Function at 0x40abc2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40abc8
call fcn.0048d6d0
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.0042e000
mov edx, str.SELECT_key__KeyStatus__ProductID__ExtendedPID__SKUID_
lea ecx, [esp + 4]
call fcn.0042e008
mov edx, dword [esp + 4]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str.Description__EditionID__SubType__LicenseType__Channel_
push edx
call fcn.0048d570
lea eax, [esp + 8]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 4]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str.CryptoID__ActivCount__Blocked__Comment__Lic__ActivVal
push edx
call fcn.0048d570
lea eax, [esp + 8]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 4]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str.FROM_keys_WHERE_key
push edx
call fcn.0048d570
mov edx, dword [esp + 4]
push edx
call fcn.0048d570
mov edx, 0x5cf830
push edx
call fcn.0048d570
lea eax, [esp + 8]
push eax
call fcn.0048d5d0
push dword [esp + 4]
push dword [0x8f9c5c]
call fcn.0047f11d
mov ebx, eax
and ebx, ebx
je 0x40b3f6
push dword [0x8f9c5c]
call fcn.0047f12f
and eax, eax
je 0x40b3eb
push edx
call fcn.0048d530
pop edx
push eax
mov eax, str.Win_XP
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 5
push dword [0x8f9c5c]
call fcn.0047f157
call fcn.0042e5e2
add dword [esp], edx
call fcn.0048ad20
call fcn.0042e610
mov ebx, eax
and ebx, ebx
jg 0x40ad38
push edx
call fcn.0048d530
pop edx
push eax
mov eax, str.Server_2003
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 5
push dword [0x8f9c5c]
call fcn.0047f157
call fcn.0042e5e2
add dword [esp], edx
call fcn.0048ad20
call fcn.0042e610
mov ebx, eax
and ebx, ebx
jg 0x40ad38
jmp 0x40ad3f
mov eax, 1
jmp 0x40ad41
xor eax, eax
and eax, eax
je 0x40af3e
mov edx, str._r_nPKeyConfig____:_Windows_XP___Server_2003_r_n
lea ecx, [esp + 8]
call fcn.0042e008
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str.Key___________:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
mov edx, 0x5dbb02
push edx
call fcn.0048d570
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str.Key_Status____:_Valid_r_n
push edx
call fcn.0048d570
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str.Product_ID____:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 2
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
mov edx, 0x5dbb02
push edx
call fcn.0048d570
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str.Description___:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 5
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
mov edx, 0x5dbb02
push edx
call fcn.0048d570
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str.Channel_______:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 8
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
mov edx, 0x5dbb02
push edx
call fcn.0048d570
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str.Comment_______:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0xd
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, 0x5dbb02
push edx
call fcn.0048d570
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
jmp 0x40b3e6
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nKey___________:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nKey_Status____:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 1
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nProduct_ID____:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 2
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nExtended_PID__:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 3
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nSKU_ID________:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 4
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nDescription___:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 5
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nEdition_ID____:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 6
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nSub_Type______:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 7
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nLicense_Type__:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 8
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nChannel_______:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 9
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nCrypto_ID_____:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0xa
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
