Function at 0x428330
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4560e8
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
push edi
push eax
push str._keysym_0x_x
push 8
push 0x46f3bc
mov esi, ecx
call fcn.00405970
mov eax, dword [esp + 0x74]
add esp, 0x10
cmp eax, 0xfe50
jb 0x428397
cmp eax, 0xfe60
ja 0x428397
push str.__DEAD_KEY
push 8
push 0x46f3bc
mov dword [0x47fcbc], eax
call fcn.00405970
add esp, 0xc
jmp 0x428d1a
cmp eax, 0x20
jb 0x4283a1
cmp eax, 0x7e
jbe 0x4283b7
cmp eax, 0xa0
jb 0x428be9
cmp eax, 0xff
ja 0x428be9
mov ecx, dword [0x47fcbc]
mov ebx, dword [esp + 0x68]
test ecx, ecx
je 0x4286fe
test bl, bl
je 0x4286fe
push eax
push ecx
push str._Compose_dead_0x_x_0x_x
push 8
push 0x46f3bc
call fcn.00405970
mov ecx, dword [0x47fcbc]
add esp, 0x14
lea eax, [ecx - 0xfe50]
cmp eax, 0xb
ja case.0x4283fc.65108
jmp dword [eax*4 + 0x428d30]
mov eax, dword [esp + 0x64]
lea esi, [eax - 0x41]
cmp esi, 0x34
ja case.0x42841b.75
xor edx, edx
mov dl, byte [esi + 0x428d8c]
jmp dword [edx*4 + 0x428d60]
mov eax, 0xc0
mov dword [esp + 0x64], eax
jmp case.0x42841b.75
mov eax, 0xc8
mov dword [esp + 0x64], eax
jmp case.0x42841b.75
mov eax, 0xcc
mov dword [esp + 0x64], eax
jmp case.0x42841b.75
mov eax, 0xd2
mov dword [esp + 0x64], eax
jmp case.0x42841b.75
mov eax, 0xd9
mov dword [esp + 0x64], eax
jmp case.0x42841b.75
mov eax, 0xe0
mov dword [esp + 0x64], eax
jmp case.0x42841b.75
mov eax, 0xe8
mov dword [esp + 0x64], eax
jmp case.0x42841b.75
mov eax, 0xec
mov dword [esp + 0x64], eax
jmp case.0x42841b.75
mov eax, 0xf2
mov dword [esp + 0x64], eax
jmp case.0x42841b.75
mov eax, 0xf9
mov dword [esp + 0x64], eax
jmp case.0x42841b.75
mov eax, dword [esp + 0x64]
lea esi, [eax - 0x41]
cmp esi, 0x38
ja case.0x4284a8.77
xor ecx, ecx
mov cl, byte [esi + 0x428df8]
jmp dword [ecx*4 + 0x428dc4]
mov eax, 0xc1
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xc9
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xcd
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xd3
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xda
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xe1
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xe9
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xed
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xf3
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xfa
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xfd
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, 0xdd
mov dword [esp + 0x64], eax
jmp case.0x4284a8.77
mov eax, dword [esp + 0x64]
lea esi, [eax - 0x41]
cmp esi, 0x34
ja case.0x42854b.75
xor edx, edx
mov dl, byte [esi + 0x428e60]
jmp dword [edx*4 + 0x428e34]
mov eax, 0xc2
mov dword [esp + 0x64], eax
jmp case.0x42854b.75
mov eax, 0xca
mov dword [esp + 0x64], eax
jmp case.0x42854b.75
mov eax, 0xce
mov dword [esp + 0x64], eax
jmp case.0x42854b.75
mov eax, 0xd4
mov dword [esp + 0x64], eax
jmp case.0x42854b.75
mov eax, 0xdb
mov dword [esp + 0x64], eax
jmp case.0x42854b.75
mov eax, 0xe2
mov dword [esp + 0x64], eax
jmp case.0x42854b.75
mov eax, 0xea
mov dword [esp + 0x64], eax
jmp case.0x42854b.75
mov eax, 0xee
mov dword [esp + 0x64], eax
jmp case.0x42854b.75
mov eax, 0xf4
mov dword [esp + 0x64], eax
jmp case.0x42854b.75
mov eax, 0xfb
mov dword [esp + 0x64], eax
jmp case.0x42854b.75
mov eax, dword [esp + 0x64]
lea esi, [eax - 0x41]
cmp esi, 0x2e
ja case.0x4285d4.70
xor ecx, ecx
mov cl, byte [esi + 0x428eb0]
jmp dword [ecx*4 + 0x428e98]
mov eax, 0xd1
mov dword [esp + 0x64], eax
jmp case.0x4285d4.70
mov eax, 0xd5
mov dword [esp + 0x64], eax
jmp case.0x4285d4.70
mov eax, 0xe3
mov dword [esp + 0x64], eax
jmp case.0x4285d4.70
mov eax, 0xf1
mov dword [esp + 0x64], eax
jmp case.0x4285d4.70
mov eax, 0xf5
mov dword [esp + 0x64], eax
jmp case.0x4285d4.70
mov eax, dword [esp + 0x64]
lea esi, [eax - 0x41]
cmp esi, 0x38
ja case.0x42862a.76
xor edx, edx
mov dl, byte [esi + 0x428f10]
jmp dword [edx*4 + 0x428ee0]
mov eax, 0xc4
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xcb
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xcf
