Function at 0x560ff0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59fef8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x5f300c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
xor esi, esi
or eax, 0xffffffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], eax
test edx, edx
je 0x56169b
cmp byte [edx], 0
je 0x56169b
mov dword [ebp - 0x1c], esi
lea edi, [ecx + 1]
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x561060
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.0040af10
mov edx, str.Ctrl
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0055c170
test al, al
je 0x561093
mov esi, 2
mov dword [ebp - 0x34], esi
mov edx, str.Shift
lea ecx, [ebp - 0x2c]
call fcn.0055c170
test al, al
je 0x5610aa
or esi, 1
mov dword [ebp - 0x34], esi
mov edx, str.Alt
lea ecx, [ebp - 0x2c]
call fcn.0055c170
test al, al
je 0x5610c1
or esi, 4
mov dword [ebp - 0x34], esi
mov ecx, dword [ebp - 0x1c]
cmp ecx, 1
jne 0x561121
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
jb 0x5610d5
mov eax, dword [ebp - 0x2c]
movsx ax, byte [eax]
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, al
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
cmp edi, 0x10
jb 0x56168a
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x561680
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x561680
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
jbe 0x5610e9
test ecx, ecx
je 0x5616bd
mov edx, dword [ebp - 0x18]
lea esi, [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x56113b
mov esi, eax
cmp byte [esi], 0x46
jne 0x561193
push 1
lea ecx, [ebp - 0x2c]
call fcn.0049d180
mov al, byte [eax]
cmp al, 0x30
jl 0x56118a
cmp al, 0x39
jg 0x56118a
push 1
push 0
lea ecx, [ebp - 0x2c]
call fcn.00473f40
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
jb 0x56116c
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
lea ecx, [eax - 1]
cmp ecx, 0xb
ja 0x5610e9
add eax, 0x6f
jmp 0x5610e6
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
test ecx, ecx
je 0x5616c2
lea esi, [ebp - 0x2c]
cmp edx, 0x10
jb 0x5611a5
mov esi, eax
cmp byte [esi], 0x56
jne 0x5611fd
push 1
lea ecx, [ebp - 0x2c]
call fcn.0049d180
mov al, byte [eax]
cmp al, 0x30
jl 0x5611f4
cmp al, 0x39
jg 0x5611f4
push 1
push 0
lea ecx, [ebp - 0x2c]
call fcn.00473f40
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
jb 0x5611d6
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
lea ecx, [eax - 1]
cmp ecx, 0x7ffe
ja 0x5610e9
jmp 0x5610e6
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
lea esi, [ebp - 0x2c]
cmp edx, 0x10
jb 0x561207
mov esi, eax
sub esp, 8
mov eax, esp
push ecx
push esi
mov dword [eax], str.Keypad
mov dword [eax + 4], 6
call fcn.0055bf40
add esp, 0x10
lea ecx, [ebp - 0x2c]
test al, al
je 0x561361
push 6
push 0
call fcn.00473f40
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x56127c
push 0
lea ecx, [ebp - 0x2c]
call fcn.0049d180
mov al, byte [eax]
cmp al, 0x30
jl 0x561279
cmp al, 0x39
jg 0x561279
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
jb 0x56125e
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
cmp eax, 9
ja 0x5610e9
add eax, 0x60
jmp 0x5610e6
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x2c]
cmp edi, 0x10
jb 0x56128c
mov ecx, esi
push 4
push str.Plus
mov edx, eax
call fcn.00436600
add esp, 8
test al, al
je 0x5612ad
mov dword [ebp - 0x30], 0x6b
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x5612b7
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 5
push str.Minus
call fcn.00436600
add esp, 8
test al, al
je 0x5612d9
mov dword [ebp - 0x30], 0x6d
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x5612e3
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 7
push str.Decimal
call fcn.00436600
add esp, 8
test al, al
je 0x561305
mov dword [ebp - 0x30], 0x6e
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x56130f
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 6
push str.Divide
call fcn.00436600
add esp, 8
test al, al
je 0x561331
mov dword [ebp - 0x30], 0x6f
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x56133b
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 8
push str.Multiply
call fcn.00436600
add esp, 8
test al, al
je 0x5610ef
mov dword [ebp - 0x30], 0x6a
jmp 0x5610ef
