Function at 0x412060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4694d3
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x487304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xac], edi
mov ecx, dword [edi + 0x2c8]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xa8], esi
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x4120bb
mov eax, dword [edi + 0x2c8]
jmp 0x41212d
mov ecx, dword [edi + 0x2cc]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x4120d7
mov eax, dword [edi + 0x2cc]
jmp 0x41212d
mov ecx, dword [edi + 0x2d0]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x4120f3
mov eax, dword [edi + 0x2d0]
jmp 0x41212d
mov ecx, dword [edi + 0x2d4]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x41210f
mov eax, dword [edi + 0x2d4]
jmp 0x41212d
mov ecx, dword [edi + 0x2d8]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x41235b
mov eax, dword [edi + 0x2d8]
mov dword [ebp - 0xa4], eax
test eax, eax
je 0x41235b
cmp esi, 8
je 0x41235b
cmp esi, 0x1b
je 0x41235b
cmp esi, 0x20
je 0x41235b
cmp esi, 0x14
je 0x41235b
cmp esi, 0xc0
je 0x41235b
cmp esi, 0x10
jb 0x412179
cmp esi, 0x12
jbe 0x41235b
lea ecx, [ebp - 0x58]
xor ebx, ebx
call fcn.0042e48f
mov dword [ebp - 4], ebx
cmp esi, 0x70
jb 0x4121bd
cmp esi, 0x7b
ja 0x4121bd
push esi
lea eax, [ebp - 0xa0]
push eax
call fcn.00412520
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.0042e5fe
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], bl
call fcn.0042e585
jmp 0x41228e
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov ebx, 0x8000
test bx, ax
je 0x4121e1
push 9
call esi
test bx, ax
je 0x4121e1
mov ebx, 0x19
jmp 0x412222
push 0x12
call esi
test bx, ax
je 0x4121f1
mov ebx, 0x12
jmp 0x412222
push 0x10
call esi
test bx, ax
je 0x412201
mov ebx, 0x10
jmp 0x412222
push 9
call esi
test bx, ax
je 0x412211
mov ebx, 9
jmp 0x412222
push 0x11
call esi
and ax, bx
movzx ebx, ax
neg ebx
sbb ebx, ebx
add ebx, 0x12
push ebx
lea eax, [ebp - 0xa0]
push eax
call fcn.00412520
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0042e5fe
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0
call fcn.0042e585
push str.Ctrl__Tab
lea ecx, [ebp - 0x58]
call fcn.0042e6cf
test al, al
je 0x412289
lea ecx, [ebp - 0x58]
call fcn.0042ece7
test al, al
jne 0x412353
push 0x478440
lea ecx, [ebp - 0x58]
call fcn.0042e7d9
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x58]
call fcn.0042e7b9
jmp 0x41228e
mov ebx, 0x11
push dword [ebp - 0xa4]
call fcn.00412380
mov eax, dword [edi + 0x2c0]
mov esi, dword [eax]
cmp esi, eax
je 0x41231a
lea ecx, [ebp - 0x58]
call fcn.0042e701
lea ecx, [esi + 0x14]
mov edi, eax
call fcn.0042e701
push edi
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
add esp, 8
test eax, eax
je 0x412353
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x4122f4
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x4122f0
nop dword [eax]
cmp esi, dword [eax + 8]
jne 0x4122f0
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4122e0
mov esi, eax
jmp 0x41230c
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x41230c
nop
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x412300
mov edi, dword [ebp - 0xac]
cmp esi, dword [edi + 0x2c0]
jne 0x4122a5
cmp ebx, 0x12
jne 0x412324
lea eax, [ebx - 0x11]
jmp 0x41233b
cmp ebx, 0x10
jne 0x41232e
lea eax, [ebx - 0xc]
jmp 0x41233b
xor eax, eax
mov ecx, 2
cmp ebx, 0x11
cmove eax, ecx
lea ecx, [ebp - 0x58]
push ecx
push dword [ebp - 0xa8]
mov ecx, edi
push eax
push dword [ebp - 0xa4]
call fcn.00411be0
lea ecx, [ebp - 0x58]
call fcn.0042e585
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004662d8
mov esp, ebp
pop ebp
ret 8