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xd6
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xdc
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xe4
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xeb
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xef
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xf6
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xfc
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xff
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, dword [esp + 0x64]
cmp eax, 0x43
je 0x4286cc
cmp eax, 0x63
jne 0x4286db
mov eax, 0xe7
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, 0xc7
mov dword [esp + 0x64], eax
jmp 0x4286db
mov eax, dword [esp + 0x64]
push eax
push str._Composed_0x_x
push 8
push 0x46f3bc
mov dword [0x47fcbc], 0
call fcn.00405970
mov eax, dword [esp + 0x74]
add esp, 0x10
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov esi, eax
movsx ebp, si
push ebp
push str._SHORT_s__i
push 8
push 0x46f3bc
mov dword [esp + 0x20], esi
call fcn.00405970
add esp, 0x10
cmp si, 0xffff
jne 0x42886e
test bl, bl
je 0x428d1a
push str.down
push 8
push 0x46f3bc
call fcn.00405970
push str._Found_key
push 8
push 0x46f3bc
call fcn.00405970
mov ecx, dword [esp + 0x7c]
add esp, 0x18
xor eax, eax
xor edx, edx
mov dx, word [eax*2 + 0x467a98]
cmp ecx, edx
je 0x428776
inc eax
cmp eax, 0x100
jl 0x428760
cdq
mov esi, 0x64
idiv esi
mov esi, 0xa
mov bl, al
mov eax, edx
cdq
idiv esi
mov byte [esp + 0x10], bl
cmp edx, 0xff
mov dword [esp + 0x18], edx
mov byte [esp + 0x68], al
je 0x428854
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x12
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call edi
mov eax, dword [esp + 0x10]
push 0
and eax, 0xff
push 0
push 0
add bl, 0x60
lea ebp, [eax + 0x60]
push ebp
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push ebp
call esi
push eax
push ebx
call edi
mov ecx, dword [esp + 0x68]
mov bl, byte [esp + 0x68]
and ecx, 0xff
push 0
push 0
push 0
lea ebp, [ecx + 0x60]
add bl, 0x60
push ebp
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push ebp
call esi
push eax
push ebx
call edi
mov ebx, dword [esp + 0x18]
push 0
mov edx, ebx
push 0
and edx, 0xff
push 0
add bl, 0x60
lea ebp, [edx + 0x60]
push ebp
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push ebp
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push 0x12
call esi
push eax
push 0x12
call edi
jmp 0x428d1a
push ecx
push str.ignoring_unrecognised_Latin_1_keysym_0x_x
push 8
push 0x46f3bc
call fcn.00405970
add esp, 0x10
jmp 0x428d1a
xor eax, eax
mov dword [esp + 0x48], 0x11
mov dword [esp + 0x4c], eax
mov byte [esp + 0x50], al
mov byte [esp + 0x51], al
mov dword [esp + 0x5c], eax
mov dword [esp + 0x3c], 0x12
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], al
mov byte [esp + 0x45], al
mov dword [esp + 0x30], 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0x38], al
mov byte [esp + 0x39], al
mov dword [esp + 0x18], 0xa0
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], al
mov byte [esp + 0x21], al
mov dword [esp + 0x24], 0xa1
mov dword [esp + 0x28], eax
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], al
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
test bl, bl
mov byte [esp + 0x5c], 4
je 0x428a6a
mov eax, ebp
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 8
test al, 2
mov byte [esp + 0x68], al
je 0x42893a
push 0x11
call ebp
test ah, ah
js 0x428936
push 0
push 0
push 0
push 0x11
call edi
push eax
push 0x11
call esi
push 0x11
push str.fake__d_down_n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x10
mov byte [esp + 0x50], 1
mov al, byte [esp + 0x68]
test al, 4
je 0x428974
push 0x12
call ebp
test ah, ah
js 0x428970
push 0
push 0
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push 0x12
push str.fake__d_down_n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x10
mov byte [esp + 0x44], 1
mov al, byte [esp + 0x68]
test al, 1
je 0x4289b0
push 0x10
call ebp
test ah, ah
js 0x428a6a
push 0
push 0
push 0
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_down_n
