Function at 0x418293
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp word [edi + 0xc], 9
jne 0x4182cb
lea eax, [ecx + 0x74]
lea edx, [ecx + 0x78]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [edi]
cmp edx, dword [eax]
jne 0x4182cb
mov ecx, dword [ecx + 0x44]
mov eax, dword [ecx]
call dword [eax]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and al, 1
push 0x11
mov byte [ebp - 1], al
call esi
shr eax, 0xf
and al, 1
push 0xa3
mov byte [ebp + 0xb], al
call esi
mov bx, ax
push 0x10
shr ebx, 0xf
and bl, 1
call esi
shr eax, 0xf
and al, 1
xor esi, esi
mov byte [ebp - 8], al
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov ax, word [edi + 0xc]
cmp ax, 0x30
jb 0x418349
cmp ax, 0x39
ja 0x418349
test bl, bl
jne 0x418325
cmp byte [ebp - 1], bl
je 0x418349
mov ecx, dword [ebp - 0xc]
movzx eax, ax
sub eax, 0x30
cmp byte [ebp - 8], 0
push eax
je 0x41833f
call fcn.00412f13
jmp 0x418698
call fcn.00412fae
jmp 0x418698
cmp ax, 0x71
je 0x418355
cmp ax, 0x70
jne 0x418381
cmp byte [ebp - 1], 0
je 0x418381
cmp byte [ebp + 0xb], 0
jne 0x418381
cmp byte [ebp - 8], 0
jne 0x418381
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
cmp ax, 0x70
mov ecx, dword [ecx + 0x44]
setne bl
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
jmp 0x418698
cmp ax, 0x78
jne 0x4183a3
cmp byte [ebp - 1], 0
jne 0x4183a3
cmp byte [ebp + 0xb], 0
jne 0x4183a3
cmp byte [ebp - 8], 0
jne 0x4183a3
mov ecx, 0x45c330
call fcn.004017bd
mov cx, word [edi + 0xc]
cmp cx, 0x72
jb 0x4183d5
cmp cx, 0x7b
ja 0x4183d5
cmp byte [ebp + 0xb], 0
je 0x4183d5
call fcn.00418732
cmp eax, esi
jl 0x4183d5
mov ebx, dword [ebp - 0xc]
push dword [eax*8 + 0x45a984]
mov ecx, ebx
call fcn.0041c508
jmp 0x4183d8
mov ebx, dword [ebp - 0xc]
movzx eax, word [edi + 0xc]
cmp eax, 0x4e
jg 0x41857d
je 0x418567
cmp eax, 0x28
jg 0x41849d
je 0x41842b
sub eax, 8
je 0x418491
sub eax, 8
je 0x418477
sub eax, 0x12
je 0x418454
sub eax, 3
je 0x418418
dec eax
je 0x418441
dec eax
jne 0x4182c2
cmp byte [ebp - 1], 0
je 0x41842b
mov ecx, dword [ebx + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x4182c2
cmp byte [ebp - 8], 0
je 0x4182c2
mov ecx, ebx
call fcn.0041bb2c
jmp 0x4182c2
cmp byte [ebp - 1], 0
je 0x41842b
mov ecx, dword [ebx + 0x44]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x4182c2
cmp byte [ebp + 0xb], 0
je 0x4182c2
cmp byte [ebp - 1], 0
jne 0x4182c2
cmp byte [ebp - 8], 0
jne 0x4182c2
jmp 0x418698
and byte [ebx + 0x180], 0
lea ecx, [ebx + 0x78]
call fcn.00402e0c
mov dword [ebx + 0x184], eax
jmp 0x4182c2
mov ecx, ebx
call fcn.00413b50
jmp 0x418698
cmp eax, 0x2d
je 0x418510
cmp eax, 0x2e
je 0x4184fc
cmp eax, 0x30
jle 0x4182c2
