Function at 0x406a80
Capabilities:
Log keystrokes via application hook

Disassembly:
sub esp, 0x140
mov eax, dword [0x47cda4]
xor eax, esp
mov dword [esp + 0x13c], eax
push ebx
push ebp
push esi
push edi
call fcn.00403c00
cmp byte [section..data], 0
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, eax
je 0x406ab5
push 0x47e5e0
call ebp
mov bl, byte [esp + 0x154]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [esi + 0x2ba], bl
cmp byte [section..data], 0
je 0x406ad8
push 0x47e5e0
call edi
call fcn.00403c00
test bl, bl
mov esi, eax
je 0x406c10
cmp byte [section..data], 0
je 0x406af7
push 0x47e5e0
call ebp
cmp byte [section..data], 0
mov eax, dword [esi + 0x2bc]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0x2c0]
mov dword [esp + 0x14], ecx
je 0x406b1b
push 0x47e5e0
call edi
call fcn.00403c00
cmp byte [section..data], 0
mov esi, eax
je 0x406b32
push 0x47e5e0
call ebp
cmp byte [section..data], 0
mov edx, dword [esi + 0x2c4]
mov dword [esp + 0x18], edx
mov eax, dword [esi + 0x2c8]
mov dword [esp + 0x1c], eax
je 0x406b56
push 0x47e5e0
call edi
lea ecx, [esp + 0x20]
push ecx
call fcn.00403c00
mov ecx, eax
call fcn.00401ee0
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
lea edx, [esp + 0x14]
push edx
push 8
push 0x3b
call esi
push 0
lea eax, [esp + 0x1c]
push eax
push 8
push 0x35
call esi
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x18
push 0x33
call esi
call fcn.00403c00
cmp byte [section..data], 0
mov esi, eax
je 0x406bab
push 0x47e5e0
call ebp
cmp byte [section..data], 0
mov esi, dword [esi + 0x2b4]
je 0x406bc1
push 0x47e5e0
call edi
test esi, esi
je 0x406d5c
call fcn.00403c00
cmp byte [section..data], 0
mov esi, eax
je 0x406be0
push 0x47e5e0
call ebp
cmp byte [section..data], 0
mov esi, dword [esi + 0x2b4]
je 0x406bf6
push 0x47e5e0
call edi
push esi
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push 0
call fcn.00403c00
mov ecx, eax
call fcn.00401d30
jmp 0x406d5c
cmp byte [section..data], 0
je 0x406c20
push 0x47e5e0
call ebp
cmp byte [section..data], 0
mov esi, dword [esi + 0x2b4]
je 0x406c36
push 0x47e5e0
call edi
test esi, esi
jne 0x406c7e
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x48], 2
jne 0x406c7e
cmp dword [esp + 0x3c], 4
jbe 0x406c7e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x4069d0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push eax
call fcn.00403c00
mov ecx, eax
call fcn.00401d30
call fcn.00403c00
cmp byte [section..data], 0
mov esi, eax
je 0x406c95
push 0x47e5e0
call ebp
cmp byte [section..data], 0
mov eax, dword [esi + 0x2bc]
mov dword [esp + 0x18], eax
mov ecx, dword [esi + 0x2c0]
mov dword [esp + 0x1c], ecx
je 0x406cb9
push 0x47e5e0
call edi
test byte [esp + 0x1c], 1
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ebx, 0xfffffff3
jne 0x406cdc
and dword [esp + 0x1c], ebx
push 0
lea edx, [esp + 0x1c]
push edx
push 8
push 0x3b
call edi
call fcn.00403c00
cmp byte [section..data], 0
mov esi, eax
je 0x406cf3
push 0x47e5e0
call ebp
cmp byte [section..data], 0
mov eax, dword [esi + 0x2c4]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0x2c8]
mov dword [esp + 0x14], ecx
je 0x406d1b
push 0x47e5e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [esp + 0x14], 1
jne 0x406d33
and dword [esp + 0x14], ebx
push 0
lea edx, [esp + 0x14]
push edx
push 8
push 0x35
call edi
lea eax, [esp + 0x20]
push eax
call fcn.00403c00
mov ecx, eax
call fcn.00401ee0
test byte [esp + 0x24], 1
jne 0x406d5c
and dword [esp + 0x24], ebx
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x18
push 0x33
call edi
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00417060
add esp, 0x140
ret