Function at 0x40ba80
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x440
push ebx
push ebp
mov ebp, ecx
mov al, byte [ebp + 0xb38]
test al, al
push esi
push edi
jne 0x40be39
mov al, byte [0x8dd730]
test al, al
jne 0x40be39
mov al, byte [ebp + 0x24]
test al, al
jne 0x40bb74
mov al, byte [0x8dd850]
test al, al
je 0x40bb74
mov eax, dword [0x4cfbf8]
cmp dword [eax], 0
je 0x40bae0
mov eax, dword [eax + 0x10]
test eax, eax
je 0x40bae0
push 5
push 0x80
call eax
add esp, 8
mov esi, eax
jmp 0x40bae2
xor esi, esi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa1
call edi
and eax, 0xffff8000
test ax, ax
jne 0x40bb05
push 0xa1
mov ecx, ebp
call fcn.0040cde0
mov ebx, esi
and ebx, 0xff
je 0x40c405
push 0x10
call edi
and eax, 0xffff8000
test esi, 0x400
je 0x40bb4f
test esi, 0x200
jne 0x40bb31
test ax, ax
je 0x40bb3f
push 0
push 0xa0
mov ecx, ebp
call fcn.0040cc40
mov ecx, dword [ebp + 0xb34]
mov eax, dword [ecx]
push 0
push ebx
call dword [eax + 0x5c]
jmp 0x40bb74
test esi, 0x200
jne 0x40bb5c
test ax, ax
jne 0x40bb68
push 0xa0
mov ecx, ebp
call fcn.0040cde0
mov ecx, dword [ebp + 0xb34]
mov edx, dword [ecx]
push ebx
call dword [edx + 0x60]
mov eax, dword [0x4cfc00]
test eax, eax
je 0x40bbf4
mov ecx, dword [eax]
test ecx, ecx
je 0x40bbf4
test ecx, ecx
je 0x40be0d
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x40bbd1
push 0
call ecx
add esp, 4
test al, al
je 0x40bbcc
test eax, 0x80000000
je 0x40bbb3
and eax, 0xff
push eax
mov ecx, ebp
call fcn.0040cde0
jmp 0x40bbcc
mov ecx, eax
shr ecx, 0x1e
and ecx, 0xffffff01
push ecx
and eax, 0xff
push eax
mov ecx, ebp
call fcn.0040cc40
mov eax, dword [0x4cfc00]
cmp dword [eax], 0
je 0x40be0d
mov eax, dword [eax + 0x28]
test eax, eax
je 0x40be0d
push 0x444
call eax
add esp, 4
jmp 0x40be0d
mov al, byte [ebp + 0x24]
test al, al
je 0x40bd55
lea esi, [ebp + 0x325]
xor eax, eax
push esi
mov ecx, 0x40
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x20]
mov edx, dword [eax]
push 0x100
push eax
call dword [edx + 0x24]
test eax, eax
jge 0x40bc3b
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp + 0x20]
mov edx, dword [eax]
push esi
push 0x100
push eax
call dword [edx + 0x24]
mov cl, byte [ebp + 0x376]
mov al, byte [ebp + 0x377]
mov bl, byte [ebp + 0x375]
mov dl, byte [ebp + 0x374]
or al, cl
mov cl, byte [ebp + 0x372]
or al, bl
mov bl, byte [ebp + 0x371]
or al, dl
mov dl, byte [ebp + 0x370]
or al, cl
mov cl, byte [ebp + 0x36e]
or al, bl
mov bl, byte [ebp + 0x36d]
or al, dl
mov dl, byte [ebp + 0x36c]
or al, cl
or al, bl
or al, dl
test al, 0x80
je 0x40bcad
mov cl, byte [ebp + 0x44f]
or byte [ebp + 0x34f], cl
mov al, byte [ebp + 0x35b]
mov dl, byte [ebp + 0x45b]
or al, dl
mov byte [ebp + 0x35b], al
mov al, byte [ebp + 0x332]
mov cl, byte [ebp + 0x3b5]
mov bl, byte [ebp + 0x3a2]
mov dl, byte [ebp + 0x34e]
or cl, al
mov al, byte [ebp + 0x3b7]
mov byte [ebp + 0x3b5], cl
mov cl, byte [ebp + 0x34d]
or al, cl
mov cl, byte [ebp + 0x341]
mov byte [ebp + 0x3b7], al
mov al, byte [ebp + 0x3c1]
or bl, dl
or cl, al
mov byte [ebp + 0x3a2], bl
mov byte [ebp + 0x341], cl
xor edi, edi
xor eax, eax
mov al, byte [edi + 0x4ab988]
