Function at 0x4067d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x98], 0
jg 0x4067ee
call fcn.00437957
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x40681e
push 0
lea ecx, [edi + 0x9c]
push 0x5b81db
call fcn.00402ef0
mov dword [edi + 0xb0], 0
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ebx, dword [edi + 0xa0]
push esi
mov esi, dword [edi + 0xa4]
add ebx, 2
push 0
adc esi, 0
call fcn.00583e72
add esp, 4
cmp edx, esi
jl 0x406864
jg 0x406846
cmp eax, ebx
jb 0x406864
mov eax, dword [edi + 0x9c]
lea ecx, [edi + 0x9c]
cmp dword [eax - 0xc], 0
jle 0x406864
push 0
push 0x5b81db
call fcn.00402ef0
mov eax, dword [edi + 0xa8]
lea esi, [edi + 0x9c]
cmp eax, dword [edi + 0x98]
je 0x406886
push 0
push 0x5b81db
mov ecx, esi
call fcn.00402ef0
mov eax, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x20]
mov dword [ebp - 0xc], eax
call eax
cmp dword [edi + 0xac], eax
je 0x4068b2
push 0
push 0x5b81db
mov ecx, esi
call fcn.00402ef0
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x4068c4
mov dword [edi + 0xb0], 0
mov eax, dword [edi + 0x98]
push 0
mov dword [edi + 0xa8], eax
call fcn.00583e72
mov dword [edi + 0xa0], eax
add esp, 4
mov eax, dword [esi]
mov dword [edi + 0xa4], edx
cmp dword [eax - 0xc], 1
jne 0x406900
mov cl, byte [ebp + 8]
cmp byte [eax], cl
jne 0x406900
inc dword [edi + 0xb0]
jmp 0x406a32
cmp dword [edi + 0xb0], 0
mov edx, 1
mov dword [ebp - 8], 0
jle 0x4069e2
nop dword [eax]
mov edx, dword [esi]
mov ecx, dword [edx - 0xc]
test ecx, ecx
js 0x406ade
mov al, byte [edx]
lea ebx, [ecx + 1]
mov byte [ebp - 1], al
xor eax, eax
test ebx, ebx
cmovns eax, ebx
cmp eax, ecx
cmovle ecx, eax
mov dword [ebp - 0x10], ecx
test ebx, ebx
js 0x406ade
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, ebx
or ecx, eax
jge 0x406965
push ebx
mov ecx, esi
call fcn.00402e50
mov ecx, dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [esi]
sub edx, ecx
lea eax, [ecx + eax]
mov dword [ebp - 0x10], eax
lea ecx, [eax + 1]
je 0x4069a3
test ecx, ecx
jne 0x406994
call fcn.0057d8c8
mov dword [eax], 0x16
call fcn.0057d7ca
mov eax, 0x16
jmp 0x4069a5
test eax, eax
je 0x40697d
push edx
push eax
push ecx
call fcn.00579d70
add esp, 0xc
xor eax, eax
push eax
call fcn.00404990
mov eax, dword [ebp - 0x10]
add esp, 4
mov cl, byte [ebp - 1]
mov byte [eax], cl
mov eax, dword [esi]
cmp ebx, dword [eax - 8]
jg 0x406ade
mov dword [eax - 0xc], ebx
mov eax, dword [esi]
mov byte [ebx + eax], 0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [edi + 0xb0]
jl 0x406920
mov edx, 1
mov dword [edi + 0xb0], 0
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x10], ecx
lea ebx, [ecx + 1]
test ebx, ebx
js 0x406ade
sub edx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, ebx
or edx, eax
jge 0x406a16
push ebx
mov ecx, esi
call fcn.00402e50
mov ecx, dword [ebp - 0x10]
mov eax, dword [esi]
mov dl, byte [ebp + 8]
mov byte [ecx + eax], dl
mov eax, dword [esi]
cmp ebx, dword [eax - 8]
jg 0x406ade
mov dword [eax - 0xc], ebx
mov eax, dword [esi]
mov byte [ebx + eax], 0
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x20]
call dword [ebp - 0xc]
mov edx, dword [edi + 0x98]
mov ebx, eax
xor eax, eax
test ebx, ebx
cmovs ebx, eax
test edx, edx
jns 0x406a60
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x198]
mov edx, eax
mov ecx, dword [edi]
push esi
mov eax, dword [ecx + 0x248]
mov ecx, dword [esi]
mov dword [ebp + 8], eax
cmp dword [ecx - 0xc], 1
mov ecx, edi
jne 0x406a80
lea eax, [ebx + 1]
push eax
push edx
call dword [ebp + 8]
jmp 0x406a84
push ebx
push edx
call eax
mov dword [edi + 0xac], eax
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x4067e7
push 2
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.0043e301
push 2
push 2
push dword [edi + 0xac]
mov ecx, edi
call fcn.0043e301
push 1
push 1
push dword [edi + 0xac]
mov ecx, edi
call fcn.0043e301
push 0
push dword [edi + 0xac]
push 0x1013
push dword [edi + 0x20]
call dword [ebp - 0xc]
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.00401ec0
int3