Function at 0x40c9eb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
mov dword [ebp - 0x94], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x24]
and eax, 1
test eax, eax
je 0x40cf29
cmp dword [ebp - 4], 0x200
je 0x40ca4b
cmp dword [ebp - 4], 0xa0
je 0x40ca4b
cmp dword [ebp - 4], 0x202
je 0x40ca4b
cmp dword [ebp - 4], 0x205
je 0x40ca4b
cmp dword [ebp - 4], 0x208
jne 0x40cf29
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x40cf29
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl 0x40cf29
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x40cf29
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.00451508
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x40cabd
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x94]
je 0x40cabd
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x24]
and edx, 1
test edx, edx
jne 0x40cabd
mov ecx, dword [ebp - 0x38]
call fcn.004a6775
mov dword [ebp - 0x38], eax
jmp 0x40ca92
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x94]
je 0x40cacd
jmp 0x40cf29
mov ecx, 0x4e3960
call fcn.00402700
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0xcc]
mov dword [ebp - 0x40], edx
mov ecx, dword [ebp - 0x94]
call fcn.004548d3
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x40], 0
je 0x40cb5d
mov ecx, dword [ebp - 0x40]
call fcn.004a51e4
cmp eax, dword [ebp - 0x7c]
je 0x40cb5d
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x40]
call dword [edx + 0x60]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x80], ecx
cmp dword [ebp - 0x80], 0
je 0x40cb3f
push 1
mov edx, dword [ebp - 0x80]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x80]
call dword [eax + 4]
mov dword [ebp - 0x98], eax
jmp 0x40cb49
mov dword [ebp - 0x98], 0
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 0xcc], 0
mov dword [ebp - 0x40], 0
cmp dword [ebp - 0x40], 0
jne 0x40cc24
push 0x166
push str.tooltip.cpp
push 0x58
call fcn.0044f189
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x40cb9a
mov ecx, dword [ebp - 0x88]
call fcn.0040be90
mov dword [ebp - 0x9c], eax
jmp 0x40cba4
mov dword [ebp - 0x9c], 0
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x40], edx
push 1
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.0040bee9
test eax, eax
jne 0x40cc07
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x8c], edx
cmp dword [ebp - 0x8c], 0
je 0x40cbf8
push 1
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x8c]
call dword [edx + 4]
mov dword [ebp - 0xa0], eax
jmp 0x40cc02
mov dword [ebp - 0xa0], 0
jmp 0x40cf29
push 0
push 0
push 0x401
mov ecx, dword [ebp - 0x40]
call fcn.004a5249
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x40]
mov dword [eax + 0xcc], ecx
push 0x170
push str.tooltip.cpp
mov edx, dword [ebp - 0x40]
push edx
call fcn.004599c0
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40cc5c
push 0x171
push str.tooltip.cpp
call fcn.004a24f0
test eax, eax
je 0x40cc5c
int3
xor edx, edx
test edx, edx
jne 0x40cc37
push 0x2c
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.004103c0
add esp, 0xc
mov dword [ebp - 0x30], 0x2c
mov dword [ebp - 0x2c], 1
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x24], ecx
lea edx, [ebp - 0x30]
push edx
push 0
push 0x408
mov ecx, dword [ebp - 0x40]
call fcn.004a5249
test eax, eax
jne 0x40cd74
cmp dword [ebp - 0x30], 0x2c
je 0x40cccd
push 0x17b
push str.tooltip.cpp
call fcn.004a24f0
test eax, eax
je 0x40cccd
int3
xor eax, eax
test eax, eax
jne 0x40ccb3
cmp dword [ebp - 0x2c], 1
je 0x40cced
push 0x17c
push str.tooltip.cpp
call fcn.004a24f0
test eax, eax
je 0x40cced
int3
xor ecx, ecx
test ecx, ecx
jne 0x40ccd3
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x28]
cmp eax, dword [edx + 0x1c]
je 0x40cd15
push 0x17d
push str.tooltip.cpp
call fcn.004a24f0
test eax, eax
je 0x40cd15
int3
xor ecx, ecx
test ecx, ecx
jne 0x40ccf3
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x1c]
je 0x40cd3d
push 0x17e
push str.tooltip.cpp
call fcn.004a24f0
test eax, eax
je 0x40cd3d
int3
xor ecx, ecx
test ecx, ecx
jne 0x40cd1b
lea edx, [ebp - 0x30]
push edx
push 0
push 0x404
mov ecx, dword [ebp - 0x40]
call fcn.004a5249
test eax, eax
jne 0x40cd6e
push 0x17f
push str.tooltip.cpp
call fcn.004a24f0
test eax, eax
je 0x40cd6e
int3
xor eax, eax
test eax, eax
jne 0x40cd43
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ecx + 0x14]
push eax
lea ecx, [ebp - 0x74]
call fcn.004abb00
lea ecx, [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x2c
push 0
lea ecx, [ebp - 0x6c]
push ecx
call fcn.004103c0
add esp, 0xc
mov dword [ebp - 0x6c], 0x2c
lea edx, [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x94]
call dword [eax + 0x6c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0xffffffff
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x94]
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0xd4]
cmp eax, dword [ebp - 0x3c]
jne 0x40ce05
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0xd0]
cmp edx, dword [ebp - 0x78]
je 0x40cefe
cmp dword [ebp - 0x3c], 0xffffffff
je 0x40cea0
mov ecx, 0xb
lea esi, [ebp - 0x6c]
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x2c]
and eax, 0x3fffffff
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x30]
push ecx
push 0
push 0x404
mov ecx, dword [ebp - 0x40]
call fcn.004a5249
test eax, eax
jne 0x40ce52
push 0x192
push str.tooltip.cpp
call fcn.004a24f0
test eax, eax
je 0x40ce52
int3
xor edx, edx
test edx, edx
jne 0x40ce27
mov eax, dword [ebp - 0x68]
and eax, 0x40000000
test eax, eax
jne 0x40ce73
mov ecx, dword [ebp - 0x94]
call fcn.00454945
test eax, eax
je 0x40cea0
push 0
push 1
push 0x401
mov ecx, dword [ebp - 0x40]
call fcn.004a5249
push 0x213
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.0040cf32
mov edx, dword [ebp - 0x34]
cmp dword [edx + 0xd8], 0x2c
jne 0x40ced1
mov eax, dword [ebp - 0x34]
add eax, 0xd8
push eax
push 0
push 0x405
mov ecx, dword [ebp - 0x40]
call fcn.004a5249
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x78]
mov dword [ecx + 0xd0], edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 0xd4], ecx
mov edi, dword [ebp - 0x34]
add edi, 0xd8
mov ecx, 0xb
lea esi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
jmp 0x40cf11
cmp dword [ebp - 0x3c], 0xffffffff
je 0x40cf11
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x40]
push eax
call fcn.0040cf32
cmp dword [ebp - 0x48], 0xffffffff
je 0x40cf29
cmp dword [ebp - 0x4c], 0
jne 0x40cf29
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.0040e540
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4