Function at 0x417dc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp word [edi + 0xc], 9
jne 0x417ded
mov eax, dword [edi]
cmp eax, dword [ecx + 0x74]
jne 0x417ded
mov ecx, dword [ecx + 0x44]
mov eax, dword [ecx]
call dword [eax]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and al, 1
push 0x11
mov byte [ebp - 1], al
call esi
shr eax, 0xf
and al, 1
push 0xa3
mov byte [ebp + 0xb], al
call esi
mov bx, ax
push 0x10
shr ebx, 0xf
and bl, 1
call esi
shr eax, 0xf
and al, 1
xor esi, esi
mov byte [ebp - 8], al
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov ax, word [edi + 0xc]
cmp ax, 0x30
jb 0x417e6b
cmp ax, 0x39
ja 0x417e6b
test bl, bl
jne 0x417e47
cmp byte [ebp - 1], bl
je 0x417e6b
mov ecx, dword [ebp - 0xc]
movzx eax, ax
sub eax, 0x30
cmp byte [ebp - 8], 0
push eax
je 0x417e61
call fcn.004130b3
jmp 0x4181ba
call fcn.0041314e
jmp 0x4181ba
cmp ax, 0x71
je 0x417e77
cmp ax, 0x70
jne 0x417ea3
cmp byte [ebp - 1], 0
je 0x417ea3
cmp byte [ebp + 0xb], 0
jne 0x417ea3
cmp byte [ebp - 8], 0
jne 0x417ea3
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
cmp ax, 0x70
mov ecx, dword [ecx + 0x44]
setne bl
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
jmp 0x4181ba
cmp ax, 0x78
jne 0x417ec5
cmp byte [ebp - 1], 0
jne 0x417ec5
cmp byte [ebp + 0xb], 0
jne 0x417ec5
cmp byte [ebp - 8], 0
jne 0x417ec5
mov ecx, 0x45d4c0
call fcn.004017b2
mov cx, word [edi + 0xc]
cmp cx, 0x72
jb 0x417ef7
cmp cx, 0x7b
ja 0x417ef7
cmp byte [ebp + 0xb], 0
je 0x417ef7
call fcn.00418254
cmp eax, esi
jl 0x417ef7
mov ebx, dword [ebp - 0xc]
push dword [eax*8 + 0x45ba8c]
mov ecx, ebx
call fcn.0041be7a
jmp 0x417efa
mov ebx, dword [ebp - 0xc]
movzx eax, word [edi + 0xc]
cmp eax, 0x4e
jg 0x41809f
je 0x418089
cmp eax, 0x28
jg 0x417fbf
je 0x417f4d
sub eax, 8
je 0x417fb3
sub eax, 8
je 0x417f99
sub eax, 0x12
je 0x417f76
sub eax, 3
je 0x417f3a
dec eax
je 0x417f63
dec eax
jne 0x417de4
cmp byte [ebp - 1], 0
je 0x417f4d
mov ecx, dword [ebx + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x417de4
cmp byte [ebp - 8], 0
je 0x417de4
mov ecx, ebx
call fcn.0041b4ab
jmp 0x417de4
cmp byte [ebp - 1], 0
je 0x417f4d
mov ecx, dword [ebx + 0x44]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x417de4
cmp byte [ebp + 0xb], 0
je 0x417de4
cmp byte [ebp - 1], 0
jne 0x417de4
cmp byte [ebp - 8], 0
jne 0x417de4
jmp 0x4181ba
and byte [ebx + 0x17c], 0
lea ecx, [ebx + 0x74]
call fcn.00402df8
mov dword [ebx + 0x180], eax
jmp 0x417de4
mov ecx, ebx
call fcn.00413c6e
jmp 0x4181ba
cmp eax, 0x2d
je 0x418032
cmp eax, 0x2e
je 0x41801e
cmp eax, 0x30
jle 0x417de4
cmp eax, 0x34
jle 0x418004