push 9
push 0x46f3bc
call fcn.00405970
mov byte [esp + 0x48], 1
jmp 0x428a67
call fcn.00436190
test eax, eax
je 0x4289ee
push 0x10
call ebp
test ah, ah
jns 0x428a6a
push 0
push 2
push 0
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_up_n
push 9
push 0x46f3bc
call fcn.00405970
mov byte [esp + 0x49], 1
jmp 0x428a67
push 0xa0
call ebp
test ah, ah
jns 0x428a2c
push 0
push 2
push 0
push 0xa0
call edi
push eax
push 0xa0
call esi
push 0xa0
push str.fake__d_up_n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x10
mov byte [esp + 0x21], 1
push 0xa1
call ebp
test ah, ah
jns 0x428a6a
push 0
push 2
push 0
push 0xa1
call edi
push eax
push 0xa1
call esi
push 0xa1
push str.fake__d_up_n
push 9
push 0x46f3bc
call fcn.00405970
mov byte [esp + 0x3d], 1
add esp, 0x10
mov ebp, dword [esp + 0x10]
mov eax, ebx
and eax, 0xff
and ebp, 0xff
push eax
mov eax, dword [esp + 0x68]
push ebp
push eax
push eax
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x1c
neg bl
sbb ebx, ebx
push 0
and ebx, 0xfffffffe
add ebx, 2
push ebx
push 0
push ebp
call edi
mov ecx, dword [esp + 0x18]
push eax
push ecx
call esi
mov al, byte [esp + 0x2d]
mov byte [esp + 0x5c], 3
test al, al
je 0x428aec
push 0
push 0
push 0
push 0xa1
call edi
push eax
push 0xa1
call esi
push 0xa1
push str.fake__d_down_n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x10
mov al, byte [esp + 0x21]
mov byte [esp + 0x5c], 2
test al, al
je 0x428b27
push 0
push 0
push 0
push 0xa0
call edi
push eax
push 0xa0
call esi
push 0xa0
push str.fake__d_down_n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x10
mov al, byte [esp + 0x38]
mov byte [esp + 0x5c], 1
test al, al
je 0x428b4c
push 0
push 2
push 0
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_up_n
jmp 0x428b6a
mov al, byte [esp + 0x39]
test al, al
je 0x428b79
push 0
push 0
push 0
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_down_n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x10
mov al, byte [esp + 0x44]
mov byte [esp + 0x5c], 0
test al, al
je 0x428bab
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push 0x12
push str.fake__d_up_n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x10
mov al, byte [esp + 0x50]
mov dword [esp + 0x5c], 0xffffffff
test al, al
je 0x428d1a
push 0
push 2
push 0
push 0x11
call edi
push eax
push 0x11
call esi
push 0x11
push str.fake__d_up_n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x10
jmp 0x428d1a
mov edi, dword [esi + 4]
lea edx, [esp + 0x64]
push edx
mov ecx, esi
call fcn.0042a3b0
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x64]
cmp eax, ecx
mov dword [esp + 0x18], eax
je 0x428c12
cmp edx, dword [eax + 0xc]
jb 0x428c12
lea eax, [esp + 0x18]
jmp 0x428c1a
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x10]
cmp dword [eax], edi
jne 0x428c38
push edx
push str.ignoring_unknown_keysym__d_n
push 8
push 0x46f3bc
call fcn.00405970
add esp, 0x10
jmp 0x428d1a
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x20], edx
mov byte [esp + 0x24], 0
call fcn.00429260
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x24]
xor edi, edi
mov bl, byte [edx + 0x10]
lea edx, [esp + 0x30]
push ecx
push edx
lea ecx, [esi + 0x10]
mov byte [esp + 0x18], bl
mov dword [esp + 0x2c], eax
mov byte [esp + 0x30], 0
call fcn.004299d0
mov eax, dword [esp + 0x30]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x428c8e
mov edi, 1
mov al, byte [esp + 0x68]
test al, al
jne 0x428cc3
or edi, 2
call fcn.00436190
test eax, eax
je 0x428cfa
mov eax, dword [esp + 0x10]
and eax, 0xff
sub eax, 0xa1
je 0x428cf5
sub eax, 2
je 0x428cee
sub eax, 2
jne 0x428cfa
mov byte [esp + 0x10], 0x12
jmp 0x428cfa
cmp bl, 0x2e
jne 0x428c99
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
test ah, ah
jns 0x428c99
push 0x12
call esi
test ah, ah
jns 0x428c99
call fcn.004361a0
test eax, eax
je 0x428c99
call fcn.004365a0
jmp 0x428d1a
mov byte [esp + 0x10], 0x11
jmp 0x428cfa
mov byte [esp + 0x10], 0x10
mov esi, dword [esp + 0x10]
push 0
mov ecx, esi
push edi
and ecx, 0xff
push 0
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 8