ebp + 0x10]
mov ecx, dword [edi + 0x84]
push dword [ebp + 0xc]
call fcn.004498e0
jmp case.default.0x40bf29
mov esi, dword [edi + 0x1d4]
lea ecx, [ebp - 0x1c]
lea eax, [esi + 0x28]
push eax
call fcn.0044c870
mov bl, byte [esi + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.0044c890
test bl, bl
jne case.default.0x40bf29
mov esi, dword [ebp + 0x10]
mov ecx, 0xe5
movzx eax, word [ebp + 0xc]
mov ebx, esi
shr ebx, 0x1f
not bl
and bl, 1
cmp ax, cx
jne 0x40bd70
mov eax, esi
shr eax, 0x10
movzx ecx, al
shr eax, 8
test al, 1
push 3
lea eax, [ecx + 0xe000]
cmove eax, ecx
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
cmp ax, 0x11
jne 0x40bd8e
mov ecx, dword [edi + 0x84]
push esi
push eax
mov byte [edi + 0x1cc], bl
call fcn.00449d20
jmp case.default.0x40bf29
cmp ax, 0x12
jne 0x40bd9a
mov byte [edi + 0x1cd], bl
mov ecx, dword [edi + 0x84]
push esi
push eax
call fcn.00449d20
jmp case.default.0x40bf29
mov eax, dword [ebp + 0xc]
movzx ecx, ax
cmp ecx, 5
ja case.default.0x40bf29
jmp dword [ecx*4 + 0x40bfd4]
shr eax, 0x10
lea ecx, [edi + 0x94]
push eax
call fcn.00427320
jmp 0x40bf70
push 5
lea ecx, [edi + 0x94]
call fcn.004274e0
jmp 0x40bf70
push 0
lea ecx, [edi + 0x94]
call fcn.004274e0
jmp 0x40bf70
push 5
lea ecx, [edi + 0x94]
call fcn.00427590
jmp 0x40bf70
push 0
lea ecx, [edi + 0x94]
call fcn.00427590
jmp 0x40bf70
cmp eax, 0x115
je 0x40bf1e
cmp eax, 0x308
jne case.default.0x40bccc
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je case.default.0x40bccc
mov esi, dword [edi + 0x1d4]
lea ecx, [ebp - 0x14]
lea eax, [esi + 0x28]
push eax
call fcn.0044c870
mov bl, byte [esi + 0xd]
lea ecx, [ebp - 0x14]
call fcn.0044c890
test bl, bl
je case.default.0x40bccc
lea ecx, [ebp - 0x34]
call fcn.0044cc70
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x1b0]
call fcn.00460c40
test al, al
je 0x40befe
lea esi, [edi + 0x1bc]
push esi
lea ecx, [ebp - 0x34]
call fcn.0044cd80
push 0x4aa998
test al, al
je 0x40bed0
lea ecx, [ebp - 0x24]
call fcn.0044cbc0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.0044cd60
lea ecx, [ebp - 0x24]
call fcn.0044cd00
lea ecx, [ebp - 0x34]
call fcn.0044cd00
jmp case.default.0x40bf29
lea ecx, [ebp - 0x44]
call fcn.0044cbc0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.0044cd60
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.0044cd00
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.0040cde0
lea ecx, [ebp - 0x34]
call fcn.0044cd00
jmp case.default.0x40bf29
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, ax
cmp ecx, 5
ja case.default.0x40bf29
jmp dword [ecx*4 + 0x40bfec]
shr eax, 0x10
lea ecx, [edi + 0x94]
push eax
call fcn.004272b0
jmp 0x40bf70
push 5
lea ecx, [edi + 0x94]
call fcn.00427430
jmp 0x40bf70
push 0
lea ecx, [edi + 0x94]
call fcn.00427430
jmp 0x40bf70
push 5
jmp 0x40bf65
push 0
lea ecx, [edi + 0x94]
call fcn.00427390
push 1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc