Function at 0x4146c0
Capabilities:
Log keystrokes
Log keystrokes via polling
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x45a94c]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 1
push esi
mov esi, dword [0x45abf8]
mov dword [ebp - 0x34], esi
push edi
mov edi, edx
mov dword [ebp - 0x38], edi
cmp eax, 2
jne 0x414716
push ecx
push ecx
push dword [ebp + 8]
mov ecx, esi
call fcn.00413a60
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x414739
push ecx
push ecx
push dword [ebp + 8]
mov ecx, esi
call fcn.004135f0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
cmp dword [0x45af74], 0
je 0x414753
push dword [ebp + 8]
push edi
push 0x45ae60
call fcn.0041c5b0
add esp, 0xc
push dword [ebp + 8]
push str.Enter_WriteToConsole_with__d_chars_n
push 1
call fcn.0041a380
add esp, 0xc
cmp dword [0x45a94c], 3
jne 0x4147c6
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00414580
push 0
push dword [ebp - 0x2c]
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4147a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.pipewrite_error_d_n
call fcn.00427a67
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp + 8]
push dword [0x45a960]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
cmp dword [0x457fc8], 0
je 0x414858
push 0x47b9a0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, 1
mov dword [0x457fc8], 0
mov word [0x47b980], cx
mov dword [0x47b984], ecx
mov dword [0x47b988], 0x100001
mov dword [0x47b98c], 0x2a
mov dword [0x47b990], 0x10
mov word [0x47bb70], cx
mov dword [0x47bb9c], 0x47bb74
mov word [0x47bb78], cx
mov dword [0x47bb74], ecx
mov word [0x47bb84], cx
mov dword [0x47bb98], 0x47bb88
mov word [0x47bb8c], cx
mov dword [0x47bb88], 0
cmp dword [0x457e9c], 0
je 0x4148c2
push str.Waiting_for_mutex_n
push 2
call fcn.0041a380
add esp, 8
mov ecx, 0xfa
call fcn.00412710
test al, al
je 0x414899
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
push str.WriteToConsole_got_OutputMutex_n
push 2
call fcn.0041a380
add esp, 8
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x28]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
cmp dword [0x45a94c], 1
jne 0x4148d7
push 0x45a93c
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x414d1f
cmp dword [0x457e9c], 0
je 0x414951
cmp dword [ebp - 0x30], 0
je 0x41492a
push str.Waiting_for_mutex_n
push 2
call fcn.0041a380
add esp, 8
mov ecx, 0xfa
call fcn.00412710
test al, al
jne 0x414d40
push str.WriteToConsole_got_OutputMutex_n
push 2
call fcn.0041a380
add esp, 8
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x28]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [ebp - 0x22]
mov word [0x47b996], ax
movzx eax, word [ebp - 0x24]
mov word [0x47b994], ax
add edi, esi
cmp byte [edi], 0x1b
jne 0x414a84
cmp dword [0x45a94c], 1
je 0x414a84
mov edi, dword [ebp - 0x38]
inc esi
push dword [0x47bb9c]
movzx eax, byte [edi + esi]
push eax
call fcn.00420ae0
mov eax, dword [0x47bb9c]
add esp, 8
test byte [0x47ba40], 0x80
je 0x414992
or dword [eax + 0xc], 0x10
mov cl, byte [0x47ba44]
test cl, cl
jns 0x4149a6
or dword [eax + 0xc], 2
mov cl, byte [0x47ba44]
test byte [0x47ba42], 0x80
je 0x4149b9
or dword [eax + 0xc], 8
mov cl, byte [0x47ba44]
cmp word [eax + 6], 0x12
jne 0x4149e1
cmp dword [eax], 0
je 0x4149d4
or cl, 0x80
mov byte [0x47ba44], cl
or dword [eax + 0xc], 2
jmp 0x4149e1
and cl, 0x7f
mov byte [0x47ba44], cl
and dword [eax + 0xc], 0xfffffffd
cmp word [eax + 6], 0x11
jne 0x414a05
cmp dword [eax], 0
je 0x4149fa
or byte [0x47ba42], 0x80
or dword [eax + 0xc], 8
jmp 0x414a05
and byte [0x47ba42], 0x7f
and dword [eax + 0xc], 0xfffffff7
cmp word [eax + 6], 0x10
jne 0x414a29
cmp dword [eax], 0
je 0x414a1e
or byte [0x47ba40], 0x80
or dword [eax + 0xc], 0x10
jmp 0x414a29
and byte [0x47ba40], 0x7f
and dword [eax + 0xc], 0xffffffef
lea eax, [ebp - 0x10]
push eax
push 1
push 0x47bb70
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
cmp dword [0x45ad50], 0
mov al, byte [0x47bb7e]
mov byte [ebp - 0xc], al