cmp eax, 0x34
jle 0x4184e2
cmp eax, 0x41
je 0x4184cf
cmp eax, 0x43
jne 0x4182c2
cmp byte [ebp + 0xb], 0
je 0x4182c2
jmp 0x418526
cmp byte [ebp + 0xb], 0
je 0x4182c2
push 1
mov ecx, ebx
jmp 0x418650
cmp byte [ebp + 0xb], 0
je 0x4182c2
add eax, 0xffffffcf
mov ecx, ebx
push eax
call fcn.0040e6a5
jmp 0x418698
cmp byte [ebp - 8], 0
mov ecx, ebx
sete al
push eax
call fcn.0041a30a
jmp 0x418698
cmp byte [ebp - 1], 0
jne 0x4182c2
cmp byte [ebp + 0xb], 0
je 0x418532
cmp byte [ebp - 8], 0
jne 0x418538
mov ecx, ebx
call fcn.00419617
jmp 0x418698
cmp byte [ebp - 8], 0
je 0x41854e
cmp byte [ebp + 0xb], 0
jne 0x4182c2
mov ecx, ebx
call fcn.00441e30
jmp 0x418698
cmp byte [ebx + 0x93], 0
je 0x4182c2
mov ecx, ebx
call fcn.0041bbd7
jmp 0x418698
cmp byte [ebp + 0xb], 0
je 0x4182c2
mov ecx, ebx
call fcn.0041b2bf
jmp 0x418698
cmp eax, 0x6d
jg 0x418657
je 0x418637
sub eax, 0x52
je 0x418624
sub eax, 4
je 0x418615
dec eax
dec eax
je 0x4185ff
dec eax
dec eax
je 0x4185e9
sub eax, 0x10
je 0x4185dd
dec eax
jne 0x4182c2
cmp byte [ebp - 1], 0
je 0x4185bb
push 1
jmp 0x41863e
cmp byte [ebp - 8], 0
jne 0x4184d9
cmp byte [ebp + 0xb], 0
jne 0x418698
push 1
mov ecx, ebx
call fcn.0041bd62
jmp 0x418698
mov ecx, ebx
call fcn.0041c0c7
jmp 0x418698
cmp byte [ebp + 0xb], 0
je 0x4182c2
mov ecx, ebx
call fcn.0041b547
jmp 0x418698
cmp byte [ebp + 0xb], 0
je 0x4182c2
mov ecx, ebx
call fcn.00441e30
jmp 0x418698
cmp byte [ebp + 0xb], 0
je 0x4182c2
jmp 0x418542
cmp byte [ebp + 0xb], 0
je 0x4182c2
mov ecx, ebx
call fcn.00417faf
jmp 0x418698
cmp byte [ebp - 1], 0
je 0x418647
push esi
mov ecx, ebx
call fcn.0041beb3
jmp 0x418698
cmp byte [ebp - 8], 0
push esi
mov ecx, ebx
je 0x4185d3
call fcn.0041c095
jmp 0x418698
sub eax, 0x71
je 0x418708
dec eax
dec eax
je 0x4186e1
dec eax
je 0x4186c2
dec eax
je 0x41869f
sub eax, 6
jne 0x4182c2
cmp byte [ebp - 1], 0
je 0x4182c2
cmp byte [ebp + 0xb], 0
jne 0x4182c2
cmp byte [ebp - 8], 0
jne 0x4182c2
mov ecx, ebx
call fcn.004138f1
mov al, 1
jmp 0x4182c4
cmp byte [ebp - 1], 0
jne 0x4182c2
cmp byte [ebp + 0xb], 0
jne 0x4182c2
mov ecx, dword [ebx + 0x44]
push dword [ebp - 8]
mov eax, dword [ecx]
push 1
call dword [eax + 8]
jmp 0x418698
cmp byte [ebp - 1], 0
jne 0x4182c2
cmp byte [ebp + 0xb], 0
jne 0x4182c2
mov ecx, dword [ebx + 0x44]
push dword [ebp - 8]
mov eax, dword [ecx]
push esi
jmp 0x4186bd
cmp byte [ebp - 1], 0
jne 0x4182c2
cmp byte [ebp + 0xb], 0
jne 0x4182c2
cmp byte [ebp - 8], 0
mov ecx, ebx
jne 0x418573
call fcn.0041762e
jmp 0x418698
cmp byte [ebp - 1], 0
jne 0x4182c2
cmp byte [ebp + 0xb], 0
jne 0x4182c2
cmp byte [ebp - 8], 0
jne 0x4182c2
mov ecx, ebx
call fcn.0041b526
jmp 0x418698