test eax, eax
je 0x40bd3a
test byte [esi + eax], 0x80
je 0x40bd27
test byte [eax + ebp + 0x425], 0x80
jne 0x40bd3a
push 0
push edi
mov ecx, ebp
call fcn.0040cc40
jmp 0x40bd3a
mov al, byte [edi + ebp + 0x620]
test al, al
jne 0x40bd3a
push edi
mov ecx, ebp
call fcn.0040cde0
inc edi
cmp edi, 0x100
jl 0x40bcff
lea edi, [ebp + 0x425]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
jmp 0x40be0d
mov al, byte [ebp + 0x525]
test al, al
je 0x40bdb6
mov cl, byte [ebp + 0x526]
test cl, cl
jne 0x40bdb2
mov al, byte [ebp + 0x2c5]
test al, al
jne 0x40bdff
mov al, byte [ebp + 0x2c6]
test al, al
jne 0x40bd90
mov ecx, dword [ebp + 0xb34]
mov edx, dword [ecx]
push 0
push 0x10
call dword [edx + 0x5c]
mov ecx, dword [ebp + 0xb34]
mov eax, dword [ecx]
push 0
push 0xa0
call dword [eax + 0x5c]
mov byte [ebp + 0x235], 0x80
mov byte [ebp + 0x2c5], 0x80
jmp 0x40bdff
test al, al
jne 0x40bdff
mov al, byte [ebp + 0x526]
test al, al
je 0x40bdff
mov al, byte [ebp + 0x2c5]
test al, al
je 0x40bdff
mov ecx, dword [ebp + 0xb34]
mov edx, dword [ecx]
push 0xa0
call dword [edx + 0x60]
mov al, byte [ebp + 0x2c6]
test al, al
jne 0x40bdf1
mov ecx, dword [ebp + 0xb34]
mov eax, dword [ecx]
push 0x10
call dword [eax + 0x60]
mov byte [ebp + 0x235], 0
mov byte [ebp + 0x2c5], 0
mov byte [ebp + 0x526], 0
mov byte [ebp + 0x525], 0
push 0x14
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov bx, ax
mov al, byte [ebp + 0x527]
and bl, 1
cmp al, bl
je 0x40be39
push 0
push 0xf0
mov ecx, ebp
call fcn.0040cc40
mov byte [ebp + 0x527], bl
mov al, byte [ebp + 0x528]
test al, al
je 0x40be87
mov al, byte [ebp + 0xb38]
test al, al
jne 0x40be87
lea esi, [ebp + 0x225]
mov edi, 0xfffffddb
mov dword [esp + 0x10], esi
sub edi, ebp
mov al, byte [esi]
test al, 0x80
je 0x40be79
and al, 0x7f
mov byte [esi], al
jne 0x40be79
mov ecx, dword [ebp + 0xb34]
mov edx, dword [ecx]
lea eax, [edi + esi]
push eax
call dword [edx + 0x60]
inc esi
lea ecx, [edi + esi]
cmp ecx, 0x100
jl 0x40be5e
jmp 0x40bec6
lea esi, [ebp + 0x225]
mov edi, 0xfffffddb
mov dword [esp + 0x10], esi
sub edi, ebp
mov al, byte [esi]
mov cl, al
and cl, 0x7f
je 0x40beba
and al, 0x80
dec cl
or al, cl
mov byte [esi], al
jne 0x40beba
mov ecx, dword [ebp + 0xb34]
mov edx, dword [ecx]
lea eax, [esi + edi]
push eax
call dword [edx + 0x60]
inc esi
lea ecx, [esi + edi]
cmp ecx, 0x100
jl 0x40be98
mov edx, dword [esp + 0x10]
xor eax, eax
mov byte [ebp + 0x528], 0
mov byte [edx], 0
lea edi, [ebp + 0x52c]
mov ecx, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 0x53c]
xor ebx, ebx
test eax, eax
jle 0x40c047
lea esi, [ebp + 0x550]
cmp ebx, 4
jge 0x40c047
mov dword [edi], 0
mov eax, dword [esi - 0x10]
test eax, eax
mov dword [esp + 0x1c], 0x34
mov dword [esp + 0x20], 0xff
je 0x40c032
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.WINMM.dll_joyGetPosEx]
test eax, eax
jne 0x40c032
cmp dword [esi - 0x10], 2
jb 0x40bf56
mov eax, dword [esp + 0x28]
cmp eax, dword [esi - 4]
jae 0x40bf4f
or dword [edi], 1
cmp eax, dword [esi]
jbe 0x40bf56
or dword [edi], 2
cmp dword [esi - 0x10], 1
jb 0x40bf70
mov eax, dword [esp + 0x24]
