Function at 0x417da0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x4dbd08
mov esi, 0x4dbd0c
mov edi, 0x4dbd18
cmp dword [0x4cb374], 0
je 0x4182b4
push 0
push 0x4dbd1c
mov eax, dword [ebp + 8]
push eax
call fcn.004b7b68
mov dword [0x4dbd04], eax
mov eax, dword [0x4dbd04]
test eax, eax
je 0x4182b4
cmp dword [eax + 0x4b8], 0
je 0x4182b4
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x417e09
mov dword [0x4dbd2c], 1
jmp 0x417e11
xor edx, edx
mov dword [0x4dbd2c], edx
mov ecx, dword [0x4cb364]
mov dword [0x4cb354], ecx
mov eax, dword [0x4cb368]
mov dword [0x4cb358], eax
mov edx, dword [0x4cb36c]
mov dword [0x4cb35c], edx
mov ecx, dword [0x4cb370]
mov dword [0x4cb360], ecx
mov edx, dword [0x4cb360]
mov eax, dword [0x4cb358]
cmp edx, eax
jne 0x417e60
mov ecx, dword [0x4cb35c]
cmp ecx, dword [0x4cb354]
jle 0x4182b4
cmp edx, eax
jg 0x4182b4
cmp dword [0x4cb354], 0
jl 0x4182b4
cmp dword [0x4cb358], 0
jl 0x4182b4
cmp dword [0x4cb35c], 0
jl 0x4182b4
cmp dword [0x4cb360], 0
jl 0x4182b4
mov eax, dword [0x4dbd04]
mov edx, dword [eax + 0x4c4]
sub edx, dword [eax + 0x4c8]
mov dword [0x4dbd14], edx
mov ecx, dword [eax + 0x4b8]
mov eax, dword [ecx + 0x30]
mov dword [ebx], eax
jmp 0x417edd
mov edx, dword [0x4dbd04]
mov ecx, dword [edx + 0x4b8]
mov eax, dword [ebx]
cmp ecx, eax
je 0x417ee6
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
dec dword [0x4dbd14]
cmp dword [0x4dbd14], 0
jg 0x417ec0
cmp dword [ebx], 0
je 0x4182b4
mov ecx, 0x64
mov dword [0x4dbd38], ecx
mov eax, dword [0x4dbd38]
push eax
call fcn.004c75a4
pop ecx
mov dword [0x4dbcfc], eax
test eax, eax
jne 0x417f1b
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4182b4
mov edx, dword [0x4dbd04]
mov ecx, dword [edx + 0x5b8]
mov dword [0x4dbd30], ecx
mov eax, dword [0x4dbd28]
sub eax, dword [0x4dbd30]
dec eax
mov dword [0x4dbd10], eax
xor edx, edx
mov dword [0x4dbd14], edx
jmp 0x417f7a
mov eax, dword [0x4dbd30]
sub dword [0x4dbd10], eax
neg eax
cmp eax, dword [0x4dbd10]
jg 0x417f88
mov edx, dword [0x4dbd04]
mov ecx, dword [edx + 0x4b8]
mov eax, dword [ebx]
cmp ecx, eax
je 0x417f88
mov edx, dword [eax + 0x30]
mov dword [ebx], edx
inc dword [0x4dbd14]
mov ecx, dword [0x4dbd14]
cmp ecx, dword [0x4cb358]
jl 0x417f48
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov dword [0x4dbd34], edx
mov byte [0x4e4b90], 0
mov ecx, dword [0x4dbcfc]
mov byte [ecx], 0
jmp 0x41826f
mov eax, dword [0x4dbd14]
cmp eax, dword [0x4cb358]
jne 0x418070
mov edx, dword [ebx]
mov ecx, dword [edx]
push esi
push edi
mov edi, ecx
mov esi, 0x4e4f77
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x4e4f77
call fcn.004bceac
pop ecx
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, dword [0x4cb354]
jge 0x418004
mov edx, dword [esi]
mov dword [0x4cb354], edx
mov ecx, dword [0x4dbd14]
cmp ecx, dword [0x4cb360]
jne 0x418038
mov eax, dword [esi]
cmp eax, dword [0x4cb35c]
