Function at 0x4171e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str.SetAutoAnser___s__r_n
call fcn.004145f0
add esp, 8
push 0x46897c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x417234
push 0x5ada20
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x4738ec], 0
push 0x5ada20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x41740a
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
cmp eax, 0x5c
jne 0x4172b5
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x4172b5
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
push eax
call fcn.0043a1a6
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x5b
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x19
ja case.0x417286.1
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x417428]
jmp dword [eax*4 + 0x417410]
mov ecx, dword [ebp + 8]
mov byte [ecx], 8
jmp case.0x417286.1
mov edx, dword [ebp + 8]
mov byte [edx], 9
jmp case.0x417286.1
mov eax, dword [ebp + 8]
mov byte [eax], 0xa
jmp case.0x417286.1
mov ecx, dword [ebp + 8]
mov byte [ecx], 0xd
jmp case.0x417286.1
mov edx, dword [ebp + 8]
mov byte [edx], 0x1b
jmp 0x4172ea
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
cmp ecx, 0x5e
jne 0x4172ea
mov edx, 1
shl edx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
test ecx, ecx
je 0x4172ea
mov edx, 1
shl edx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
and ecx, 0x1f
mov edx, dword [ebp + 8]
mov byte [edx], cl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
cmp ecx, 8
jne 0x417300
mov edx, 8
mov word [ebp - 4], dx
jmp 0x417353
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
cmp ecx, 9
jne 0x417316
mov edx, 9
mov word [ebp - 4], dx
jmp 0x417353
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
cmp ecx, 0xd
jne 0x41732c
mov edx, 0xd
mov word [ebp - 4], dx
jmp 0x417353
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
cmp ecx, 0x1b
jne 0x417342
mov edx, 0x1b
mov word [ebp - 4], dx
jmp 0x417353
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov word [ebp - 4], ax
push 0
movzx edx, word [ebp - 4]
and edx, 0xff
movzx eax, dl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0xc], eax
movzx ecx, word [ebp - 4]
shr ecx, 8
and ecx, 0xff
movzx edx, cl
push edx
movzx eax, word [ebp - 4]
and eax, 0xff
movzx ecx, al
push ecx
mov edx, dword [ebp - 0xc]
and edx, 0xff
movzx eax, dl
push eax
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
push edx
push str.Ansi__02x__Scan__02x__VK__02x__Shift__02x_r_n
call fcn.004145f0
add esp, 0x14
push 0x5ada20
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
shl ecx, 0x18
movzx edx, word [ebp - 4]
shr edx, 8
and edx, 0xff
movzx eax, dl
shl eax, 0x10
or ecx, eax
mov edx, dword [ebp - 0xc]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
movzx edx, word [ebp - 4]
and edx, 0xff
movzx eax, dl
or ecx, eax
mov dword [0x4738ec], ecx
push 0x5ada20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov esp, ebp
pop ebp
ret