Function at 0x4418a1
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x11c
mov eax, dword [0x47e5d0]
xor eax, esp
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x12c]
push ebp
push esi
mov esi, dword [esp + 0x128]
push 0xff
mov dword [esp + 0x1c], eax
xor ebp, ebp
lea eax, [esp + 0x25]
push ebp
push eax
mov byte [esp + 0x2c], 0
call fcn.00452e00
add esp, 0xc
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], esi
cmp esi, ebp
je 0x441b2b
push edi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push ebx
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0
je 0x441b29
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0044065c
mov ebx, eax
cmp dword [0x485430], ebp
je 0x441933
mov dword [esp + 0x14], ebp
cmp ebx, ebp
je 0x441af6
cmp dword [esp + 0x134], 1
jne 0x441982
mov esi, dword [esp + 0x14]
and esi, 1
je 0x44195e
push ebp
push ebp
push ebp
push 0x10
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x10
call edi
push ebx
call fcn.004417da
cmp esi, ebp
je 0x441af6
push ebp
push 2
push ebp
push 0x10
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x10
call edi
jmp 0x441af6
test byte [esp + 0x14], 4
mov eax, dword [esp + 0x20]
je 0x4419ef
cmp eax, ebp
je 0x441994
add dword [eax], 4
push ebx
lea eax, [esp + 0x2c]
push str._04d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebp
push ebp
push ebp
push 0x12
call edi
movsx esi, byte [esp + ebp + 0x28]
xor eax, eax
push eax
push eax
push eax
add esi, 0x30
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call edi
push 0
push 2
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call edi
inc ebp
cmp ebp, 4
jl 0x4419af
push 0
push 2
push 0
push 0x12
call edi
xor ebp, ebp
jmp 0x441aa0
cmp eax, ebp
je 0x4419f5
inc dword [eax]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
and eax, 1
mov dword [esp + 0x24], eax
je 0x441a14
push ebp
push ebp
push ebp
push 0x10
call esi
push eax
push 0x10
call edi
cmp dword [esp + 0x10], ebp
je 0x441a21
cmp dword [esp + 0x10], 2
jne 0x441a50
cmp ebx, 0x21
jl 0x441a2b
cmp ebx, 0x2e
jle 0x441a43
cmp ebx, 0x11
je 0x441a43
cmp ebx, 0x5b
je 0x441a43
cmp ebx, 0x5c
je 0x441a43
cmp ebx, 0x5d
je 0x441a43
xor eax, eax
jmp 0x441a46
xor eax, eax
inc eax
push ebp
push eax
push ebp
push ebx
call esi
push eax
push ebx
call edi
xor eax, eax
inc eax
cmp dword [esp + 0x10], eax
je 0x441a60
cmp dword [esp + 0x10], 2
jne 0x441a8d
cmp ebx, 0x21
jl 0x441a6a
cmp ebx, 0x2e
jle 0x441a80
cmp ebx, 0x11
je 0x441a80
cmp ebx, 0x5b
je 0x441a80
cmp ebx, 0x5c
je 0x441a80
cmp ebx, 0x5d
je 0x441a80
xor eax, eax
push ebp
or eax, 2
push eax
push ebp
push ebx
call esi
push eax
push ebx
call edi
cmp dword [esp + 0x24], ebp
je 0x441aa0
push ebp
push 2
push ebp
push 0x10
call esi
push eax
push 0x10
call edi
cmp dword [esp + 0x10], ebp
jne 0x441acb
cmp ebx, 0x11
jne 0x441ab0
xor eax, eax
inc eax
jmp 0x441ac5
cmp ebx, 0x10
jne 0x441ab9
push 2
jmp 0x441ac0
cmp ebx, 0x12
jne 0x441ac3
push 4
pop eax
jmp 0x441ac5
xor eax, eax
or dword [0x485430], eax
xor eax, eax
inc eax
cmp dword [esp + 0x10], eax
jne 0x441af6
cmp ebx, 0x11
je 0x441aee
cmp ebx, 0x10
jne 0x441ae2
push 2
jmp 0x441ae9
cmp ebx, 0x12
jne 0x441aec
push 4
pop eax
jmp 0x441aee
xor eax, eax
not eax
and dword [0x485430], eax
mov esi, dword [esp + 0x1c]
add esi, dword [esp + 0x18]
mov eax, dword [esp + 0x138]
mov dword [esp + 0x1c], esi
cmp eax, ebp
jne 0x441b12
cmp ebx, 0x11
jne 0x441b21
cmp ebx, 0x11
jne 0x441b1a
push 0xa
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, ebp
jne 0x441903
pop ebx
pop edi
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
xor ecx, esp
call fcn.00452dee
add esp, 0x11c
ret 0x10