jge 0x418024
mov edx, dword [esi]
mov dword [0x4cb35c], edx
mov ecx, dword [0x4cb35c]
mov byte [ecx + 0x4e4f78], 0
xor eax, eax
mov dword [0x4dbd14], eax
mov edx, 0x4e4f77
add edx, dword [0x4cb354]
push esi
push edi
mov edi, edx
mov esi, 0x4e4b90
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4181d4
mov eax, dword [ebx]
mov edx, dword [eax]
push esi
push edi
mov edi, edx
mov esi, 0x4e4f77
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, dword [0x4dbd14]
cmp eax, dword [0x4cb360]
jne 0x4180dc
push 0x4e4f77
call fcn.004bceac
pop ecx
mov dword [esi], eax
mov edx, dword [esi]
cmp edx, dword [0x4cb35c]
jge 0x4180c8
mov ecx, dword [esi]
mov dword [0x4cb35c], ecx
mov eax, dword [0x4cb35c]
mov byte [eax + 0x4e4f78], 0
xor edx, edx
mov dword [0x4dbd14], edx
cmp dword [0x4dbd2c], 0
jne 0x4181af
mov ecx, dword [ebx]
mov eax, dword [ecx + 4]
cmp eax, dword [0x4dbd34]
jne 0x4181af
mov edx, dword [ebx]
mov eax, dword [edx + 0xc]
test eax, eax
jle 0x418182
mov dword [esi], eax
mov dword [edi], 0x4e4f77
jmp 0x418115
dec dword [esi]
cmp al, 0x20
jne 0x418122
inc dword [edi]
mov edx, dword [edi]
mov al, byte [edx]
test al, al
je 0x418122
cmp dword [esi], 0
jg 0x41810d
mov edx, dword [edi]
cmp byte [edx], 0
je 0x418155
mov ecx, dword [edi]
push esi
push edi
mov esi, 0x4e4b90
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4181d4
push esi
push edi
mov esi, 0x4e4b90
mov edi, 0x4e4f77
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4181d4
push esi
push edi
mov esi, 0x4e4b90
mov edi, 0x4e4f77
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4181d4
push esi
push edi
mov esi, 0x4cb378
mov edi, 0x4e4b90
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x4e4f77
push 0x4e4b90
call fcn.004bcdd0
add esp, 8
push 0xf
push 0x4e4b90
call fcn.004a6178
mov edx, dword [0x4dbcfc]
push edx
call fcn.004bceac
pop ecx
push eax
push 0x4e4b90
call fcn.004bceac
pop ecx
pop ecx
add ecx, eax
add ecx, 0x14
mov dword [esi], ecx
mov eax, dword [esi]
cmp eax, dword [0x4dbd38]
jle 0x418245
add dword [esi], 0x64
mov edx, dword [esi]
mov dword [0x4dbd38], edx
mov ecx, dword [0x4dbd38]
push ecx
mov eax, dword [0x4dbcfc]
push eax
call fcn.004c7a38
add esp, 8
mov dword [0x4dbd00], eax
cmp dword [0x4dbd00], 0
je 0x41829e
mov edx, dword [0x4dbd00]
mov dword [0x4dbcfc], edx
push 0x4e4b90
mov ecx, dword [0x4dbcfc]
push ecx
call fcn.004bcdd0
add esp, 8
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov dword [0x4dbd34], edx
mov ecx, dword [eax + 0x2c]
mov dword [ebx], ecx
dec dword [0x4dbd14]
cmp dword [ebx], 0
je 0x418281
cmp dword [0x4dbd14], 0
jge 0x417fa8
mov eax, dword [0x4dbcfc]
push eax
call fcn.004bceac
pop ecx
cmp eax, 1
jbe 0x41829e
mov edx, dword [0x4dbcfc]
push edx
call fcn.0040b25c
cmp dword [0x4dbcfc], 0
je 0x4182b4
mov ecx, dword [0x4dbcfc]
push ecx
call fcn.004c749c
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 4