Function at 0x411baf
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, eax
xor eax, eax
push edi
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 2], al
mov byte [ebp - 1], al
mov byte [ebp - 3], al
mov byte [ebp - 4], al
call fcn.00449fa0
inc eax
push eax
call fcn.00449614
mov ebx, eax
push esi
mov dword [ebp - 0xc], ebx
call fcn.00449fa0
lea eax, [eax + eax + 1]
push eax
call fcn.00449614
xor edi, edi
mov dword [ebp - 0x10], eax
inc edi
add esp, 0x10
lea edx, [ebp - 8]
mov al, 0x20
mov dword [ebp - 0x14], edi
call fcn.0041200b
test eax, eax
jne 0x411c41
mov eax, dword [ebp - 8]
mov al, byte [eax + esi]
cmp al, 0x20
je 0x411c18
cmp al, 9
jne 0x411c1d
inc dword [ebp - 8]
jmp 0x411c0a
mov ebx, dword [ebp - 0x10]
lea edx, [ebp - 8]
xor al, al
call fcn.0041200b
push 0x45ca14
mov esi, ebx
push esi
call fcn.004564ce
test eax, eax
pop ecx
pop ecx
jne 0x411c8f
mov byte [ebp - 2], 1
xor ebx, ebx
push dword [ebp - 0xc]
mov esi, dword [ebp - 0x18]
push dword [esi*4 + 0x466518]
call fcn.004564ce
test eax, eax
pop ecx
pop ecx
je 0x411c64
inc esi
cmp esi, 0x62
mov dword [ebp - 0x18], esi
jl 0x411c43
cmp esi, 0x62
jne 0x411d4a
cmp byte [ebp - 1], 0
mov eax, dword [ebp - 0xc]
movsx eax, byte [eax]
je 0x411d26
push ebx
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
and eax, 0xff
jmp 0x411e18
push str.down
push esi
call fcn.004564ce
test eax, eax
pop ecx
pop ecx
jne 0x411ca6
mov byte [ebp - 1], 1
jmp 0x411c41
push 0x45ca08
push esi
call fcn.004564ce
test eax, eax
pop ecx
pop ecx
jne 0x411cbd
mov byte [ebp - 3], 1
jmp 0x411c41
push 0x45ca04
push esi
call fcn.004564ce
test eax, eax
pop ecx
pop ecx
jne 0x411cd7
mov byte [ebp - 4], 1
jmp 0x411c41
cmp byte [esi], 0x30
jne 0x411d0b
mov al, byte [esi + 1]
cmp al, 0x78
je 0x411ce7
cmp al, 0x58
jne 0x411d0b
lea edi, [esi + 2]
lea esi, [ebp - 0x14]
call fcn.0041222f
mov edi, dword [ebp - 0x14]
push edi
push 0x45ca00
push dword [ebp - 0x10]
call fcn.0044a5c9
add esp, 0xc
jmp 0x411c41
push esi
call fcn.0044a6a9
mov edi, eax
xor ebx, ebx
cmp edi, ebx
pop ecx
jg 0x411c43
xor edi, edi
inc edi
jmp 0x411c43
cmp byte [ebp - 2], 0
je 0x411d3b
push ebx
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
and eax, 0xff
jmp 0x411d74
mov ecx, dword [ebp + 8]
push edi
push eax
call fcn.00410f54
jmp case.default.0x411dc7
cmp byte [esi + 0x4666a0], 0
jne 0x411db7
cmp byte [ebp - 1], 0
je 0x411d66
mov eax, dword [esi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
push ebx
jmp 0x411e18
cmp byte [ebp - 2], 0
je 0x411d7c
mov eax, dword [esi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
push ebx
mov ecx, dword [ebp + 8]
jmp 0x411fb6
cmp byte [ebp - 3], 0
je 0x411d8d
push 1
push dword [esi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
jmp 0x411d9b
cmp byte [ebp - 4], 0
push ebx
push dword [esi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
je 0x411da8
mov esi, dword [ebp + 8]
call fcn.00410eee
jmp case.default.0x411dc7
mov ecx, dword [ebp + 8]
mov eax, edi
call fcn.00410fb7
jmp case.default.0x411dc7
