Function at 0x411720
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x429fa8
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x48
cmp eax, 0x20
push ebx
push ebp
push esi
push edi
mov esi, ecx
jb 0x41174c
cmp eax, 0x7e
jbe 0x411762
cmp eax, 0xa0
jb 0x411af3
cmp eax, 0xff
ja 0x411af3
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
mov dword [esp + 0x14], eax
jne 0x411791
mov eax, dword [esp + 0x68]
push eax
push str.ignoring_unrecognised_Latin_1_keysym__d_n
push 8
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
jmp 0x411c26
xor ebx, ebx
mov dword [esp + 0x1c], 0x11
mov dword [esp + 0x20], ebx
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov dword [esp + 0x60], ebx
mov dword [esp + 0x4c], 0x12
mov dword [esp + 0x50], ebx
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], bl
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov dword [esp + 0x40], 0xa0
mov dword [esp + 0x44], ebx
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
mov dword [esp + 0x34], 0xa1
mov dword [esp + 0x38], ebx
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov cl, byte [esp + 0x6c]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp cl, bl
mov byte [esp + 0x60], 4
je 0x4119a6
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 8
test al, 2
mov byte [esp + 0x13], al
je 0x411877
push 0x11
call ebp
test ah, 0x80
jne 0x411873
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 0x1c]
push ebx
push edx
and eax, 0xff
push ebx
push eax
mov byte [esp + 0x28], cl
call edi
mov ecx, dword [esp + 0x20]
push eax
push ecx
call esi
mov edx, dword [esp + 0x1c]
push edx
push str.fake__d_down_n
push 9
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
mov byte [esp + 0x24], 1
mov al, byte [esp + 0x13]
test al, 4
je 0x4118af
push 0x12
call ebp
test ah, 0x80
jne 0x4118ab
push ebx
push ebx
push ebx
push 0x12
call edi
push eax
push 0x12
call esi
push 0x12
push str.fake__d_down_n
push 9
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
mov byte [esp + 0x54], 1
mov al, byte [esp + 0x13]
test al, 1
je 0x4118ec
push 0x10
call ebp
test ah, 0x80
jne 0x4119a6
push ebx
push ebx
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_down_n
push 9
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
mov byte [esp + 0x30], 1
jmp 0x4119a6
call fcn.004195d0
test eax, eax
je 0x41192c
push 0x10
call ebp
test ah, 0x80
je 0x4119a6
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_up_n
push 9
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
mov byte [esp + 0x31], 1
jmp 0x4119a6
push 0xa0
call ebp
test ah, 0x80
je 0x411969
push ebx
push 2
push ebx
push 0xa0
call edi
push eax
push 0xa0
call esi
push 0xa0
push str.fake__d_up_n
push 9
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
mov byte [esp + 0x49], 1
push 0xa1
call ebp
test ah, 0x80
je 0x4119a6
push ebx
push 2
push ebx
push 0xa1
call edi
push eax
push 0xa1
call esi
push 0xa1
push str.fake__d_up_n
push 9
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
mov byte [esp + 0x3d], 1
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x14]
and eax, 0xff
and ebp, 0xff
push eax
mov eax, dword [esp + 0x6c]
push ebp
push eax
push eax
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_n
push 9
push 0x43b3b0
call fcn.00402c70
mov eax, dword [esp + 0x88]
add esp, 0x1c
neg al
sbb eax, eax
push ebx
and al, 0xfe
add eax, 2
push eax
push ebx
push ebp
call edi
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call esi
mov al, byte [esp + 0x3d]
mov byte [esp + 0x60], 3
cmp al, bl
je 0x411a2b
push ebx
push ebx
push ebx
push 0xa1
call edi
push eax
push 0xa1
call esi
push 0xa1
push str.fake__d_down_n
push 9
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
mov al, byte [esp + 0x49]
mov byte [esp + 0x60], 2
cmp al, bl
je 0x411a63
push ebx
push ebx
push ebx
push 0xa0
call edi
push eax
push 0xa0
call esi
push 0xa0
push str.fake__d_down_n
push 9
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
mov al, byte [esp + 0x30]
mov byte [esp + 0x60], 1
cmp al, bl
je 0x411a86
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_up_n
jmp 0x411a9f
cmp byte [esp + 0x31], bl
je 0x411aae
push ebx
push ebx
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_down_n
push 9
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
mov al, byte [esp + 0x54]
mov byte [esp + 0x60], bl
cmp al, bl
je 0x411add
push ebx
push 2
push ebx
push 0x12
call edi
push eax
push 0x12
call esi
push 0x12
push str.fake__d_up_n
push 9
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
lea ecx, [esp + 0x1c]
mov dword [esp + 0x60], 0xffffffff
call fcn.00411c40
jmp 0x411c26
mov edi, dword [esi + 4]
lea edx, [esp + 0x68]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.00412050
cmp dword [esp + 0x18], edi
jne 0x411b2b
mov ecx, dword [esp + 0x68]
push ecx
push str.ignoring_unknown_keysym__d_n
push 8
push 0x43b3b0
call fcn.00402c70
add esp, 0x10
jmp 0x411c26
lea edx, [esp + 0x68]
mov ecx, esi
push edx
call fcn.00411e10
mov al, byte [eax]
lea ecx, [esp + 0x68]
lea edi, [esi + 0x10]
push ecx
mov ecx, edi
mov byte [esp + 0x18], al
xor ebx, ebx
xor ebp, ebp
call fcn.00411f30
cmp byte [eax], bl
je 0x411b59
mov ebp, 1
mov eax, dword [esp + 0x6c]
cmp al, bl
jne 0x411b64
or ebp, 2
mov esi, dword [esp + 0x14]
and eax, 0xff
lea edx, [esp + 0x68]
push eax
push edx
mov ecx, edi
and esi, 0xff
call fcn.00411f30
xor ecx, ecx
mov cl, byte [eax]
mov eax, dword [esp + 0x6c]
push ecx
push esi
push eax
push eax
push str.keyboard_key:_keysym__d_0x_x__vkCode_0x_x_ext__d_down__d_n
push 9
push 0x43b3b0
call fcn.00402c70
mov al, byte [esp + 0x8c]
add esp, 0x20
cmp al, bl
je 0x411bda
cmp byte [esp + 0x14], 0x2e
jne 0x411bda
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
test ah, 0x80
je 0x411bda
push 0x12
call edi
test ah, 0x80
je 0x411bda
call fcn.004195e0
test eax, eax
je 0x411bda
call fcn.00419970
jmp 0x411c26
call fcn.004195d0
test eax, eax
je 0x411c08
sub esi, 0xa1
je 0x411c03
sub esi, 2
je 0x411bfc
sub esi, 2
jne 0x411c08
mov byte [esp + 0x14], 0x12
jmp 0x411c08
mov byte [esp + 0x14], 0x11
jmp 0x411c08
mov byte [esp + 0x14], 0x10
mov esi, dword [esp + 0x14]
push ebx
mov edx, esi
push ebp
and edx, 0xff
push ebx
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x58]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 8