Function at 0x41683c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, 0x4275e0
call fcn.004268b0
sub esp, 0x4c
push ebx
push esi
push edi
mov ebx, 0x4378c8
push dword [ebp + 8]
mov edi, ecx
push str._keysym_0x_x
push 8
push ebx
call fcn.004053a7
mov ecx, dword [ebp + 8]
mov esi, 0xfe50
add esp, 0x10
cmp ecx, esi
jb 0x416895
cmp ecx, 0xfe60
ja 0x416895
push str.__DEAD_KEY
push 8
push ebx
mov dword [0x437970], ecx
call fcn.004053a7
add esp, 0xc
jmp 0x416f9d
cmp ecx, 0x20
jb 0x41689f
cmp ecx, 0x7e
jbe 0x4168b7
cmp ecx, 0xa0
jb 0x416ed1
cmp ecx, 0xff
ja 0x416ed1
mov eax, dword [0x437970]
xor ebx, ebx
cmp eax, ebx
je 0x416c52
cmp byte [ebp + 0xc], bl
je 0x416c52
push ecx
push eax
push str._Compose_dead_0x_x_0x_x
mov edi, 0x4378c8
push 8
push edi
call fcn.004053a7
add esp, 0x14
mov eax, dword [0x437970]
sub eax, esi
push 0x61
pop ecx
push 0x41
pop edx
push 0x65
pop esi
je 0x416924
dec eax
je 0x4169cf
dec eax
je 0x416a9c
dec eax
je 0x416b28
sub eax, 4
je 0x416b78
sub eax, 4
je 0x416c18
jmp 0x416c34
mov eax, dword [ebp + 8]
cmp eax, ecx
ja 0x416991
je 0x416985
cmp eax, edx
je 0x416979
cmp eax, 0x45
je 0x41696d
cmp eax, 0x49
je 0x416961
cmp eax, 0x4f
je 0x416955
cmp eax, 0x55
jne 0x4169cf
mov dword [ebp + 8], 0xd9
jmp 0x416b28
mov dword [ebp + 8], 0xd2
jmp 0x416b28
mov dword [ebp + 8], 0xcc
jmp 0x416b28
mov dword [ebp + 8], 0xc8
jmp 0x416b28
mov dword [ebp + 8], 0xc0
jmp 0x416b28
mov dword [ebp + 8], 0xe0
jmp 0x416b28
cmp eax, esi
je 0x4169c8
cmp eax, 0x69
je 0x4169bc
cmp eax, 0x6f
je 0x4169b0
cmp eax, 0x75
jne 0x4169cf
mov dword [ebp + 8], 0xf9
jmp 0x416b28
mov dword [ebp + 8], 0xf2
jmp 0x416b28
mov dword [ebp + 8], 0xec
jmp 0x416b28
mov dword [ebp + 8], 0xe8
mov eax, dword [ebp + 8]
cmp eax, ecx
ja 0x416a4d
je 0x416a41
cmp eax, edx
je 0x416a35
cmp eax, 0x45
je 0x416a29
cmp eax, 0x49
je 0x416a1d
cmp eax, 0x4f
je 0x416a11
cmp eax, 0x55
je 0x416a05
cmp eax, 0x59
jne 0x416a9c
mov dword [ebp + 8], 0xdd
jmp 0x416b28
mov dword [ebp + 8], 0xda
jmp 0x416b28
mov dword [ebp + 8], 0xd3
jmp 0x416b28
mov dword [ebp + 8], 0xcd
jmp 0x416b28
mov dword [ebp + 8], 0xc9
jmp 0x416b28
mov dword [ebp + 8], 0xc1
jmp 0x416b28
mov dword [ebp + 8], 0xe1
jmp 0x416b28
cmp eax, esi
je 0x416a95
cmp eax, 0x69
je 0x416a89
cmp eax, 0x6f
je 0x416a7d
cmp eax, 0x75
je 0x416a71
cmp eax, 0x79
jne 0x416a9c
mov dword [ebp + 8], 0xfd
jmp 0x416b28
mov dword [ebp + 8], 0xfa
jmp 0x416b28
mov dword [ebp + 8], 0xf3
jmp 0x416b28
mov dword [ebp + 8], 0xed
jmp 0x416b28
mov dword [ebp + 8], 0xe9
mov eax, dword [ebp + 8]
cmp eax, ecx
ja 0x416af3
je 0x416aea
cmp eax, edx
je 0x416ae1
cmp eax, 0x45
je 0x416ad8
cmp eax, 0x49
je 0x416acf
cmp eax, 0x4f
je 0x416ac6
cmp eax, 0x55
jne 0x416b28
mov dword [ebp + 8], 0xdb
jmp 0x416b28
mov dword [ebp + 8], 0xd4
jmp 0x416b28
mov dword [ebp + 8], 0xce
jmp 0x416b28
mov dword [ebp + 8], 0xca
jmp 0x416b28
mov dword [ebp + 8], 0xc2
jmp 0x416b28
mov dword [ebp + 8], 0xe2
jmp 0x416b28
cmp eax, esi
je 0x416b21
cmp eax, 0x69
je 0x416b18
cmp eax, 0x6f
je 0x416b0f
cmp eax, 0x75
jne 0x416b28
mov dword [ebp + 8], 0xfb
jmp 0x416b28
mov dword [ebp + 8], 0xf4
jmp 0x416b28
mov dword [ebp + 8], 0xee
