Function at 0x42aa7d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
lea eax, [ebp - 0x10c]
mov esi, ecx
push eax
mov edi, edx
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x42ab61
mov dh, byte [ebp - 0xdf]
mov al, byte [ebp - 0x6b]
mov cl, dh
mov ah, byte [ebp - 0xf8]
add cl, cl
mov ch, byte [ebp - 0x7b]
or cl, ah
shr al, 1
add cl, cl
or al, byte [ebp - 0x6c]
or cl, byte [ebp - 0x7c]
shr al, 1
add cl, cl
or al, byte [ebp - 0xfb]
or cl, ch
shr al, 1
or al, byte [ebp - 0xfa]
shl cl, 4
shr al, 4
or cl, al
test byte [ebp - 0x67], 0x80
mov byte [esi + 2], cl
je 0x42aaef
xor cl, cl
jmp 0x42aaf5
mov cl, byte [ebp - 0x6a]
shr cl, 7
mov dl, byte [ebp - 0xb1]
and dh, 0x80
mov al, byte [ebp - 0x68]
or al, dl
shr al, 3
or al, ch
and ch, 1
shr al, 1
or al, byte [ebp - 0x7c]
shr al, 1
or al, ah
add ah, ah
or ah, byte [ebp - 0x7c]
shr al, 1
add ah, ah
or al, dh
or ah, ch
or al, cl
mov byte [esi + 5], ah
mov cl, byte [ebp - 0xb0]
mov byte [esi + 3], al
or cl, dl
mov al, byte [ebp - 0x69]
shr al, 1
or al, byte [ebp - 0x67]
shr al, 4
or al, 0x10
shr cl, 6
mov byte [esi + 4], al
and cl, 2
mov eax, dword [ebp + 8]
mov edx, eax
mov byte [esi + 7], al
shr eax, 8
and al, 1
add cl, al
xor eax, eax
mov byte [esi + 6], cl
mov word [esi + 8], ax
jmp 0x42ab64
mov edx, dword [ebp + 8]
movzx ecx, word [esi]
lea eax, [ecx - 0x200]
cmp ax, 0xe
ja 0x42abc5
mov edi, 0x200
cmp cx, di
jne 0x42ac76
mov edx, dword [0x15d46e0]
mov ecx, dword [0x15d46e4]
jmp 0x42aba9
imul eax, edx, 0xe
cmp word [eax + 0x15d46e8], di
je 0x42abb2
inc edx
and edx, 0x8000007f
jns 0x42aba9
dec edx
or edx, 0xffffff80
inc edx
cmp edx, ecx
jne 0x42ab8f
jmp 0x42ac7c
imul edi, edx, 0xe
add edi, 0x15d46e8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x42aca6
test edx, edx
je 0x42ac64
cmp byte [ebp + 0xc], 0
je 0x42ac64
push 0
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
push edx
push edi
call dword [sym.imp.USER32.dll_ToUnicode]
test eax, eax
jns 0x42abf9
mov edi, 0x1697ec4
jmp 0x42abbb
mov ecx, dword [0x15d46e4]
cmp eax, 1
jle 0x42ac54
mov ax, word [ebp - 0xc]
mov word [0x1697ecc], ax
mov eax, 0x100
mov word [0x1697ec4], ax
lea eax, [ecx + 1]
and eax, 0x8000007f
jns 0x42ac28
dec eax
or eax, 0xffffff80
inc eax
cmp eax, dword [0x15d46e0]
je 0x42ac4e
imul edi, ecx, 0xe
mov esi, 0x1697ec4
mov ecx, eax
add edi, 0x15d46e8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 4]
mov dword [0x15d46e4], ecx
mov ax, word [ebp - 0xa]
jmp 0x42ac5e
jne 0x42ac5c
mov ax, word [ebp - 0xc]
jmp 0x42ac5e
xor eax, eax
mov word [esi + 8], ax
jmp 0x42ac7c
mov eax, 0x100
cmp cx, ax
jne 0x42ac76
test edi, edi
je 0x42ac76
mov word [esi + 8], di
mov ecx, dword [0x15d46e4]
lea eax, [ecx + 1]
and eax, 0x8000007f
jns 0x42ac8b
dec eax
or eax, 0xffffff80
inc eax
cmp eax, dword [0x15d46e0]
je 0x42aca6
imul edi, ecx, 0xe
add edi, 0x15d46e8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [0x15d46e4], eax
pop edi
pop esi
leave
ret