Function at 0x405e80
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x405e88
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4061a9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1388
mov eax, dword [0x4070a4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor edx, edx
push ebp
push 0x40616d
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [0x4070a8]
mov ebx, dword [ebx]
test esi, esi
je 0x405f2b
lea eax, [ebx + 4]
mov edx, dword [esi]
call fcn.00401418
mov eax, dword [esi + 4]
mov dword [ebx + 0x104], eax
mov eax, dword [esi + 8]
mov dword [ebx + 0x108], eax
mov eax, dword [esi + 0xc]
mov edx, eax
or edx, 1
cmp eax, edx
sete al
mov byte [ebx], al
mov eax, dword [esi + 0xc]
mov edx, eax
or edx, 2
cmp eax, edx
sete al
mov byte [ebx + 1], al
mov eax, dword [esi + 0xc]
mov edx, eax
or edx, 4
cmp eax, edx
sete al
mov byte [ebx + 2], al
mov eax, dword [esi + 0xc]
mov edx, eax
or edx, 8
cmp eax, edx
sete al
mov byte [ebx + 3], al
jmp 0x405f70
call fcn.00405250
mov edx, dword [0x4070a0]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4061c4
call fcn.00401bc4
mov edx, dword [ebp - 8]
lea eax, [ebx + 4]
mov ecx, 0xff
call fcn.00401b54
xor eax, eax
mov dword [ebx + 0x104], eax
xor eax, eax
mov dword [ebx + 0x108], eax
mov byte [ebx], 1
mov byte [ebx + 1], 1
mov byte [ebx + 2], 0
mov byte [ebp - 1], 0
xor edx, edx
xor eax, eax
call fcn.00404514
mov eax, dword [0x4070a8]
mov eax, dword [eax]
cmp byte [eax + 3], 0
je 0x406039
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
call fcn.00403c5c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4061d8
call fcn.00403280
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
call fcn.004033dc
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00403854
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea eax, [ebp - 0x40]
call fcn.0040349c
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00403854
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x30]
mov ecx, 1
mov eax, 0x4061e8
call fcn.00403280
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x406208
call fcn.00403280
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00401b80
mov eax, dword [ebp - 0xc]
mov dl, 1
call fcn.00404514
jmp 0x406068
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
call fcn.00403c5c
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
mov eax, 0x4061d8
xor ecx, ecx
call fcn.00403280
mov eax, dword [ebp - 0x44]
mov dl, 1
call fcn.00404514
mov ebx, dword [0x4070a8]
mov ebx, dword [ebx]
cmp dword [ebx + 0x10c], 0
jne 0x4060ab
cmp byte [ebx], 0
je 0x4060ab
push 0
mov eax, dword [0x408408]
push eax
mov eax, 0x405690
push eax
push 2
call sub.user32.dll_SetWindowsHookExA
mov esi, eax
mov dword [ebx + 0x10c], esi
test esi, esi
jne 0x4060ab
xor edx, edx
mov eax, 0x406218
call fcn.00404514
cmp dword [ebx + 0x110], 0
jne 0x4060e7
cmp byte [ebx + 1], 0
je 0x4060e7
push 0
mov eax, dword [0x408408]
push eax
mov eax, 0x405a38
push eax
push 7
call sub.user32.dll_SetWindowsHookExA
mov esi, eax
mov dword [ebx + 0x110], esi
test esi, esi
jne 0x4060e7
xor edx, edx
mov eax, 0x40624c
call fcn.00404514
cmp dword [ebx + 0x114], 0
jne 0x406123
cmp byte [ebx + 2], 0
je 0x406123
push 0
mov eax, dword [0x408408]
push eax
mov eax, 0x405c64
push eax
push 0xa
call sub.user32.dll_SetWindowsHookExA
mov esi, eax
mov dword [ebx + 0x114], esi
test esi, esi
jne 0x406123
xor edx, edx
mov eax, 0x40627c
call fcn.00404514
cmp dword [ebx + 0x10c], 0
je 0x40613e
cmp dword [ebx + 0x110], 0
je 0x40613e
cmp dword [ebx + 0x114], 0
jne 0x406142
xor eax, eax
jmp 0x406144
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
call fcn.00404384
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406174
mov eax, dword [0x4070a4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_ReleaseMutex
ret