cmp eax, 0x41
je 0x417ff1
cmp eax, 0x43
jne 0x417de4
cmp byte [ebp + 0xb], 0
je 0x417de4
jmp 0x418048
cmp byte [ebp + 0xb], 0
je 0x417de4
push 1
mov ecx, ebx
jmp 0x418172
cmp byte [ebp + 0xb], 0
je 0x417de4
add eax, 0xffffffcf
mov ecx, ebx
push eax
call fcn.0040e8bf
jmp 0x4181ba
cmp byte [ebp - 8], 0
mov ecx, ebx
sete al
push eax
call fcn.00419de1
jmp 0x4181ba
cmp byte [ebp - 1], 0
jne 0x417de4
cmp byte [ebp + 0xb], 0
je 0x418054
cmp byte [ebp - 8], 0
jne 0x41805a
mov ecx, ebx
call fcn.0041913d
jmp 0x4181ba
cmp byte [ebp - 8], 0
je 0x418070
cmp byte [ebp + 0xb], 0
jne 0x417de4
mov ecx, ebx
call fcn.00442090
jmp 0x4181ba
cmp byte [ebx + 0x8f], 0
je 0x417de4
mov ecx, ebx
call fcn.0041b556
jmp 0x4181ba
cmp byte [ebp + 0xb], 0
je 0x417de4
mov ecx, ebx
call fcn.0041ac27
jmp 0x4181ba
cmp eax, 0x6d
jg 0x418179
je 0x418159
sub eax, 0x52
je 0x418146
sub eax, 4
je 0x418137
dec eax
dec eax
je 0x418121
dec eax
dec eax
je 0x41810b
sub eax, 0x10
je 0x4180ff
dec eax
jne 0x417de4
cmp byte [ebp - 1], 0
je 0x4180dd
push 1
jmp 0x418160
cmp byte [ebp - 8], 0
jne 0x417ffb
cmp byte [ebp + 0xb], 0
jne 0x4181ba
push 1
mov ecx, ebx
call fcn.0041b6e1
jmp 0x4181ba
mov ecx, ebx
call fcn.0041ba46
jmp 0x4181ba
cmp byte [ebp + 0xb], 0
je 0x417de4
mov ecx, ebx
call fcn.0041aeae
jmp 0x4181ba
cmp byte [ebp + 0xb], 0
je 0x417de4
mov ecx, ebx
call fcn.00442090
jmp 0x4181ba
cmp byte [ebp + 0xb], 0
je 0x417de4
jmp 0x418064
cmp byte [ebp + 0xb], 0
je 0x417de4
mov ecx, ebx
call fcn.00417b11
jmp 0x4181ba
cmp byte [ebp - 1], 0
je 0x418169
push esi
mov ecx, ebx
call fcn.0041b832
jmp 0x4181ba
cmp byte [ebp - 8], 0
push esi
mov ecx, ebx
je 0x4180f5
call fcn.0041ba14
jmp 0x4181ba
sub eax, 0x71
je 0x41822a
dec eax
dec eax
je 0x418203
dec eax
je 0x4181e4
dec eax
je 0x4181c1
sub eax, 6
jne 0x417de4
cmp byte [ebp - 1], 0
je 0x417de4
cmp byte [ebp + 0xb], 0
jne 0x417de4
cmp byte [ebp - 8], 0
jne 0x417de4
mov ecx, ebx
call fcn.00413a0f
mov al, 1
jmp 0x417de6
cmp byte [ebp - 1], 0
jne 0x417de4
cmp byte [ebp + 0xb], 0
jne 0x417de4
mov ecx, dword [ebx + 0x44]
push dword [ebp - 8]
mov eax, dword [ecx]
push 1
call dword [eax + 8]
jmp 0x4181ba
cmp byte [ebp - 1], 0
jne 0x417de4
cmp byte [ebp + 0xb], 0
jne 0x417de4
mov ecx, dword [ebx + 0x44]
push dword [ebp - 8]
mov eax, dword [ecx]
push esi
jmp 0x4181df
cmp byte [ebp - 1], 0
jne 0x417de4
cmp byte [ebp + 0xb], 0
jne 0x417de4
cmp byte [ebp - 8], 0
mov ecx, ebx
jne 0x418095
call fcn.004171ab
jmp 0x4181ba
cmp byte [ebp - 1], 0
jne 0x417de4
cmp byte [ebp + 0xb], 0
jne 0x417de4
cmp byte [ebp - 8], 0
jne 0x417de4
mov ecx, ebx
call fcn.0041ae8d
jmp 0x4181ba