cmp eax, dword [esi - 0xc]
jae 0x40bf68
or dword [edi], 4
cmp eax, dword [esi - 8]
jbe 0x40bf70
or dword [edi], 8
cmp dword [esi - 0x10], 3
jb 0x40bf90
mov eax, dword [esp + 0x2c]
cmp eax, dword [esi + 4]
jae 0x40bf85
or dword [edi], 0x100000
cmp eax, dword [esi + 8]
jbe 0x40bf90
or dword [edi], 0x200000
cmp dword [esi - 0x10], 4
jb 0x40bfb0
mov eax, dword [esp + 0x30]
cmp eax, dword [esi + 0xc]
jae 0x40bfa5
or dword [edi], 0x400000
cmp eax, dword [esi + 0x10]
jbe 0x40bfb0
or dword [edi], 0x800000
cmp dword [esi - 0x10], 5
jb 0x40bfd0
mov eax, dword [esp + 0x34]
cmp eax, dword [esi + 0x14]
jae 0x40bfc5
or dword [edi], 0x1000000
cmp eax, dword [esi + 0x18]
jbe 0x40bfd0
or dword [edi], 0x2000000
cmp dword [esi - 0x10], 6
jb 0x40bff0
mov eax, dword [esp + 0x38]
cmp eax, dword [esi + 0x1c]
jae 0x40bfe5
or dword [edi], 0x4000000
cmp eax, dword [esi + 0x20]
jbe 0x40bff0
or dword [edi], 0x8000000
mov edx, dword [esp + 0x44]
cmp edx, 0xffff
je 0x40c022
xor ecx, ecx
mov eax, 0x8ca
cmp edx, eax
jb 0x40c016
add eax, 0x1194
inc ecx
cmp eax, 0xa6fe
jl 0x40c003
jmp 0x40c022
and ecx, 7
mov eax, dword [ecx*4 + 0x4aba88]
or dword [edi], eax
mov ecx, dword [esi + 0x24]
and ecx, dword [esp + 0x3c]
mov eax, dword [edi]
shl ecx, 4
or eax, ecx
mov dword [edi], eax
mov eax, dword [ebp + 0x53c]
inc ebx
add edi, 4
add esi, 0x38
cmp ebx, eax
jl 0x40beff
mov al, byte [0x8dd95e]
test al, al
je 0x40c09e
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x26
call esi
shr eax, 0xf
test al, 1
je 0x40c068
or dword [ebp + 0x52c], 1
push 0x28
call esi
shr eax, 0xf
test al, 1
je 0x40c07a
or dword [ebp + 0x52c], 2
push 0x25
call esi
shr eax, 0xf
test al, 1
je 0x40c08c
or dword [ebp + 0x52c], 4
push 0x27
call esi
shr eax, 0xf
test al, 1
je 0x40c09e
or dword [ebp + 0x52c], 8
mov al, byte [0x8dd6e4]
test al, al
je 0x40c258
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x54]
mov dword [esp + 0x50], 0
rep stosd dword es:[edi], eax
mov eax, dword [0x8dd6e8]
test eax, eax
jne 0x40c0f9
mov edx, dword [ebp + 0x52c]
xor ecx, ecx
mov eax, str.__hbdf
mov ebx, 1
mov esi, ebx
shl esi, cl
test edx, esi
je 0x40c0e9
mov esi, dword [eax]
mov dword [esp + esi*4 + 0x50], ebx
add eax, 4
inc ecx
cmp eax, 0x4abab8
jl 0x40c0db
jmp 0x40c1a2
mov ebx, 1
cmp eax, ebx
jne 0x40c12a
mov edx, dword [ebp + 0x52c]
xor ecx, ecx
mov eax, 0x4abab8
mov esi, ebx
shl esi, cl
test edx, esi
je 0x40c11d
mov esi, dword [eax]
mov dword [esp + esi*4 + 0x50], ebx
add eax, 4
inc ecx
cmp eax, 0x4abac8
jl 0x40c10f
jmp case.0x40c140.3
cmp eax, 2
jne 0x40c1a2
mov edx, dword [ebp + 0x52c]
mov eax, edx
and eax, 0xf
dec eax
cmp eax, 9
ja case.0x40c140.3
jmp dword [eax*4 + 0x40c410]
mov dword [esp + 0x1d4], ebx
jmp case.0x40c140.3
mov dword [esp + 0x1d8], ebx
jmp case.0x40c140.3
mov dword [esp + 0x1dc], ebx
jmp case.0x40c140.3
mov dword [esp + 0x1e0], ebx
jmp case.0x40c140.3
mov dword [esp + 0x1e8], ebx
jmp case.0x40c140.3
mov dword [esp + 0x1ec], ebx
jmp case.0x40c140.3
mov dword [esp + 0x1f0], ebx
jmp case.0x40c140.3
mov dword [esp + 0x1f4], ebx
mov al, byte [0x8dd6ec]
test al, al
je 0x40c1a2
test dl, 0xf
jne 0x40c1a2
