Function at 0x426de0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x457bf8
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x48
cmp eax, 0x20
push ebx
push esi
push edi
mov esi, ecx
jb 0x426e0b
cmp eax, 0x7e
jbe 0x426e21
cmp eax, 0xa0
jb 0x4271c1
cmp eax, 0xff
ja 0x4271c1
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
mov dword [esp + 0x10], eax
jne 0x426e5f
mov eax, dword [esp + 0x64]
push eax
push str.ignoring_unrecognised_Latin_1_keysym__d_n
push 8
push 0x4721bc
call fcn.004070e0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 8
xor ebx, ebx
push ebp
mov dword [esp + 0x40], 0x11
mov dword [esp + 0x44], ebx
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
mov dword [esp + 0x60], ebx
mov dword [esp + 0x34], 0x12
mov dword [esp + 0x38], ebx
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov dword [esp + 0x4c], 0xa0
mov dword [esp + 0x50], ebx
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], bl
mov dword [esp + 0x1c], 0xa1
mov dword [esp + 0x20], ebx
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov cl, byte [esp + 0x6c]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp cl, bl
mov byte [esp + 0x60], 4
je 0x427086
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 8
test al, 2
mov byte [esp + 0x13], al
je 0x426f45
push 0x11
call ebp
test ah, ah
js 0x426f41
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
mov cl, byte [esp + 0x40]
push ebx
push edx
and eax, 0xff
push ebx
push eax
mov byte [esp + 0x28], cl
call edi
mov ecx, dword [esp + 0x20]
push eax
push ecx
call esi
mov edx, dword [esp + 0x40]
push edx
push str.fake__d_down_n
push 9
push 0x4721bc
call fcn.004070e0
add esp, 0x10
mov byte [esp + 0x48], 1
mov al, byte [esp + 0x13]
test al, 4
je 0x426f99
mov eax, dword [esp + 0x34]
push eax
call ebp
test ah, ah
js 0x426f95
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov cl, byte [esp + 0x34]
push ebx
push edx
and eax, 0xff
push ebx
push eax
mov byte [esp + 0x28], cl
call edi
mov ecx, dword [esp + 0x20]
push eax
push ecx
call esi
mov edx, dword [esp + 0x34]
push edx
push str.fake__d_down_n
push 9
push 0x4721bc
call fcn.004070e0
add esp, 0x10
mov byte [esp + 0x3c], 1
mov al, byte [esp + 0x13]
test al, 1
je 0x426fd2
push 0x10
call ebp
test ah, ah
js 0x427086
push ebx
push ebx
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_down_n
push 9
push 0x4721bc
call fcn.004070e0
mov byte [esp + 0x40], 1
jmp 0x427083
call fcn.00432710
test eax, eax
je 0x42700e
push 0x10
call ebp
test ah, ah
jns 0x427086
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_up_n
push 9
push 0x4721bc
call fcn.004070e0
mov byte [esp + 0x41], 1
jmp 0x427083
push 0xa0
call ebp
test ah, ah
jns 0x42704a
push ebx
push 2
push ebx
push 0xa0
call edi
push eax
push 0xa0
call esi
push 0xa0
push str.fake__d_up_n
push 9
push 0x4721bc
call fcn.004070e0
add esp, 0x10
mov byte [esp + 0x55], 1
push 0xa1
call ebp
test ah, ah
jns 0x427086
push ebx
push 2
push ebx
push 0xa1
call edi
push eax
push 0xa1
call esi
push 0xa1
push str.fake__d_up_n
push 9
push 0x4721bc
call fcn.004070e0
mov byte [esp + 0x35], 1
add esp, 0x10
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x14]
and eax, 0xff
and ebp, 0xff
push eax
mov eax, dword [esp + 0x6c]
push ebp
push eax
push eax
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_n
push 9
push 0x4721bc
call fcn.004070e0
mov eax, dword [esp + 0x88]
add esp, 0x1c
neg al
sbb eax, eax
push ebx
and al, 0xfe
add eax, 2
push eax
push ebx
push ebp
call edi
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call esi
mov al, byte [esp + 0x25]
mov byte [esp + 0x60], 3
cmp al, bl
pop ebp
je 0x42710c
push ebx
push ebx
push ebx
push 0xa1
call edi
push eax
push 0xa1
call esi
push 0xa1
push str.fake__d_down_n
push 9
push 0x4721bc
call fcn.004070e0
add esp, 0x10
mov al, byte [esp + 0x51]
mov byte [esp + 0x5c], 2
cmp al, bl
je 0x427144
push ebx
push ebx
push ebx
push 0xa0
call edi
push eax
push 0xa0
call esi
push 0xa0
push str.fake__d_down_n
push 9
push 0x4721bc
call fcn.004070e0
add esp, 0x10
mov al, byte [esp + 0x2c]
mov byte [esp + 0x5c], 1
cmp al, bl
je 0x427167
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_up_n
jmp 0x427180
cmp byte [esp + 0x2d], bl
je 0x42718f
push ebx
push ebx
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
push 0x10
push str.fake__d_down_n
push 9
push 0x4721bc
call fcn.004070e0
add esp, 0x10
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], bl
call fcn.00427300
lea ecx, [esp + 0x3c]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00427300
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 8
mov edi, dword [esi + 4]
lea edx, [esp + 0x64]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.004276d0
cmp dword [esp + 0x14], edi
jne 0x427208
mov ecx, dword [esp + 0x64]
push ecx
push str.ignoring_unknown_keysym__d_n
push 8
push 0x4721bc
call fcn.004070e0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 8
lea edx, [esp + 0xf]
lea eax, [esp + 0x64]
xor ebx, ebx
push edx
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x17], bl
call fcn.00427740
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, esi
call fcn.004275f0
mov eax, dword [eax]
lea ecx, [esi + 0x10]
xor edi, edi
mov dl, byte [eax + 0x10]
lea eax, [esp + 0x64]
push eax
mov byte [esp + 0x14], dl
call fcn.004274d0
cmp byte [eax], bl
je 0x42724f
mov edi, 1
cmp byte [esp + 0x68], bl
jne 0x427282
or edi, 2
call fcn.00432710
test eax, eax
je 0x4272cd
mov eax, dword [esp + 0x10]
and eax, 0xff
sub eax, 0xa1
je 0x4272c8
sub eax, 2
je 0x4272c1
sub eax, 2
jne 0x4272cd
mov byte [esp + 0x10], 0x12
jmp 0x4272cd
cmp byte [esp + 0x10], 0x2e
jne 0x427258
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
test ah, ah
jns 0x427258
push 0x12
call esi
test ah, ah
jns 0x427258
call fcn.00432720
test eax, eax
je 0x427258
call fcn.00432b40
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 8
mov byte [esp + 0x10], 0x11
jmp 0x4272cd
mov byte [esp + 0x10], 0x10
mov esi, dword [esp + 0x10]
push ebx
mov ecx, esi
push edi
and ecx, 0xff
push ebx
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 8