Function at 0x416d04
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, 0x427f64
call fcn.00427220
sub esp, 0x48
push ebx
push esi
push edi
mov edi, 0x4386e8
push dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push str._keysym_0x_x
push 8
push edi
call fcn.00405446
mov ecx, dword [ebp + 8]
mov esi, 0xfe50
add esp, 0x10
cmp ecx, esi
jb 0x416d60
cmp ecx, 0xfe60
ja 0x416d60
push str.__DEAD_KEY
push 8
push edi
mov dword [0x438bc8], ecx
call fcn.00405446
add esp, 0xc
jmp 0x417477
cmp ecx, 0x20
jb 0x416d6a
cmp ecx, 0x7e
jbe 0x416d82
cmp ecx, 0xa0
jb 0x4173a4
cmp ecx, 0xff
ja 0x4173a4
mov eax, dword [0x438bc8]
xor ebx, ebx
cmp eax, ebx
je 0x417116
cmp byte [ebp + 0xc], bl
je 0x417116
push ecx
push eax
push str._Compose_dead_0x_x_0x_x
push 8
push edi
call fcn.00405446
add esp, 0x14
mov eax, dword [0x438bc8]
sub eax, esi
push 0x61
pop ecx
push 0x41
pop edx
push 0x65
pop esi
je 0x416dea
dec eax
je 0x416e95
dec eax
je 0x416f62
dec eax
je 0x416fee
sub eax, 4
je 0x41703e
sub eax, 4
je 0x4170de
jmp 0x4170fa
mov eax, dword [ebp + 8]
cmp eax, ecx
ja 0x416e57
je 0x416e4b
cmp eax, edx
je 0x416e3f
cmp eax, 0x45
je 0x416e33
cmp eax, 0x49
je 0x416e27
cmp eax, 0x4f
je 0x416e1b
cmp eax, 0x55
jne 0x416e95
mov dword [ebp + 8], 0xd9
jmp 0x416fee
mov dword [ebp + 8], 0xd2
jmp 0x416fee
mov dword [ebp + 8], 0xcc
jmp 0x416fee
mov dword [ebp + 8], 0xc8
jmp 0x416fee
mov dword [ebp + 8], 0xc0
jmp 0x416fee
mov dword [ebp + 8], 0xe0
jmp 0x416fee
cmp eax, esi
je 0x416e8e
cmp eax, 0x69
je 0x416e82
cmp eax, 0x6f
je 0x416e76
cmp eax, 0x75
jne 0x416e95
mov dword [ebp + 8], 0xf9
jmp 0x416fee
mov dword [ebp + 8], 0xf2
jmp 0x416fee
mov dword [ebp + 8], 0xec
jmp 0x416fee
mov dword [ebp + 8], 0xe8
mov eax, dword [ebp + 8]
cmp eax, ecx
ja 0x416f13
je 0x416f07
cmp eax, edx
je 0x416efb
cmp eax, 0x45
je 0x416eef
cmp eax, 0x49
je 0x416ee3
cmp eax, 0x4f
je 0x416ed7
cmp eax, 0x55
je 0x416ecb
cmp eax, 0x59
jne 0x416f62
mov dword [ebp + 8], 0xdd
jmp 0x416fee
mov dword [ebp + 8], 0xda
jmp 0x416fee
mov dword [ebp + 8], 0xd3
jmp 0x416fee
mov dword [ebp + 8], 0xcd
jmp 0x416fee
mov dword [ebp + 8], 0xc9
jmp 0x416fee
mov dword [ebp + 8], 0xc1
jmp 0x416fee
mov dword [ebp + 8], 0xe1
jmp 0x416fee
cmp eax, esi
je 0x416f5b
cmp eax, 0x69
je 0x416f4f
cmp eax, 0x6f
je 0x416f43
cmp eax, 0x75
je 0x416f37
cmp eax, 0x79
jne 0x416f62
mov dword [ebp + 8], 0xfd
jmp 0x416fee
mov dword [ebp + 8], 0xfa
jmp 0x416fee
mov dword [ebp + 8], 0xf3
jmp 0x416fee
mov dword [ebp + 8], 0xed
jmp 0x416fee
mov dword [ebp + 8], 0xe9
mov eax, dword [ebp + 8]
cmp eax, ecx
ja 0x416fb9
je 0x416fb0
cmp eax, edx
je 0x416fa7
cmp eax, 0x45
je 0x416f9e
cmp eax, 0x49
je 0x416f95
cmp eax, 0x4f
je 0x416f8c
cmp eax, 0x55
jne 0x416fee
mov dword [ebp + 8], 0xdb
jmp 0x416fee
mov dword [ebp + 8], 0xd4
jmp 0x416fee
mov dword [ebp + 8], 0xce
jmp 0x416fee
mov dword [ebp + 8], 0xca
jmp 0x416fee
mov dword [ebp + 8], 0xc2
jmp 0x416fee
mov dword [ebp + 8], 0xe2
jmp 0x416fee
cmp eax, esi
je 0x416fe7
cmp eax, 0x69
je 0x416fde
cmp eax, 0x6f
je 0x416fd5
cmp eax, 0x75
jne 0x416fee
mov dword [ebp + 8], 0xfb
jmp 0x416fee
mov dword [ebp + 8], 0xf4
jmp 0x416fee
mov dword [ebp + 8], 0xee
jmp 0x416fee
mov dword [ebp + 8], 0xea
