Function at 0x410300
Capabilities:
Log keystrokes
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x444118
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x74]
cmp edi, 0x20
mov esi, ecx
jb 0x41032c
cmp edi, 0x7e
jbe 0x41033b
lea eax, [edi - 0xa0]
cmp eax, 0x5f
ja 0x410515
push edi
call dword [sym.imp.USER32.dll_VkKeyScanA]
movzx ecx, ax
cmp cx, 0xffff
mov dword [esp + 0x74], ecx
jne 0x410379
push edi
push str.ignoring_unrecognised_Latin_1_keysym__d_n
push 8
push 0x457788
call fcn.00401860
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0xc
mov esi, dword [esp + 0x7c]
xor eax, eax
mov dword [esp + 0x54], 0x11
mov dword [esp + 0x58], eax
mov byte [esp + 0x5c], al
mov byte [esp + 0x5d], al
mov dword [esp + 0x60], esi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x44], 0x12
mov dword [esp + 0x48], eax
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], al
mov dword [esp + 0x50], esi
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], al
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], 0xa0
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
mov byte [esp + 0x3d], al
mov dword [esp + 0x40], esi
mov dword [esp + 0x24], 0xa1
mov dword [esp + 0x28], eax
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], al
mov dword [esp + 0x30], esi
mov bl, byte [esp + 0x78]
test bl, bl
mov byte [esp + 0x6c], 4
je 0x410463
mov eax, ecx
shr eax, 8
test al, 2
mov byte [esp + 0x78], al
je 0x410422
lea ecx, [esp + 0x54]
call fcn.0040ed70
mov al, byte [esp + 0x78]
test al, 4
je 0x410433
lea ecx, [esp + 0x44]
call fcn.0040ed70
mov al, byte [esp + 0x78]
test al, 1
je 0x410442
lea ecx, [esp + 0x14]
call fcn.0040ed70
jmp 0x410463
call fcn.004158c0
test eax, eax
je 0x410451
lea ecx, [esp + 0x14]
jmp 0x41045e
lea ecx, [esp + 0x34]
call fcn.0040ede0
lea ecx, [esp + 0x24]
call fcn.0040ede0
movzx ebp, byte [esp + 0x74]
movzx ecx, bl
push ecx
push ebp
push edi
push edi
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_n
push 9
push 0x457788
call fcn.00401860
add esp, 0x1c
test esi, esi
je 0x410495
mov edx, dword [esi]
mov eax, dword [edx + 0x214]
push 1
mov ecx, esi
call eax
neg bl
push 0
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 2
push ebx
push 0
push ebp
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, dword [esp + 0x7c]
push eax
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
lea ecx, [esp + 0x24]
mov byte [esp + 0x6c], 3
call fcn.0040ee50
lea ecx, [esp + 0x34]
mov byte [esp + 0x6c], 2
call fcn.0040ee50
lea ecx, [esp + 0x14]
mov byte [esp + 0x6c], 1
call fcn.0040ee50
lea ecx, [esp + 0x44]
mov byte [esp + 0x6c], 0
call fcn.0040ee50
lea ecx, [esp + 0x54]
mov dword [esp + 0x6c], 0xffffffff
call fcn.0040ee50
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0xc
mov ebp, dword [esi + 4]
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0040f590
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x410533
cmp eax, esi
je 0x410538
call fcn.00432b04
cmp dword [ebx + 4], ebp
jne 0x410567
push edi
push str.ignoring_unknown_keysym__d_n
push 8
push 0x457788
call fcn.00401860
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0xc
lea ecx, [esp + 0x74]
push ecx
mov ecx, esi
call fcn.004101c0
mov dl, byte [eax]
lea eax, [esp + 0x74]
add esi, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x14], dl
xor ebp, ebp
call fcn.004101c0
cmp byte [eax], 0
je 0x410594
mov ebp, 1
mov bl, byte [esp + 0x78]
test bl, bl
jne 0x41059f
or ebp, 2
lea ecx, [esp + 0x74]
push ecx
mov ecx, esi
call fcn.004101c0
movzx eax, byte [eax]
movzx esi, byte [esp + 0x10]
movzx edx, bl
push edx
push eax
push esi
push edi
push edi
push str.keyboard_key:_keysym__d_0x_x__vkCode_0x_x_ext__d_down__d_n
push 9
push 0x457788
call fcn.00401860
add esp, 0x20
test bl, bl
je 0x410615
cmp byte [esp + 0x10], 0x2e
jne 0x410615
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
test ax, ax
jns 0x410615
push 0x12
call edi
test ax, ax
jns 0x410615
call fcn.004158d0
test eax, eax
je 0x410615
call fcn.00415ca0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0xc
call fcn.004158c0
test eax, eax
je 0x410643
sub esi, 0xa1
je 0x41063e
sub esi, 2
je 0x410637
sub esi, 2
jne 0x410643
mov byte [esp + 0x10], 0x12
jmp 0x410643
mov byte [esp + 0x10], 0x11
jmp 0x410643
mov byte [esp + 0x10], 0x10
mov ecx, dword [esp + 0x7c]
test ecx, ecx
je 0x410657
mov edx, dword [ecx]
mov eax, dword [edx + 0x214]
push 1
call eax
movzx ecx, byte [esp + 0x10]
push 0
push ebp
push 0
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, dword [esp + 0x18]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret 0xc