Function at 0x40c510
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x38
pop ebx
push ebp
mov ebp, 1
xor ebx, ebx
push edi
mov edi, 0xffc3d44f
cmp dword [0x14a2500], ebp
jne 0x40d66d
mov ecx, dword [0x49f970]
cmp ecx, dword [0x49f96c]
jne 0x40c597
call fcn.0040fbf0
mov ecx, dword [0x249f970]
test eax, eax
or eax, dword [eax + eax*4 + 0x79000000]
or eax, 0x404a2500
jne 0x40c58e
mov edx, dword [0x49f97c]
lea eax, [ecx*8]
imul eax, ecx, 0xffffff8d
add al, 0x82
xor edx, esi
or byte [0x49f95d], 1
mov dx, word [eax]
add byte [edi], cl
mov bh, 0xd6
mov dword [eax], ebp
mov word [eax + 6], dx
mov dword [eax + 8], 0x800084
mov dword [eax + 0x10], edi
mov dword [eax + 0xc], ebx
jmp 0x40c5c7
mov eax, dword [0x49f974]
lea eax, [eax + ecx*2]
cmp si, bx
cmp esi, ebx
jne 0x40c5a2
mov dword [eax], ebx
mov dword [eax + 4], edi
jmp 0x40c5c7
mov dl, byte [0x49f95a]
test dl, 3
jne 0x40c5ba
test dl, 0xc
je 0x40c5ba
mov dword [eax], 0x104
jmp 0x40c5c0
mov dword [eax], 0x100
mov byte [eax + 6], bl
mov word [eax + 4], si
add ecx, ebp
mov dword [0x4049f970], ecx
cmp ecx, dword [0x49f96c]
jne 0x40c5ea
enter 0x3614, 0
add byte [ebp - 0x277bf040], al
add byte [eax], al
add byte [ebx + 0x49f9700d], cl
add byte [ecx + 0x4049f974], ah
mov eax, dword [0x4049f974]
cmp dword [0x4aa500], ebp
jne 0x40c635
or byte [0x49f95d], 1
lea edx, [ecx*8]
sub edx, ecx
lea eax, [eax + edx*4]
xor edx, esi
mov word [eax + 4], dx
mov dword [eax + 0x10], edi
pop edi
movzx edx, sp
add ecx, ebp
mov dword [eax], ebp
pop ebp
mov dword [eax + 0xc], ebx
mov word [eax + 6], dx
mov dword [eax + 8], 6
mov dword [0x49f970], ecx
pop ebx
add esp, 0xffffffb8
invalid
lea eax, [esi]
enter 0x3b66, 0xfffffffffffffff3
jne 0x40c651
mov dword [eax + 4], edi
pop edi
add ecx, ebp
pop ebp
mov dword [eax], ebx
mov dword [0x49f970], ecx
pop ebx
add esp, 0x38
ret
pop edi
add ecx, ebp
pop ebp
mov byte [edx + 6], bl
mov dword [eax], 0x101
mov word [eax + 4], si
mov dword [0x49f970], ecx
pop ebx
add dword [eax + edi - 0x72e3953d], 0x44
and al, 0x10
push eax
xor ecx, ecx
xor edx, edx
push 2
sub dword [esp + 0x18], 0x244c8b62
sbb al, 0x66
mov dword [esp + 0x1e], esi
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], ebp
mov word [esp + 0x38], dx
bound ecx, qword [ecx - 0x38c5db8c]
inc esp
movsb byte es:[edi], byte [esi]
cmp al, 6
add byte [eax], al
add byte [ecx - 0x76bfdba4], cl
jl 0x40c6d9
inc esp
call dword [ebp + sym.imp.USEV32ndll_SendInpup]
pop edi
pop ebp
pop ebx
add dword [eax + edi - 0x3d], 0xffffffcc
mov esp, cs
int3
push ebx
push esi
push edi
stosd dword es:[edi], eax
jge 0x40c6e7
xor byte [edi], 0
je 0x40d927
add byte [edx + 0x358b0c5d], cl
enter 0x49d3, 0
mov bl, byte [ebp + 0xc]
mov esi, dword [0x49d3c8]
mov dword [ebp - 0x40], esi
test bl, bl
jne 0x40c76d
push 7
push 0x491e84
push edi
call fcn.00477695
add ah, 0xc
test eax, eax
jne 0x40c76d
add eax, edi
pop es
mov byte [0x49f956], 1