mov byte [ebp - 0xb], 0
je 0x414a65
push 1
lea eax, [ebp - 0xc]
push eax
push 0x45ac28
call fcn.0041c5b0
add esp, 0xc
push 0x47b9a0
call dword [sym.imp.USER32.dll_SetKeyboardState]
push str.Processed_Input_Key_written_to_console_n
push 3
call fcn.0041a380
add esp, 8
jmp 0x414ce5
mov eax, dword [0x47bb9c]
lea ecx, [eax + 0xa]
push 1
push edi
mov dword [eax + 0xc], 0
mov al, byte [edi]
push ecx
mov byte [ecx], al
call fcn.00429c96
mov eax, dword [0x47bb9c]
add esp, 0xc
movzx eax, byte [eax + 0xa]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov edx, dword [0x47bb9c]
movsx ecx, ax
mov eax, ecx
shr eax, 8
cmp al, 0xff
je 0x414b04
test ecx, 0x100
jne 0x414ad6
test byte [0x47ba40], 0x80
je 0x414ada
or dword [edx + 0xc], 0x10
test ecx, 0x200
jne 0x414aeb
test byte [0x47ba42], 0x80
je 0x414aef
or dword [edx + 0xc], 8
test ecx, 0x400
jne 0x414b00
test byte [0x47ba44], 0x80
je 0x414b04
or dword [edx + 0xc], 2
cmp cl, 0xff
je 0x414b3c
movzx eax, cl
push 0
push eax
mov word [edx + 6], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, dword [0x47bb9c]
cmp word [edx + 0xa], 0x1b
mov word [edx + 8], ax
jne 0x414b3c
cmp dword [0x45a94c], 1
jne 0x414b3c
mov eax, 0xdb
mov word [edx + 6], ax
test dword [edx + 0xc], 0x100
je 0x414b9b
lea eax, [ebp - 0x10]
mov dword [0x47b984], 1
push eax
push 1
push 0x47b980
push dword [ebp - 0x34]
mov dword [0x47b990], 0x10
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
cmp dword [0x45ad50], 0
mov al, byte [0x47bb7e]
mov byte [ebp - 0xc], al
mov byte [ebp - 0xb], 0
je 0x414b95
push 1
lea eax, [ebp - 0xc]
push eax
push 0x45ac28
call fcn.0041c5b0
add esp, 0xc
mov edx, dword [0x47bb9c]
mov ecx, dword [0x47bb98]
movzx eax, word [edx + 6]
mov dword [edx], 1
mov word [ecx + 6], ax
movzx eax, word [edx + 8]
mov word [ecx + 8], ax
mov al, byte [edx + 0xa]
mov byte [ecx + 0xa], al
movzx eax, word [edx + 0xa]
mov word [ecx + 0xa], ax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 2
push 0x47bb70
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x47bb9c]
movsx ecx, byte [edx + 0xa]
movzx eax, word [edx + 0xa]
push ecx
push dword [edx + 0xc]
push eax
movzx eax, word [edx + 8]
push ecx
push eax
movzx eax, word [edx + 6]
push eax
movzx eax, word [edx + 4]
push eax
push dword [edx]
push esi
push str._d_Key_written____x___x___x___x___x___x___lx___c__n
push 3
call fcn.0041a380
mov edx, dword [0x47bb98]
add esp, 0x2c
mov eax, dword [0x47bb9c]
movsx ecx, byte [edx + 0xa]
movzx eax, word [eax + 0xa]
push ecx
push dword [edx + 0xc]
push eax
movzx eax, word [edx + 8]
push ecx
push eax
movzx eax, word [edx + 6]
push eax
movzx eax, word [edx + 4]
push eax
push dword [edx]
push esi
push str._d_Key_written____x___x___x___x___x___x___lx___c__n
push 3
call fcn.0041a380
mov al, byte [0x47bb7e]
add esp, 0x2c
cmp dword [0x45ad50], 0
mov byte [ebp - 0xc], al
mov byte [ebp - 0xb], 0
je 0x414c76
push 1
lea eax, [ebp - 0xc]
push eax
push 0x45ac28
call fcn.0041c5b0
add esp, 0xc
mov eax, dword [0x47bb9c]
test dword [eax + 0xc], 0x100
je 0x414cc8
lea eax, [ebp - 0x10]
mov dword [0x47b984], 0
push eax
push 1
push 0x47b980
push dword [ebp - 0x34]
mov dword [0x47b990], 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
cmp dword [0x45ad50], 0
je 0x414cc8
push 1
lea eax, [ebp - 0xc]
push eax
push 0x45ac28
call fcn.0041c5b0
add esp, 0xc
cmp dword [0x457e9c], 0
je 0x414ce2
push ecx
mov cl, byte [edi]
lea edx, [ebp - 0x24]
call fcn.00412a20
add esp, 4
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x38]
mov ecx, dword [0x45af64]
test ecx, ecx
je 0x414d0b
push ecx
push str.Sleep__d_n
push 3
call fcn.0041a380
add esp, 0xc
push dword [0x45af64]
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
cmp esi, eax
jb 0x4148e4
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
call fcn.00414fb0
call fcn.00412780
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
mov dword [eax], esi
mov eax, esi
pop esi
call fcn.004265fb
mov esp, ebp
pop ebp
ret