mov eax, dword [ebp + 8]
sub eax, edx
je 0x417037
sub eax, 0xe
je 0x41702b
sub eax, 0x12
je 0x41701f
sub eax, 0xd
je 0x417013
dec eax
jne 0x41703e
mov dword [ebp + 8], 0xf5
jmp 0x4170fa
mov dword [ebp + 8], 0xf1
jmp 0x4170fa
mov dword [ebp + 8], 0xe3
jmp 0x4170fa
mov dword [ebp + 8], 0xd5
jmp 0x4170fa
mov dword [ebp + 8], 0xd1
mov eax, dword [ebp + 8]
cmp eax, ecx
ja 0x41709b
je 0x417092
cmp eax, edx
je 0x417089
cmp eax, 0x45
je 0x417080
cmp eax, 0x49
je 0x417077
cmp eax, 0x4f
je 0x41706b
cmp eax, 0x55
jne 0x4170de
mov dword [ebp + 8], 0xdc
jmp 0x4170fa
mov dword [ebp + 8], 0xd6
jmp 0x4170fa
mov dword [ebp + 8], 0xcf
jmp 0x4170fa
mov dword [ebp + 8], 0xcb
jmp 0x4170fa
mov dword [ebp + 8], 0xc4
jmp 0x4170fa
mov dword [ebp + 8], 0xe4
jmp 0x4170fa
cmp eax, esi
je 0x4170d7
cmp eax, 0x69
je 0x4170ce
cmp eax, 0x6f
je 0x4170c5
cmp eax, 0x75
je 0x4170bc
cmp eax, 0x79
jne 0x4170de
mov dword [ebp + 8], 0xff
jmp 0x4170fa
mov dword [ebp + 8], 0xfc
jmp 0x4170fa
mov dword [ebp + 8], 0xf6
jmp 0x4170fa
mov dword [ebp + 8], 0xef
jmp 0x4170fa
mov dword [ebp + 8], 0xeb
cmp dword [ebp + 8], 0x43
je 0x4170f3
cmp dword [ebp + 8], 0x63
jne 0x4170fa
mov dword [ebp + 8], 0xe7
jmp 0x4170fa
mov dword [ebp + 8], 0xc7
push dword [ebp + 8]
mov dword [0x438bc8], ebx
push str._Composed_0x_x
push 8
push edi
call fcn.00405446
mov ecx, dword [ebp + 8]
add esp, 0x10
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx esi, ax
push esi
push str._SHORT_s__i
push 8
push edi
mov dword [ebp - 0x14], eax
call fcn.00405446
add esp, 0x10
cmp word [ebp - 0x14], 0xffff
jne 0x417277
cmp byte [ebp + 0xc], bl
je 0x417477
push str.down
push 8
push edi
call fcn.00405446
add esp, 0xc
push str._Found_key
push 8
push edi
call fcn.00405446
add esp, 0xc
xor ecx, ecx
mov eax, 0x435f98
movzx edx, word [eax]
cmp dword [ebp + 8], edx
je 0x417181
inc ecx
inc eax
inc eax
cmp eax, str.fake__d_down_n
jl 0x41716f
mov eax, ecx
push 0x64
cdq
pop esi
idiv esi
push esi
mov byte [ebp + 0xf], al
mov eax, ecx
cdq
pop ecx
idiv ecx
push 0xa
pop esi
push esi
mov ecx, edx
mov eax, ecx
cdq
idiv esi
mov byte [ebp - 0xd], al
mov eax, ecx
cdq
pop ecx
idiv ecx
cmp edx, 0xff
mov dword [ebp - 0x14], edx
je 0x41726a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
push ebx
push ebx
push 0x12
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call edi
movzx eax, byte [ebp + 0xf]
mov cl, byte [ebp + 0xf]
push ebx
add eax, 0x60
push ebx
add cl, 0x60
push ebx
push eax
mov dword [ebp - 0x18], eax
mov byte [ebp + 0xc], cl
call esi
push eax
push dword [ebp + 0xc]
call edi
push ebx
push 2
push ebx
push dword [ebp - 0x18]
call esi
push eax
push dword [ebp + 0xc]
call edi
movzx eax, byte [ebp - 0xd]
mov cl, byte [ebp - 0xd]
push ebx
add eax, 0x60
push ebx
add cl, 0x60
push ebx
push eax
mov dword [ebp - 0x18], eax
mov byte [ebp + 0xc], cl
call esi
push eax
push dword [ebp + 0xc]
call edi
push ebx
push 2
push ebx
push dword [ebp - 0x18]
call esi
push eax
push dword [ebp + 0xc]
call edi
movzx eax, byte [ebp - 0x14]
mov cl, byte [ebp - 0x14]
push ebx
add eax, 0x60
push ebx
add cl, 0x60
push ebx
push eax
mov dword [ebp - 0x18], eax
mov byte [ebp + 0xc], cl
call esi
push eax
