Function at 0x411959
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x45edd4
call fcn.0045e9d0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
je 0x41199a
mov eax, dword [ebp + 8]
cmp eax, 0x6c
ja 0x4119b5
je 0x41199a
sub eax, 0x64
je 0x41199a
dec eax
je 0x41199a
dec eax
je 0x41199a
dec eax
dec eax
je 0x41199a
dec eax
je 0x41199a
dec eax
je 0x4119ad
dec eax
je 0x411af4
mov dword [esi + 0xc], ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
cmp dword [esi + 0xc], 2
jne 0x41199a
jmp 0x411997
sub eax, 0x70
je 0x41199a
sub eax, 0x8a
je 0x41199a
dec eax
je 0x411af4
dec eax
je 0x41199a
dec eax
je 0x411997
sub eax, 0x13
je 0x41199a
dec eax
jne 0x411997
mov ecx, 0x4789e8
call fcn.00418f93
test eax, eax
jne 0x411997
cmp dword [esi + 0x10], ebx
jne 0x4119f0
mov dword [esi + 0x10], 1
mov edi, dword [edi + 4]
mov dword [ebp + 8], ebx
mov eax, dword [edi]
test byte [eax + 0x28], 2
jne 0x411a1a
cmp word [eax + 0x10], 8
jne 0x411a1a
push dword [eax + 0x18]
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
je 0x411a1a
mov dword [ebp + 8], 1
mov eax, dword [edi]
test byte [eax + 0x28], 0x20
je 0x411a31
cmp dword [0x474e14], ebx
je 0x411a31
mov dword [ebp + 8], 1
cmp dword [0x474dfc], ebx
je 0x411adc
cmp dword [0x476d50], ebx
jne 0x411adc
cmp dword [ebp + 8], ebx
je 0x411adc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
shr eax, 0x10
test ax, ax
jne 0x411adc
cmp dword [esi + 0xc], 2
je 0x411adc
mov eax, dword [0x4989f0]
cmp eax, ebx
je 0x411a7c
cmp dword [eax + 0x16c], ebx
jne 0x411ae1
mov dword [esi + 0xc], ebx
mov eax, dword [0x40a0f8]
mov dword [ebp + 8], eax
mov eax, dword [edi]
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x18]
cmp eax, ebx
je 0x411a9c
push eax
lea ecx, [ebp + 8]
call fcn.00412292
mov eax, dword [ebp + 0xc]
push ebx
mov ecx, esi
push dword [eax]
call fcn.00412087
test eax, eax
je 0x411ad0
mov eax, dword [edi]
push 1
mov ecx, esi
mov eax, dword [eax + 0x38]
or word [eax], 0xffff
call fcn.0041221f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00412266
jmp 0x411bb8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00412266
mov eax, dword [0x4989f0]
cmp eax, ebx
je 0x411997
cmp dword [eax + 0x16c], ebx
jmp 0x4119b1
mov ecx, 0x4789e8
call fcn.00418f93
test eax, eax
jne 0x411997
cmp dword [esi + 0x10], ebx
je 0x411b24
mov eax, dword [0x4989f0]
cmp eax, ebx
je 0x411997
cmp dword [eax + 0x16c], ebx
je 0x411997
cmp dword [0x474dfc], ebx
je 0x411997
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
movsx eax, ax
shr eax, 0x10
test ax, ax
jne 0x411997
push 0xd
call edi
movsx eax, ax
shr eax, 0x10
test ax, ax
jne 0x411997
push 0x20
call edi
movsx eax, ax
shr eax, 0x10
test ax, ax
jne 0x411997
push 0x11
call edi
movsx eax, ax
shr eax, 0x10
test ax, ax
jne 0x411997
cmp dword [esi + 0xc], ebx
jne 0x411997
mov eax, dword [ebp + 0xc]
push ebx
mov ecx, esi
mov edi, dword [eax + 4]
mov dword [esi + 0xc], ebx
push dword [eax]
call fcn.00412087
test eax, eax
je 0x411997
mov eax, dword [edi]
push 1
mov ecx, esi
mov eax, dword [eax + 8]
or word [eax], 0xffff
call fcn.0041221f
push 1
pop eax
jmp 0x41199c