jmp 0x416b28
mov dword [ebp + 8], 0xea
mov eax, dword [ebp + 8]
sub eax, edx
je 0x416b71
sub eax, 0xe
je 0x416b65
sub eax, 0x12
je 0x416b59
sub eax, 0xd
je 0x416b4d
dec eax
jne 0x416b78
mov dword [ebp + 8], 0xf5
jmp 0x416c34
mov dword [ebp + 8], 0xf1
jmp 0x416c34
mov dword [ebp + 8], 0xe3
jmp 0x416c34
mov dword [ebp + 8], 0xd5
jmp 0x416c34
mov dword [ebp + 8], 0xd1
mov eax, dword [ebp + 8]
cmp eax, ecx
ja 0x416bd5
je 0x416bcc
cmp eax, edx
je 0x416bc3
cmp eax, 0x45
je 0x416bba
cmp eax, 0x49
je 0x416bb1
cmp eax, 0x4f
je 0x416ba5
cmp eax, 0x55
jne 0x416c18
mov dword [ebp + 8], 0xdc
jmp 0x416c34
mov dword [ebp + 8], 0xd6
jmp 0x416c34
mov dword [ebp + 8], 0xcf
jmp 0x416c34
mov dword [ebp + 8], 0xcb
jmp 0x416c34
mov dword [ebp + 8], 0xc4
jmp 0x416c34
mov dword [ebp + 8], 0xe4
jmp 0x416c34
cmp eax, esi
je 0x416c11
cmp eax, 0x69
je 0x416c08
cmp eax, 0x6f
je 0x416bff
cmp eax, 0x75
je 0x416bf6
cmp eax, 0x79
jne 0x416c18
mov dword [ebp + 8], 0xff
jmp 0x416c34
mov dword [ebp + 8], 0xfc
jmp 0x416c34
mov dword [ebp + 8], 0xf6
jmp 0x416c34
mov dword [ebp + 8], 0xef
jmp 0x416c34
mov dword [ebp + 8], 0xeb
cmp dword [ebp + 8], 0x43
je 0x416c2d
cmp dword [ebp + 8], 0x63
jne 0x416c34
mov dword [ebp + 8], 0xe7
jmp 0x416c34
mov dword [ebp + 8], 0xc7
push dword [ebp + 8]
mov dword [0x437970], ebx
push str._Composed_0x_x
push 8
push edi
call fcn.004053a7
mov ecx, dword [ebp + 8]
add esp, 0x10
jmp 0x416c57
mov edi, 0x4378c8
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx esi, ax
push esi
push str._SHORT_s__i
push 8
push edi
mov dword [ebp - 0x14], eax
call fcn.004053a7
add esp, 0x10
cmp word [ebp - 0x14], 0xffff
jne 0x416da4
cmp byte [ebp + 0xc], bl
je 0x416f9d
push str.down
push 8
push edi
call fcn.004053a7
push str._Found_key
push 8
push edi
call fcn.004053a7
add esp, 0x18
xor eax, eax
movzx ecx, word [eax*2 + 0x4350e8]
cmp dword [ebp + 8], ecx
je 0x416cbd
inc eax
cmp eax, 0x100
jl 0x416ca8
push 0x64
cdq
pop ecx
idiv ecx
push 0xa
pop ecx
mov dword [ebp + 0xc], eax
mov eax, edx
cdq
idiv ecx
cmp edx, 0xff
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
je 0x416d94
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
push ebx
push ebx
push 0x12
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call edi
movzx eax, byte [ebp + 0xc]
mov cl, byte [ebp + 0xc]
push ebx
add eax, 0x60
push ebx
add cl, 0x60
push ebx
push eax
mov dword [ebp - 0x1c], eax
mov byte [ebp + 0xc], cl
call esi
push eax
push dword [ebp + 0xc]
call edi
push ebx
push 2
push ebx
push dword [ebp - 0x1c]
call esi
push eax
push dword [ebp + 0xc]
call edi
movzx eax, byte [ebp - 0x14]
mov cl, byte [ebp - 0x14]
push ebx
add eax, 0x60
push ebx
add cl, 0x60
push ebx
push eax
mov dword [ebp - 0x1c], eax
mov byte [ebp + 0xc], cl
call esi
push eax
push dword [ebp + 0xc]
call edi
push ebx
push 2
push ebx
push dword [ebp - 0x1c]
call esi
push eax
push dword [ebp + 0xc]
call edi
movzx eax, byte [ebp - 0x18]
mov cl, byte [ebp - 0x18]
push ebx
add eax, 0x60
push ebx
add cl, 0x60
push ebx
push eax
mov dword [ebp - 0x1c], eax
mov byte [ebp + 0xc], cl
call esi
push eax
push dword [ebp + 0xc]
call edi
push ebx
push 2
push ebx