push dword [ebp + 0xc]
call edi
push ebx
push 2
push ebx
push dword [ebp - 0x18]
call esi
push eax
push dword [ebp + 0xc]
call edi
push ebx
push 2
push ebx
push 0x12
call esi
push eax
push 0x12
call edi
jmp 0x417477
push dword [ebp + 8]
push str.ignoring_unrecognised_Latin_1_keysym_0x_x
jmp 0x4173c3
mov dword [ebp - 0x54], 0x11
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], bl
mov byte [ebp - 0x4b], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x48], 0x12
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov dword [ebp - 0x24], 0x10
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
mov dword [ebp - 0x3c], 0xa0
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov dword [ebp - 0x30], 0xa1
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], bl
cmp byte [ebp + 0xc], bl
mov byte [ebp - 4], 4
je 0x417325
mov eax, esi
shr eax, 8
test al, 2
mov byte [ebp - 0xd], al
je 0x4172ea
lea ecx, [ebp - 0x54]
call fcn.00416a1e
mov al, byte [ebp - 0xd]
test al, 4
je 0x4172f9
lea ecx, [ebp - 0x48]
call fcn.00416a1e
mov al, byte [ebp - 0xd]
test al, 1
je 0x417307
lea ecx, [ebp - 0x24]
call fcn.00416a1e
jmp 0x417325
call fcn.0041d56b
test eax, eax
je 0x417315
lea ecx, [ebp - 0x24]
jmp 0x417320
lea ecx, [ebp - 0x3c]
call fcn.00416a70
lea ecx, [ebp - 0x30]
call fcn.00416a70
movzx eax, byte [ebp + 0xc]
movzx esi, byte [ebp - 0x14]
push eax
push esi
push dword [ebp + 8]
push dword [ebp + 8]
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_n
push 9
push edi
call fcn.00405446
mov al, byte [ebp + 0xc]
add esp, 0x1c
neg al
sbb eax, eax
push ebx
and al, 0xfe
inc eax
inc eax
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_keybd_event]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.00416ac4
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00416ac4
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00416ac4
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.00416ac4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00416ac4
jmp 0x417477
mov esi, dword [ebx + 4]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
call fcn.00417777
cmp dword [ebp - 0x18], esi
jne 0x4173d3
push dword [ebp + 8]
push str.ignoring_unknown_keysym__d_n
push 8
push edi
call fcn.00405446
add esp, 0x10
jmp 0x417477
mov esi, dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.004175cc
mov al, byte [eax]
lea ecx, [esi + 0x10]
mov byte [ebp - 0x14], al
lea eax, [ebp + 8]
push eax
xor ebx, ebx
xor edi, edi
call fcn.00417656
cmp byte [eax], bl
je 0x4173fd
push 1
pop edi
cmp byte [ebp + 0xc], bl
jne 0x417427
or edi, 2
call fcn.0041d56b
test eax, eax
je 0x41745f
movzx eax, byte [ebp - 0x14]
sub eax, 0xa1
je 0x41745b
dec eax
dec eax
je 0x417455
dec eax
dec eax
jne 0x41745f
mov byte [ebp - 0x14], 0x12
jmp 0x41745f
cmp byte [ebp - 0x14], 0x2e
jne 0x417405
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
test ah, 0x80
je 0x417405
push 0x12
call esi
test ah, 0x80
je 0x417405
call fcn.0041d578
test eax, eax
je 0x417405
call fcn.0041d891
jmp 0x417477
mov byte [ebp - 0x14], 0x11
jmp 0x41745f
mov byte [ebp - 0x14], 0x10
movzx eax, byte [ebp - 0x14]
push ebx
push edi
push ebx
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8