mov dword [esp + 0x1e4], ebx
mov edi, dword [ebp + 0x52c]
xor esi, esi
mov edx, 0x8dd6f0
lea ecx, [esi + 4]
mov eax, ebx
shl eax, cl
test edi, eax
je 0x40c1d7
mov eax, dword [edx]
test eax, eax
jge 0x40c1d7
mov ecx, eax
neg ecx
cmp ecx, 0x100
jge 0x40c1d7
shl eax, 2
lea ecx, [esp + 0x50]
sub ecx, eax
mov dword [ecx], ebx
add edx, 4
inc esi
cmp edx, 0x8dd730
jl 0x40c1af
xor edi, edi
lea ebx, [esp + 0x50]
cmp dword [ebx], 0
mov al, byte [edi + ebp + 0x620]
je 0x40c22e
test al, al
jne 0x40c24c
mov esi, dword [esp + 0x10]
test byte [esi + edi], 0x80
jne 0x40c224
push 0
push edi
mov ecx, ebp
call fcn.0040cc40
mov al, byte [0x8dd6ec]
test al, al
je 0x40c224
cmp edi, 0x61
jl 0x40c224
cmp edi, 0x69
jg 0x40c224
mov byte [esi + edi], 3
mov byte [edi + ebp + 0x620], 1
jmp 0x40c24c
test al, al
je 0x40c24c
mov edx, dword [esp + 0x10]
cmp byte [edx + edi], 0
je 0x40c244
push edi
mov ecx, ebp
call fcn.0040cde0
mov byte [edi + ebp + 0x620], 0
inc edi
add ebx, 4
cmp edi, 0x100
jl 0x40c1e9
xor eax, eax
lea esi, [ebp + 0x720]
mov ecx, esi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov al, byte [ebp + 0x72c]
test al, al
je 0x40c354
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp + 0xb3c]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp + 0x834]
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
sub edx, eax
mov eax, dword [ebp + 0x838]
mov dword [esi], edx
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
push 1
mov dword [ebp + 0x724], ecx
call edi
push 2
shr eax, 0xf
and eax, 1
mov dword [ebp + 0x728], eax
call edi
mov ecx, dword [ebp + 0x728]
push 4
shr eax, 0xe
and eax, 2
or ecx, eax
mov dword [ebp + 0x728], ecx
call edi
mov ecx, dword [ebp + 0x728]
shr eax, 0xd
and eax, 4
or ecx, eax
cmp dword [esi], 0
mov dword [ebp + 0x728], ecx
jne 0x40c314
mov eax, dword [ebp + 0x724]
test eax, eax
je 0x40c354
mov eax, dword [ebp + 0x834]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x838]
cdq
sub eax, edx
sar eax, 1
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xb3c]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
mov eax, dword [0x4cfbfc]
test eax, eax
je 0x40c405
cmp dword [eax], 0
je 0x40c405
mov cl, byte [0x8dd851]
test cl, cl
je 0x40c3dc
cmp dword [eax], 0
je 0x40c3dc
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x40c3dc
mov esi, dword [esp + 0x10]
push esi
call ecx
add esp, 4
test eax, eax
je 0x40c3d5
mov eax, dword [0x4cfbfc]
cmp dword [eax], 0
je 0x40c405
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x40c3e0
call ecx
test eax, eax
je 0x40c3d5
mov eax, dword [0x4cfbfc]
cmp dword [eax], 0
je 0x40c3bc
mov eax, dword [eax + 0x10]
test eax, eax
je 0x40c3bc
push esi
call eax
add esp, 4
pop edi
pop esi
mov byte [ebp + 0x2ad], 0
mov byte [ebp + 0x2ae], 0
pop ebp
pop ebx
add esp, 0x440
ret
mov eax, dword [0x4cfbfc]
jmp 0x40c3e0
mov esi, dword [esp + 0x10]
cmp dword [eax], 0
je 0x40c405
mov eax, dword [eax + 0x20]
test eax, eax
je 0x40c405
lea ecx, [esp + 0x10]
push ecx
call eax
add esp, 4
test eax, eax
je 0x40c405
mov edi, dword [esp + 0x10]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x440
ret