push dword [ebp - 0x1c]
call esi
push eax
push dword [ebp + 0xc]
call edi
push ebx
push 2
push ebx
push 0x12
call esi
push eax
push 0x12
call edi
jmp 0x416f9d
push dword [ebp + 8]
push str.ignoring_unrecognised_Latin_1_keysym_0x_x
push 8
push edi
jmp 0x416ef3
mov dword [ebp - 0x58], 0x11
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x50], bl
mov byte [ebp - 0x4f], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4c], 0x12
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x43], bl
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], bl
mov dword [ebp - 0x40], 0xa0
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x38], bl
mov byte [ebp - 0x37], bl
mov dword [ebp - 0x34], 0xa1
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x2b], bl
cmp byte [ebp + 0xc], bl
mov byte [ebp - 4], 4
je 0x416e52
mov eax, esi
shr eax, 8
test al, 2
mov byte [ebp - 0xd], al
je 0x416e17
lea ecx, [ebp - 0x58]
call fcn.00416558
mov al, byte [ebp - 0xd]
test al, 4
je 0x416e26
lea ecx, [ebp - 0x4c]
call fcn.00416558
mov al, byte [ebp - 0xd]
test al, 1
je 0x416e34
lea ecx, [ebp - 0x28]
call fcn.00416558
jmp 0x416e52
call fcn.0041cfbb
test eax, eax
je 0x416e42
lea ecx, [ebp - 0x28]
jmp 0x416e4d
lea ecx, [ebp - 0x40]
call fcn.004165a9
lea ecx, [ebp - 0x34]
call fcn.004165a9
movzx eax, byte [ebp + 0xc]
movzx esi, byte [ebp - 0x14]
push eax
push esi
push dword [ebp + 8]
push dword [ebp + 8]
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_n
push 9
push edi
call fcn.004053a7
mov al, byte [ebp + 0xc]
add esp, 0x1c
neg al
sbb eax, eax
push ebx
and al, 0xfe
inc eax
inc eax
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_keybd_event]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.004165fc
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004165fc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004165fc
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.004165fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004165fc
jmp 0x416f9d
mov esi, dword [edi + 4]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00417274
cmp dword [ebp - 0x1c], esi
jne 0x416f00
push dword [ebp + 8]
push str.ignoring_unknown_keysym__d_n
push 8
push ebx
call fcn.004053a7
add esp, 0x10
jmp 0x416f9d
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.004170d0
mov al, byte [eax]
lea ecx, [edi + 0x10]
mov byte [ebp - 0x14], al
lea eax, [ebp + 8]
push eax
xor ebx, ebx
xor esi, esi
call fcn.0041715a
cmp byte [eax], bl
je 0x416f25
inc esi
cmp byte [ebp + 0xc], bl
jne 0x416f4f
or esi, 2
call fcn.0041cfbb
test eax, eax
je 0x416f85
movzx eax, byte [ebp - 0x14]
sub eax, 0xa1
je 0x416f81
dec eax
dec eax
je 0x416f7b
dec eax
dec eax
jne 0x416f85
mov byte [ebp - 0x14], 0x12
jmp 0x416f85
cmp byte [ebp - 0x14], 0x2e
jne 0x416f2d
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
test ah, ah
jns 0x416f2d
push 0x12
call edi
test ah, ah
jns 0x416f2d
call fcn.0041cfc8
test eax, eax
je 0x416f2d
call fcn.0041d2e1
jmp 0x416f9d
mov byte [ebp - 0x14], 0x11
jmp 0x416f85
mov byte [ebp - 0x14], 0x10
movzx eax, byte [ebp - 0x14]
push ebx
push esi
push ebx
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8