Function at 0x4517ee
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
push ebx
push esi
push edi
push 9
mov edi, ecx
pop ecx
cmp word [eax + 0xc], cx
jne 0x45181c
mov eax, dword [eax]
cmp eax, dword [edi + 0x74]
jne 0x45181c
mov ecx, dword [edi + 0x40]
mov eax, dword [ecx]
call dword [eax]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x11
mov dword [ebp - 4], eax
call esi
movzx ebx, ax
shr ebx, 0xf
push 0xa3
and bl, 1
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x10
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp + 0xc]
movzx edx, ax
mov eax, dword [ebp + 8]
shr edx, 0xf
and dword [ecx], 0
and edx, 0xffffff01
push 9
movzx esi, word [eax + 0xc]
pop ecx
mov dword [ebp - 0x10], edx
mov byte [ebp - 0xc], dl
lea eax, [esi - 0x30]
cmp ax, cx
ja 0x4518a8
cmp byte [ebp - 8], 0
jne 0x45188b
mov eax, dword [ebp - 4]
test al, al
je 0x4518ab
lea ecx, [esi - 0x30]
push ecx
mov ecx, edi
test dl, dl
je 0x4518a1
call fcn.00449cd4
mov al, 1
jmp 0x451815
call fcn.00449d2f
jmp 0x45189a
mov eax, dword [ebp - 4]
mov dword [ebp - 8], 0x71
mov dword [ebp + 0xc], 0x70
cmp si, word [ebp - 8]
je 0x4518c5
cmp si, word [ebp + 0xc]
jne 0x4518e5
test al, al
je 0x4518e5
test bl, bl
jne 0x4518e5
test dl, dl
jne 0x4518e5
mov ecx, dword [edi + 0x40]
xor eax, eax
cmp si, word [ebp + 0xc]
setne al
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x45189a
lea eax, [esi - 0x72]
cmp ax, cx
ja 0x45191b
test bl, bl
je 0x45191b
xor eax, eax
cmp word [eax*8 + 0x4a4194], si
je 0x451906
inc eax
cmp eax, 5
jb 0x4518f3
or eax, 0xffffffff
test eax, eax
js 0x45191b
push dword [eax*8 + 0x4a4198]
mov ecx, edi
call fcn.004569d1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0xc]
cmp eax, 0x52
ja 0x451ad3
je 0x451abf
cmp eax, 0x28
ja 0x4519e9
je 0x4519d5
sub eax, 8
je 0x4519c9
sub eax, 8
je 0x4519a5
sub eax, 0x12
je 0x45198c
sub eax, 3
je 0x451966
sub eax, 1
je 0x451979
sub eax, 1
jne 0x451813
cmp byte [ebp - 4], 0
je 0x4519d5
mov ecx, dword [edi + 0x40]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x451813
cmp byte [ebp - 4], 0
je 0x4519d5
mov ecx, dword [edi + 0x40]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x451813
test bl, bl
je 0x451813
cmp byte [ebp - 4], 0
jne 0x451813
test dl, dl
jmp 0x451a9b
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x74]
mov byte [edi + 0x174], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x178], eax
jmp 0x451813
mov ecx, edi
call fcn.0044a564
jmp 0x45189a
test dl, dl
je 0x451813
mov ecx, edi
call fcn.00455f1c
jmp 0x451813
cmp eax, 0x2d
je 0x451a77
cmp eax, 0x2e
je 0x451a64
cmp eax, 0x30
jbe 0x451813
cmp eax, 0x34
jbe 0x451a4c
cmp eax, 0x41
je 0x451a36
cmp eax, 0x43
je 0x451a2c
cmp eax, 0x4e
jne 0x451813
test bl, bl
je 0x451813
mov ecx, edi
call fcn.0045587c
jmp 0x45189a
test bl, bl
je 0x451813
jmp 0x451a89
test bl, bl
je 0x451813
mov ecx, edi
push 1
call fcn.0045635f
jmp 0x45189a
test bl, bl
je 0x451813
add eax, 0xffffffcf
mov ecx, edi
push eax
call fcn.004452f9
jmp 0x45189a
xor dl, 1
mov ecx, edi
movzx eax, dl
push eax
call fcn.00454d7f
jmp 0x45189a
cmp byte [ebp - 4], 0
jne 0x451813
test bl, bl
je 0x451a95
test dl, dl
jne 0x451a99
mov ecx, edi
call fcn.00453e9c
jmp 0x45189a
test dl, dl
je 0x451aa6
test bl, bl
jne 0x451813
jmp 0x45189a
cmp byte [edi + 0x9f], 0
je 0x451813
mov ecx, edi
call fcn.00455fbf
jmp 0x45189a
test bl, bl
je 0x451813
mov ecx, edi
call fcn.00451574
jmp 0x45189a
cmp eax, dword [ebp - 8]
ja 0x451ba3
je 0x451b7d
sub eax, 0x56
je 0x451b70
dec eax
sub eax, 1
je 0x451b70
dec eax
sub eax, 1
je 0x451b5c
sub eax, 0x10
je 0x451b50
sub eax, 1
je 0x451b28
dec eax
sub eax, 1
jne 0x451813
push eax
cmp byte [ebp - 4], al
je 0x451b1d
mov ecx, edi
call fcn.0045618e
jmp 0x45189a
mov ecx, edi
test dl, dl
je 0x451b46
jmp 0x451a42
cmp byte [ebp - 4], 0
je 0x451b32
push 1
jmp 0x451b11
test dl, dl
jne 0x451a3e
test bl, bl
jne 0x45189a
push 1
mov ecx, edi
call fcn.004560cf
jmp 0x45189a
mov ecx, edi
call fcn.0045638c
jmp 0x45189a
test bl, bl
je 0x451813
mov ecx, edi
call fcn.00455b58
jmp 0x45189a
test bl, bl
je 0x451813
jmp 0x45189a
cmp byte [ebp - 4], 0
jne 0x451813
test bl, bl
jne 0x451813
test dl, dl
jne 0x451813
mov ecx, edi
call fcn.00455b1e
jmp 0x45189a
sub eax, 0x72
je 0x451c73
sub eax, 1
je 0x451c55
sub eax, 1
je 0x451c31
sub eax, 1
je 0x451c18
sub eax, 1
je 0x451bf2
sub eax, 5
jne 0x451813
cmp byte [ebp - 4], al
je 0x451813
test bl, bl
jne 0x451813
test dl, dl
jne 0x451813
mov ecx, edi
call fcn.0044a398
jmp 0x45189a
cmp byte [ebp - 4], 0
jne 0x451813
test bl, bl
jne 0x451813
test dl, dl
jne 0x451813
mov ecx, edi
call fcn.004555f1
jmp 0x45189a
cmp byte [ebp - 4], 0
jne 0x451813
test bl, bl
jne 0x451813
push dword [ebp - 0xc]
push 1
jmp 0x451c48
cmp byte [ebp - 4], 0
jne 0x451813
test bl, bl
jne 0x451813
push dword [ebp - 0xc]
push 0
mov ecx, dword [edi + 0x40]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x45189a
cmp byte [ebp - 4], 0
jne 0x451813
test bl, bl
jne 0x451813
test dl, dl
jne 0x451a20
push 1
jmp 0x451c8f
cmp byte [ebp - 4], 0
jne 0x451813
test bl, bl
jne 0x451813
test dl, dl
jne 0x451813
push 0
mov ecx, edi
call fcn.00450a0e
jmp 0x45189a