Function at 0x409053
Capabilities:
Log keystrokes
Log keystrokes via polling
Terminate process

Disassembly:
sub esp, 0x10c
nop
push ebx
nop
push ebp
nop
push esi
nop
push edi
nop
sub esi, esi
nop
push 0xff
nop
lea eax, [esp + 0x21]
nop
push esi
nop
push eax
nop
mov dword [esp + 0x1c], esi
nop
mov dword [esp + 0x20], esi
nop
mov byte [esp + 0x28], 0
nop
call sub.msvcrt.dll_memset
add esp, 0xc
nop
push 0x40
nop
pop eax
nop
cmp dword [0x406144], eax
nop
jle 0x4090a1
mov dword [0x406144], eax
nop
lea eax, [esp + 0x1c]
nop
push eax
nop
call dword [sym.imp.USER32.dll_GetKeyboardState]
or byte [esp + 0x2d], 0x80
nop
push esi
nop
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
nop
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
pop ebx
nop
cmp ebx, esi
nop
jne 0x4090d6
mov eax, dword [0x406130]
nop
mov ebx, dword [eax + 0xc]
nop
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, eax
nop
mov dword [esp + 0x18], ebp
nop
cmp ebx, ebp
nop
je 0x4090f6
push 1
nop
push ebp
nop
push ebx
nop
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [0x40603c]
nop
call dword [sym.imp.USER32.dll_SetForegroundWindow]
or eax, eax
nop
jne 0x409115
push dword [0x40603c]
nop
call dword [sym.imp.USER32.dll_SetActiveWindow]
push dword [0x40603c]
nop
call dword [sym.imp.USER32.dll_SetFocus]
push 0x64
nop
push dword [0x40603c]
nop
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea eax, [esp + 0x1c]
nop
push eax
nop
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp dword [0x406144], esi
nop
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
nop
jle 0x409282
mov ebp, 0x176
nop
push dword [0x40603c]
nop
call dword [sym.imp.USER32.dll_IsWindow]
or eax, eax
nop
je 0x40927d
inc dword [esp + 0x14]
nop
push ebp
nop
push ebp
nop
push dword [0x40603c]
nop
call fcn.00408d53
fld1
nop
add esp, 0xc
nop
push dword [0x406110]
nop
mov dword [0x406050], eax
nop
sub esp, 0x10
nop
fstp qword [esp + 8]
nop
fld qword [0x405268]
nop
fstp qword [esp]
nop
call fcn.00408000
add esp, 0x14
nop
push eax
nop
call esi
push 0
nop
push 0x73
nop
push 0x100
nop
push dword [0x406050]
nop
call edi
fld1
nop
push dword [0x406078]
nop
sub esp, 0x10
nop
fstp qword [esp + 8]
nop
fld qword [0x405268]
nop
fstp qword [esp]
nop
call fcn.00408000
add esp, 0x14
nop
push eax
nop
call esi
push 0
nop
push 0x73
nop
push 0x101
nop
push dword [0x406050]
nop
call edi
fld1
nop
push dword [0x406100]
nop
sub esp, 0x10
nop
fstp qword [esp + 8]
nop
fld qword [0x405268]
nop
fstp qword [esp]
nop
call fcn.00408000
add esp, 0x14
nop
push eax
nop
call esi
fld1
nop
push dword [0x406110]
nop
sub esp, 0x10
nop
fstp qword [esp + 8]
nop
fld qword [0x405268]
nop
fstp qword [esp]
nop
call fcn.00408000
add esp, 0x14
nop
push eax
nop
call esi
mov eax, dword [esp + 0x14]
nop
cmp eax, dword [0x406144]
nop
jl 0x409160
mov ebp, dword [esp + 0x18]
nop
lea eax, [esp + 0x1c]
nop
push eax
nop
mov byte [esp + 0x31], 0
nop
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp ebx, ebp
nop
je 0x4092a7
push 0
nop
push ebp
nop
push ebx
nop
call dword [sym.imp.USER32.dll_AttachThreadInput]
sub ebx, ebx
nop
push ebx
nop
push ebx
nop
push 0x10
nop
pop ebp
nop
push ebp
nop
push dword [0x40603c]
nop
call edi
or eax, eax
nop
jne 0x4092cc
mov dword [esp + 0x10], 0xd
nop
push dword [0x406120]
nop
call esi
mov eax, dword [0x406130]
nop
push ebx
nop
push dword [eax]
nop
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or eax, eax
nop
jne 0x4092fb
cmp dword [esp + 0x10], ebx
nop
je 0x4092fb
mov dword [esp + 0x10], 0xe
nop
mov eax, dword [0x406130]
nop
push dword [eax]
nop
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
call edi
or eax, eax
nop
jne 0x40931b
mov dword [esp + 0x10], 0xf
nop
mov eax, dword [0x406130]
nop
push dword [eax + 4]
nop
call edi
or eax, eax
nop
jne 0x409331
mov dword [esp + 0x10], ebp
nop
push dword [0x406158]
nop
call esi
mov eax, dword [esp + 0x10]
nop
pop edi
nop
pop esi
nop
pop ebp
nop
pop ebx
nop
add esp, 0x10c
nop
ret