Function at 0x412fe1
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
and dword [esp + 0x10], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov ebx, ecx
push edi
push 7
pop ecx
lea edi, [ebx + 0x88]
mov dword [esp + 0x2c], ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x8c]
cmp eax, 0x201
jb 0x41335d
cmp eax, 0x202
jbe 0x4130b5
cmp eax, 0x206
jbe 0x41335d
cmp eax, 0x208
jbe 0x4130b5
cmp eax, 0x245
jbe 0x41335d
cmp eax, 0x247
ja 0x41335d
mov edx, dword [ebx + 0x54]
lea ecx, [esp + 0x18]
call fcn.004162c5
mov esi, dword [esp + 0x18]
test esi, esi
je 0x41335d
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x30]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebx + 0x54]
lea eax, [esp + 0x34]
push eax
lea edx, [esp + 0x34]
call fcn.00415f2e
push dword [esp + 0x38]
mov edx, esi
lea ecx, [esp + 0x20]
push dword [esp + 0x38]
call fcn.00416120
mov edi, dword [esp + 0x24]
add esp, 0xc
test edi, edi
jne 0x4130c5
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x41335d
cmp byte [ebx + 0x81], 0
je 0x41304a
xor al, al
jmp 0x413361
xor eax, eax
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], eax
mov ecx, edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
call fcn.00416867
cmp dword [esp + 0x40], 0
pop ecx
je 0x41333f
mov ebx, dword [sym.imp.msvcrt.dll_wcsncmp]
push 0xa
push str.javascript
push dword [esp + 0x44]
call ebx
add esp, 0xc
test eax, eax
je 0x41333f
push 8
push str.vbscript
push dword [esp + 0x44]
call ebx
add esp, 0xc
test eax, eax
je 0x41333f
mov ecx, dword [esp + 0x2c]
xor ebp, ebp
mov ebx, ebp
mov eax, dword [ecx + 0x8c]
mov dword [esp + 0x18], eax
cmp eax, 0x247
je 0x413149
cmp eax, 0x246
je 0x413149
mov ebx, dword [ecx + 0x90]
jmp 0x413196
cmp dword [ecx + 0x90], 0x20001
mov byte [ecx + 0x81], 1
je 0x413179
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x10]
call ebx
push dword [esp + 0x3c]
call ebx
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x4130aa
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, dword [esp + 0x18]
jns 0x41318f
sub eax, 0x3f
jmp 0x413192
sub eax, 0x45
mov dword [esp + 0x18], eax
cmp eax, 0x207
jne 0x4131a4
mov byte [esp + 0x20], 1
jmp 0x41315c
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4131b4
or ebx, 0x20
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4131c4
or ebx, 8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4131d4
or ebx, 4
mov eax, dword [esp + 0x18]
cmp eax, 0x201
jne 0x4131ee
test bl, 0x2c
setne al
mov byte [esp + 0x20], al
jmp 0x41315c
cmp eax, 0x208
jne 0x413204
and ebx, 0xffffffef
cmp ebx, 4
push 0
pop ebx
setne bl
inc ebx
jmp 0x413228
cmp eax, 0x202
jne 0x413334
and ebx, 0xfffffffe
cmp ebx, 4
je 0x413225
cmp ebx, 8
je 0x413270
cmp ebx, 0xc
jne 0x413334
xor ebx, ebx
inc ebx
mov dword [esp + 0x14], ebp
lea ecx, [esp + 0x14]
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x9c]
cmp dword [esp + 0x14], ebp
je 0x41315c
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
call fcn.00410fea
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x413275
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41315c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41315c
push 2
pop ebx
jmp 0x413228
mov dword [esp + 0x24], ebp
lea edx, [esp + 0x24]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1b0]
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x41329f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x413259
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x413259
lea ecx, [esp + 0x18]
call fcn.00415e79
cmp dword [esp + 0x18], ebp
jne 0x4132be
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41328f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41328f
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
mov dword [esp + 0x28], ebp
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa0]
push dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
push dword [esp + 0x40]
push ebx
call fcn.0041336b
push dword [esp + 0x28]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x24], 1
call ebx
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41330f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41331d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x413162
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x413162
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x41315c
push dword [esp + 0x10]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call ebx
push dword [esp + 0x3c]
call ebx
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
mov ecx, dword [esi]
push esi
call dword [ecx + 8]
mov al, byte [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4