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
cmp edi, 0x10
jb 0x56136e
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 4
push str.Left
call fcn.00436600
add esp, 8
test al, al
je 0x561390
mov dword [ebp - 0x30], 0x25
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x56139a
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 5
push str.Right
call fcn.00436600
add esp, 8
test al, al
je 0x5613bc
mov dword [ebp - 0x30], 0x27
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x5613c6
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 2
push 0x5d6b48
call fcn.00436600
add esp, 8
test al, al
je 0x5613e8
mov dword [ebp - 0x30], 0x26
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x5613f2
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 4
push 0x5d6b40
call fcn.00436600
add esp, 8
test al, al
je 0x561414
mov dword [ebp - 0x30], 0x28
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x56141e
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 6
push 0x5d6b90
call fcn.00436600
add esp, 8
test al, al
je 0x561440
mov dword [ebp - 0x30], 0x2d
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x56144a
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 3
push 0x5d6b8c
call fcn.00436600
add esp, 8
test al, al
je 0x56146c
mov dword [ebp - 0x30], 0x23
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x561476
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 4
push str.Home
call fcn.00436600
add esp, 8
test al, al
je 0x561498
mov dword [ebp - 0x30], 0x24
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x5614a2
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 5
push str.Enter
call fcn.00436600
add esp, 8
test al, al
je 0x5614c4
mov dword [ebp - 0x30], 0xd
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x5614ce
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 5
push str.Space
call fcn.00436600
add esp, 8
test al, al
je 0x5614f0
mov dword [ebp - 0x30], 0x20
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x5614fa
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 3
push 0x5d6b70
call fcn.00436600
add esp, 8
test al, al
je 0x56151c
mov dword [ebp - 0x30], 9
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x561526
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 6
push str.Escape
call fcn.00436600
add esp, 8
test al, al
je 0x561548
mov dword [ebp - 0x30], 0x1b
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x561552
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 6
push 0x5d6b7c
call fcn.00436600
add esp, 8
test al, al
je 0x561574
mov dword [ebp - 0x30], 0x2e
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x56157e
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 6
push str.PageUp
call fcn.00436600
add esp, 8
test al, al
je 0x5615a0
mov dword [ebp - 0x30], 0x21
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x5615aa
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 8
push str.PageDown
call fcn.00436600
add esp, 8
test al, al
je 0x5615cc
mov dword [ebp - 0x30], 0x22
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x5615d6
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 3
push 0x5d6be8
call fcn.00436600
add esp, 8
test al, al
je 0x5615f8
mov dword [ebp - 0x30], 0x5b
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x561602
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 4
push str.Menu
call fcn.00436600
add esp, 8
test al, al
je 0x561624
mov dword [ebp - 0x30], 0x5d
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x56162e
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 8
push str.Backward
call fcn.00436600
add esp, 8
test al, al
je 0x561650
mov dword [ebp - 0x30], 0xa6
jmp 0x5610ef
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
jb 0x56165a
mov ecx, esi
mov edx, dword [ebp - 0x1c]
push 7
push str.Forward
call fcn.00436600
add esp, 8
test al, al
je 0x5610ef
mov dword [ebp - 0x30], 0xa7
jmp 0x5610ef
push edi
push esi
call fcn.0059e222
add esp, 8
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x56169b
mov ecx, dword [ebp - 0x34]
shl ecx, 0x10
or ecx, eax
jmp 0x56169d
xor ecx, ecx
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0059df64
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00414a70
call fcn.00414a70
int3