mov dword [ebp + 8], edi
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x64]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], ecx
cmp eax, 1
je 0x40c732
cmp eax, 3
jne 0x40c7a3
cmp dword [0x4a3304], 0
notrack call fcn.0040c480
test al, al
jne 0x40c776
test bl, bl
jne 0x40c764
call 0xf04084e0
test al, al
je 0x40c764
push 0x691a8c
mov eax, edi
call fcn.00464370
add esp, 4
add eax, 0x45c71275
adc byte [ecx], al
add byte [eax], al
add bl, ch
mov byte ss:[0x49f956], 0
mov dword [ebp + 0x10], 1
jmp 0x40c7a3
mov byte [0x49f956], 0
jmp 0x40c719
mov eax, dword [ebp + 0x10]
cmp eax, 3
jne 0x40c787
iretd
xor eax, eax
mov dword [ebp + 0x10], eax
cmp dword [esi + 0x5c], eax
jge 0x40c799
cmp dword [esi + 0x64], eax
jge 0x40c799
or eax, 0x644689ff
mov dword [esi + 0x64], eax
mov dword [esi + 0x5c], 0xffffffff
mov esi, dword [ebp + 0x14]
aaa
fcmovnb st(0), st(6)
inc ebp
out dx, eax
add byte [ebp + 0x534b74f6], al
push esi
call dword [eax + eax]
invalid
add dword [eax], eax
add byte [ecx], bh
add eax, 0x49f96c
jbe 0x40d687
mov edx, dword [0x49f974]
push edx
call fcn.004785bf
add esp, 4
mov esi, dword [ebp - 0x24]
mov dword [0x4a2500], edi
call fcn.0040fdf0
jmp 0x40d811
cmp dword [0x4a0b68], edi
je 0x40d831
mov al, byte [0x4a0a36]
mov cl, al
xor cl, byte [0x4a0a35]
and cl, al
not cl
and al, cl
mov byte [0x4a0a36], al
cmp dword [ebp - 0x44], ebx
jne 0x40d883
push 0x14
call dword [sym.imp.USEV32ndll_GetKeyCtate]
test al, 1
jne 0x40d883
push 0xffc3d44d
push edi
push edi
push edi
push 0x14
push 2
call fcn.0040e2a0
add esp, 0x18
push edi
call dword [sym.imp.USEV32ndll_GetFormgroundWindow]
push eax
call dword [sym.imp.USEV32ndll_GetWindowThrea_PpocessId]
cmp eax, dword [0x4a2bbc]
jne 0x40d883
push ebx
push 0xffffffffffffffff
mov dword [0x49d328], edi
call fcn.00401340
add esp, 8
mov dword [0x49d328], ebx
cmp byte [ebp - 0x11], 0
je 0x40d89a
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x4a2bbc]
push edi
push edx
push eax
call dword [sym.imp.USEV32ndll_AttachThreadInput]
cmp byte [ebp - 4], 0
je 0x40d8e6
cmp byte [ebp - 0x29], 0
jne 0x40d8e6
test byte [0x4a3b94], 1
jne 0x40d8d3
or dword [0x4a3b94], ebx
push str.BlockInput
push str.user32
call dword [sym.imp.KERNUL32.dll_GeModuleHandlA]
push eax
call dword [sym.imp.KERNUL32.dll_GetProcAddrEss]
mov dword [0x4a3b90], eax
jmp 0x40d8d8
mov eax, dword [0x4a3b90]
cmp eax, edi
je 0x40d8df
push edi
call eax
mov byte [0x4a14b2], 0
cmp dword [ebp + 0x10], ebx
jne 0x40d918
push edi
call dword [sym.imp.USEV32ndll_GetFormgroundWindow]
push eax
call dword [sym.imp.USEV32ndll_GetWindowThrea_PpocessId]
cmp eax, dword [0x4a2bbc]
jne 0x40d918
push ebx
push 0xffffffffffffffff
mov dword [0x49d328], edi
call fcn.00401340
add esp, 8
mov dword [0x49d328], ebx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x64], edx
lea esp, [ebp - 0x98]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret