Function at 0x40ffa0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x208
mov eax, dword [0x4642d0]
xor eax, esp
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0x20c]
push ebx
mov ebx, dword [esp + 0x214]
push esi
mov esi, ecx
cmp bl, 1
jne 0x40ffe3
push 0
push 0x9c44
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x41032a
cmp bl, 3
jne 0x410000
push 0
push 0x9c42
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x41032a
cmp bl, 0x16
jne 0x41001d
push 0
push 0x9c43
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x41032a
cmp bl, 0x18
jne 0x41003a
push 0
push 0x9c41
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x41032a
cmp bl, 0x19
jne 0x410062
mov ecx, dword [esi + 0x990]
call fcn.004022e0
test eax, eax
je 0x41032a
mov ecx, dword [esi + 0x990]
call fcn.004050b0
jmp 0x41032a
cmp bl, 0x1a
jne 0x41008a
mov ecx, dword [esi + 0x990]
call fcn.00402300
test eax, eax
je 0x41032a
mov ecx, dword [esi + 0x990]
call fcn.004065e0
jmp 0x41032a
cmp bl, 0x20
jge 0x41009d
cmp bl, 0xd
je 0x41009d
cmp bl, 9
jne 0x41032a
cmp bl, 0x7f
je 0x41032a
mov eax, dword [esi + 0x990]
cmp dword [eax + 0xc], 0
jne 0x41032a
cmp dword [esi + 0x4c], 0
jne 0x41032a
cmp bl, 0xd
jne 0x4100e6
push str.insert___n_
lea eax, [esp + 0x110]
mov word [esp + 0x10], 0xa0d
push eax
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x410158
mov byte [esp + 0xc], bl
mov byte [esp + 0xd], 0
cmp bl, 9
jne 0x410109
push str.insert___t_
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x410158
cmp bl, 0x22
jne 0x410123
push str.insert____
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x410158
cmp bl, 0x5c
jne 0x41013d
push str.insert___
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x410158
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x110]
push str.insert___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebp
push edi
lea eax, [esp + 0x114]
push eax
lea ecx, [esi + 0x998]
call fcn.004017a0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1f4]
cmp bl, 9
jne 0x4101ee
mov ebp, dword [esi + 0x990]
test byte [ebp + 0xd8], 8
je 0x4101bf
mov ecx, dword [esi + 0x3c]
xor eax, eax
test ecx, ecx
jle 0x4101ba
mov eax, ecx
lea edi, [esp + 0x14]
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
cmp eax, 0x100
jae 0x410343
mov byte [esp + eax + 0x14], 0
test byte [ebp + 0xd8], 0x20
je 0x4101ee
mov eax, dword [esi + 0x44]
cmp eax, dword [esi + 0x48]
je 0x4101ee
mov edi, dword [esi]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, esi
and eax, 1
push eax
call dword [edi + 0x13c]
jmp 0x410328
mov eax, dword [esi]
lea ebp, [esi + 0xc]
push ebp
mov ecx, esi
call dword [eax + 0x194]
mov eax, dword [esi + 0x44]
cmp eax, dword [esi + 0x48]
je 0x410213
mov ecx, dword [esi + 0x990]
push 0
push 1
call fcn.00405e50
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
cmp dword [esp + 0x224], 0
mov dword [esp + 0x10], eax
jle 0x4102b8
nop dword [eax]
cmp dword [esi + 0x8a8], 0
je 0x41027a
test eax, eax
jne 0x41027a
cmp bl, 0xd
je 0x41027a
push dword [ebp]
mov ecx, dword [esi + 0x990]
call fcn.00404000
test eax, eax
je 0x41026c
push dword [ebp]
mov ecx, dword [esi + 0x990]
call fcn.00404040
test eax, eax
jne 0x41027a
push 1
push 2
jmp 0x410270
push 1
push 1
mov eax, dword [esi]
mov ecx, esi
push dword [ebp]
call dword [eax + 0x14]
mov edi, dword [esi]
lea eax, [esp + 0x14]
push 1
push eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
push eax
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
push dword [ebp]
call dword [edi + 0x10]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [ebp], eax
sub dword [esp + 0x224], 1
mov eax, dword [esp + 0x10]
jne 0x410230
test eax, eax
je 0x4102c7
mov ecx, dword [esi + 0x990]
call fcn.00403870
mov edi, dword [esi]
lea eax, [esp + 0x14]
push 0xffffffffffffffff
push eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esi + 8], 0
call eax
mov ecx, dword [ebp]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x990]
call fcn.004039d0
push eax
mov ecx, esi
call dword [edi + 0x70]
mov eax, dword [esi + 0x990]
test byte [eax + 0xd8], 0x10
je 0x41030f
mov eax, dword [esi]
mov ecx, esi
push ebx
call dword [eax + pe_nt_image_headers32]
mov eax, dword [esi]
mov ecx, esi
push 1
push 1
call dword [eax + 0xc]
mov edx, dword [esi]
mov ecx, esi
movsx eax, bl
push eax
call dword [edx + 0x1d4]
pop edi
pop ebp
mov ecx, dword [esp + 0x20c]
pop esi
pop ebx
xor ecx, esp
call fcn.0043fe9e
add esp, 0x208
ret 0xc
call fcn.004402ce
int3