mov eax, dword [esi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
cmp eax, 0xc
ja case.default.0x411dc7
jmp dword [eax*4 + 0x411fd7]
cmp byte [ebp - 1], 0
je 0x411df8
mov ecx, dword [ebp + 8]
lea edx, [ecx + 0x244]
mov eax, dword [edx]
mov esi, 0x100
test esi, eax
jne case.default.0x411dc7
or eax, esi
push ebx
mov dword [edx], eax
push 0x12
jmp 0x411f47
cmp byte [ebp - 2], 0
jne case.0x411dc7.3
push ebx
push 0x12
push dword [ebp + 8]
call fcn.00411987
jmp case.default.0x411dc7
cmp byte [ebp - 1], 0
je 0x411e25
push ebx
push 0xd
pop eax
mov ecx, dword [ebp + 8]
call fcn.004119aa
jmp case.default.0x411dc7
cmp byte [ebp - 2], 0
je 0x411e36
mov ecx, dword [ebp + 8]
push ebx
push 0xd
jmp 0x411fb5
push 1
push 0xd
jmp 0x411e01
mov ecx, dword [ebp + 8]
lea edx, [ecx + 0x244]
mov eax, dword [edx]
mov esi, 0x100
test esi, eax
je case.default.0x411dc7
xor eax, esi
mov dword [edx], eax
jmp 0x411fb2
mov ecx, dword [ebp + 8]
lea esi, [ecx + 0x244]
mov edx, dword [esi]
mov eax, 0x200
test eax, edx
jne case.default.0x411dc7
or edx, eax
mov eax, dword [ecx + 0x254]
mov dword [esi], edx
push ebx
jmp 0x411e1b
mov ecx, dword [ebp + 8]
lea esi, [ecx + 0x244]
mov edx, dword [esi]
mov eax, 0x200
test eax, edx
je case.default.0x411dc7
xor edx, eax
mov eax, dword [ecx + 0x254]
mov dword [esi], edx
push ebx
jmp 0x411fb6
mov ecx, dword [ebp + 8]
lea esi, [ecx + 0x244]
mov edx, dword [esi]
mov eax, 0x800
test eax, edx
jne case.default.0x411dc7
push ebx
push 0x11
jmp 0x411f43
mov ecx, dword [ebp + 8]
lea esi, [ecx + 0x244]
mov edx, dword [esi]
mov eax, 0x800
test eax, edx
je case.default.0x411dc7
xor edx, eax
push ebx
mov dword [esi], edx
push 0x11
jmp 0x411fb5
mov ecx, dword [ebp + 8]
lea esi, [ecx + 0x244]
mov edx, dword [esi]
mov eax, 0x1000
test eax, edx
jne case.default.0x411dc7
push ebx
push 0x5b
jmp 0x411f43
mov ecx, dword [ebp + 8]
lea esi, [ecx + 0x244]
mov edx, dword [esi]
mov eax, 0x1000
test eax, edx
je case.default.0x411dc7
xor edx, eax
push ebx
mov dword [esi], edx
push 0x5b
jmp 0x411fb5
mov ecx, dword [ebp + 8]
lea esi, [ecx + 0x244]
mov edx, dword [esi]
mov eax, 0x2000
test eax, edx
jne case.default.0x411dc7
push ebx
push 0x5c
or edx, eax
mov dword [esi], edx
pop eax
jmp 0x411e1b
mov ecx, dword [ebp + 8]
lea esi, [ecx + 0x244]
mov edx, dword [esi]
mov eax, 0x2000
test eax, edx
je case.default.0x411dc7
xor edx, eax
push ebx
mov dword [esi], edx
push 0x5c
jmp 0x411fb5
mov edi, dword [ebp + 8]
mov esi, 0x100
test dword [edi + 0x244], esi
jne 0x411f85
push ebx
push 0x12
pop eax
mov ecx, edi
call fcn.004119aa
mov ecx, dword [ebp - 0x10]
mov al, byte [ecx]
test al, al
je 0x411fa8
mov ebx, ecx
movsx eax, al
push 0
add eax, 0x30
push eax
push edi
call fcn.00411987
inc ebx
mov al, byte [ebx]
test al, al
jne 0x411f90
xor ebx, ebx
test dword [edi + 0x244], esi
jne case.default.0x411dc7
mov ecx, edi
push ebx
push 0x12
pop eax
call fcn.00411aac
push dword [ebp - 0xc]
call fcn.0044951c
push dword [ebp - 0x10]
call fcn.0044951c
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4