Function at 0x41de10
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5c8eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
cmp dword [eax + 0xc], 2
jne 0x41de36
mov eax, dword [eax + 8]
jmp 0x41de39
mov eax, dword [eax + 4]
mov edx, dword [edi + 0x240]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x110], ebx
test edx, edx
je 0x41df01
mov ecx, 0xb5
jmp 0x41de70
movzx eax, cx
cmp word [edx + eax*2 - 2], si
je 0x41de85
add ecx, 0xffff
test cx, cx
jne 0x41de70
test cx, cx
je 0x41df01
lea eax, [ecx - 0x2f]
cmp ax, 0xe
ja 0x41debe
movzx eax, cx
mov esi, dword [edi + eax*4 + 0x144]
test esi, esi
jle 0x41debe
add eax, 0xffffffd2
shl eax, 5
add eax, edi
push esi
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0054fca0
add esp, 0xc
xor ebx, ebx
jmp 0x41def4
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [edi + 0x18]
push dword [edi + 0x14]
push ecx
mov ecx, dword [ebp - 0x108]
call fcn.00414060
mov esi, dword [ebp - 0x10c]
add esp, 0x18
mov ebx, dword [ebp - 0x110]
test esi, esi
je 0x41e1ad
jmp 0x41e0a8
mov eax, esi
and eax, 0x1ff
mov dword [ebp - 0x10c], eax
push 1
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx eax, ax
mov ecx, 1
mov dword [ebp - 0x110], eax
mov edx, ecx
xor eax, eax
mov dword [ebp - 0x108], eax
test esi, 0x200
je 0x41df49
mov eax, 2
xor ecx, ecx
mov dword [ebp - 0x108], eax
xor edx, edx
test esi, 0x400
je 0x41df5e
or eax, 4
xor ecx, ecx
mov dword [ebp - 0x108], eax
jmp 0x41df60
xor edx, edx
test esi, 0x800
je 0x41df75
or eax, 0x10
xor ecx, ecx
mov dword [ebp - 0x108], eax
xor edx, edx
mov eax, dword [ebp - 0x110]
movzx esi, ax
lea eax, [esi - 8]
cmp eax, 0x26
ja case.0x41df91.9
movzx eax, byte [eax + 0x41e1dc]
jmp dword [eax*4 + 0x41e1c8]
test edx, edx
je 0x41dfc4
mov eax, dword [edi + 8]
mov ecx, 0x7f
mov edx, 8
mov esi, 1
cmp word [eax + 0x8ea], 2
cmove ecx, edx
mov byte [ebp - 0x104], cl
jmp 0x41e0a8
test ecx, ecx
je 0x41e05a
mov eax, dword [edi + 8]
mov ecx, 8
mov edx, 0x7f
mov esi, 1
cmp word [eax + 0x8ea], 2
cmove ecx, edx
mov byte [ebp - 0x104], cl
jmp 0x41e0a8
test ecx, ecx
je 0x41e05a
mov ebx, 1
mov byte [ebp - 0x104], 0xd
mov esi, ebx
jmp 0x41e0a8
test edx, edx
je 0x41e05a
mov esi, 1
mov byte [ebp - 0x104], bl
jmp 0x41e0a8
test ecx, ecx
je 0x41e05a
mov eax, dword [edi + 8]
cmp word [eax + 0x8ec], bx
jbe 0x41e05a
mov esi, 1
mov byte [ebp - 0x104], 0x7f
jmp 0x41e0a8
movsx eax, word [edi + 0x244]
cmp esi, eax
jne 0x41e05a
test edx, edx
je 0x41e05a
mov esi, 1
mov byte [ebp - 0x104], 0x1c
jmp 0x41e0a8
mov esi, dword [ebp - 0x108]
or ebx, 0xffffffff
inc ebx
push ebx
call dword [sym.imp.USER32.dll_OemKeyScan]
cmp ax, word [ebp - 0x10c]
jne 0x41e083
shr eax, 0x10
cmp ax, si
jne 0x41e083
mov eax, 1
jmp 0x41e085
xor eax, eax
cmp ebx, 0xff
jge 0x41e093
test eax, eax
je 0x41e063
jmp 0x41e09b
test eax, eax
je 0x41e1ad
mov esi, 1
mov byte [ebp - 0x104], bl
mov ebx, esi
mov eax, dword [edi + 8]
cmp dword [eax + 0x10], 0
jne 0x41e1ad
movzx eax, bx
sub eax, 0
je 0x41e160
dec eax
je 0x41e101
dec eax
jne 0x41e1ad
cmp esi, 0xff
jae 0x41e1c0
mov ecx, dword [edi + 0xc]
push eax
mov byte [ebp + esi - 0x104], al
lea eax, [ebp - 0x104]
push eax
call fcn.004299f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054a5f8
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
movzx ebx, ax
cmp ebx, 1
jl 0x41e1ad
mov ecx, dword [edi + 8]
cmp word [ecx + 0x80c], 0
jbe 0x41e132
push esi
add ecx, 0x948
lea edx, [ebp - 0x104]
call fcn.00415410
add esp, 4
mov ecx, dword [edi + 8]
lea edx, [ebp - 0x104]
push esi
add ecx, 0x948
call fcn.00415200
add esp, 4
dec ebx
jne 0x41e110
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054a5f8
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
movzx ebx, ax
cmp ebx, 1
jl 0x41e1ad
jmp 0x41e170
mov ecx, dword [edi + 8]
lea edx, [ebp - 0x104]
push esi
add ecx, 0x948
call fcn.00415100
mov ecx, dword [edi + 8]
add esp, 4
cmp word [ecx + 0x80c], 0
jbe 0x41e1aa
push esi
add ecx, 0x948
lea edx, [ebp - 0x104]
call fcn.00415340
add esp, 4
dec ebx
jne 0x41e170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054a5f8
mov esp, ebp
pop ebp
ret 8
call fcn.0054adb2
lea ecx, [ecx]
cwde
fild word [ecx]
hlt