push edx
call fcn.0048d530
pop edx
push eax
mov eax, 0x5d7bb4
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 8
push dword [0x8f9c5c]
call fcn.0047f157
call fcn.0042e5e2
add dword [esp], edx
call fcn.0048ad20
call fcn.0042e610
mov ebx, eax
and ebx, ebx
jg 0x40b2e4
push edx
call fcn.0048d530
pop edx
push eax
mov eax, 0x5d7bac
push eax
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 8
push dword [0x8f9c5c]
call fcn.0047f157
call fcn.0042e5e2
add dword [esp], edx
call fcn.0048ad20
call fcn.0042e610
mov ebx, eax
and ebx, ebx
jg 0x40b2e4
jmp 0x40b2eb
mov eax, 1
jmp 0x40b2ed
xor eax, eax
and eax, eax
je 0x40b377
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0xb
push dword [0x8f9c5c]
call fcn.0047f157
call fcn.0048d660
mov edx, 0x5cf064
pop ecx
push ecx
call fcn.0042e600
mov ecx, eax
call fcn.0042e590
jne 0x40b377
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nActiv._Count__:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0xb
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, str._r_nComment_______:
push edx
call fcn.0048d570
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d530
pop edx
push eax
push 0xd
push dword [0x8f9c5c]
call fcn.0047f157
pop eax
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
mov edx, dword [esp + 8]
push edx
call fcn.0048d530
pop edx
push eax
push edx
call fcn.0048d570
mov edx, 0x5dbb02
push edx
call fcn.0048d570
lea eax, [esp + 0xc]
push eax
call fcn.0048d5d0
jmp 0x40ac97
push dword [0x8f9c5c]
call fcn.0047f184
push dword [esp + 8]
mov edx, 0x5cf064
pop ecx
call fcn.0042e590
jne 0x40b68f
push dword [0x8f9cf4]
pop eax
mov dword [esp + 0xc], eax
push dword [0x8f9ce4]
pop eax
mov dword [esp + 0x10], eax
push dword [0x8f9cf8]
pop eax
mov dword [esp + 0x14], eax
push dword [0x8f9d00]
pop eax
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0xc]
cmp ebx, 0x64
jge 0x40b448
mov dword [esp + 0xc], 0x190
mov ebx, dword [esp + 0x10]
cmp ebx, 0x64
jge 0x40b459
mov dword [esp + 0x10], 0x104
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x40b476
push 0
call fcn.0047ab13
mov ebx, eax
add ebx, 0xffffffec
mov dword [esp + 0x1c], ebx
jmp 0x40b47f
push dword [esp + 0x14]
pop eax
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x40b49c
push 0
call fcn.0047aa84
mov ebx, eax
add ebx, 0xa
mov dword [esp + 0x20], ebx
jmp 0x40b4a5
push dword [esp + 0x18]
pop eax
mov dword [esp + 0x20], eax
push 0xc40004
mov eax, 0x5cf064
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0x26
call fcn.0047ab21
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
push 0x2a
call fcn.00472d81
push 0x300044
mov eax, 0x5cf064
push eax
mov ebx, dword [esp + 0x18]
add ebx, 0xffffffd3
push ebx
mov ebx, dword [esp + 0x18]
add ebx, 0xffffffec
push ebx
push 6
push 0xa
push 0x29
call fcn.00474f56
push 9
mov eax, str.Consolas
push eax
push 0xffffffff
call fcn.0048c9c5
push eax
call fcn.0048ca28
push eax
push 0x29
call fcn.00474d0f
push dword [esp + 8]
push 0x29
call fcn.004734ac
push dword [0x8f99ac]
push 0x19
push 0x46
mov ebx, dword [esp + 0x1c]
add ebx, 0xffffffde
push ebx
mov ebx, dword [esp + 0x1c]
add ebx, 0xffffffab
push ebx
push 0x2c
call fcn.00477288
push 0x26
lea eax, [0x40e533]
push eax
call fcn.0047a89b
call fcn.00472d9e
push 0x26
call fcn.0041f1d0
call fcn.0041a887
push 0x258
call fcn.0047a289
call fcn.0047aa1b
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0
je 0x40b5ea
call fcn.0047bfac
push eax
mov ebx, 0x26
cmp ebx, dword [esp]
jne 0x40b5e7
push dword [esp + 0x28]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x40b5e6
call fcn.0047bf9d
push eax
mov ebx, 0x2c
cmp ebx, dword [esp]
jne 0x40b5e5
add esp, 0xc
jmp 0x40b649
pop eax
pop eax
pop eax
jmp 0x40b63c
push 0x26
call fcn.0047af47
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x40b618
call fcn.0047af05
mov ebx, eax
cmp ebx, 0x26
jne 0x40b618
call fcn.0041a887
jmp 0x40b649
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x40b63c
call fcn.0047af05
mov ebx, eax
cmp ebx, 0x26
jne 0x40b63c
call fcn.0041a887
jmp 0x40b649
mov dword [esp + 0x24], 0
jmp 0x40b5a2
push 0x26
call fcn.0047afac
mov dword [0x8f9cf4], eax
push 0x26
call fcn.0047b029
mov dword [0x8f9ce4], eax
push 0x26
call fcn.0047ab13
mov dword [0x8f9cf8], eax
push 0x26
call fcn.0047aa84
mov dword [0x8f9d00], eax
push 0x26
call fcn.0047a515
xor eax, eax
push dword [esp]
call fcn.0048d760
push dword [esp + 8]
call fcn.0048d760
push dword [esp + 4]
call fcn.0048d760
add esp, 0x28
pop ebx
ret 4