Function at 0x415006
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x20
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0x51
ja case.0x414f2c.1
mov edx, dword [ebp - 0x20]
movzx eax, byte [edx + 0x415134]
jmp dword [eax*4 + 0x415114]
push 1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x22c]
call eax
jmp 0x41510c
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x22c]
call eax
jmp 0x41510c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x414f89
mov ecx, dword [ebp - 0x1c]
call fcn.0042cb21
and eax, 4
jne 0x414f89
push 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1c]
call fcn.00413d60
jmp case.0x414f2c.1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x414fad
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x288]
call eax
jmp case.0x414f2c.1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x414fda
push 0
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax + 0x154]
call edx
jmp 0x41510c
jmp case.0x414f2c.1
mov ecx, dword [ebp - 0x1c]
call fcn.0040fe80
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00413cf0
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x190]
call eax
jmp case.0x414f2c.1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x41501a
jmp case.0x414f2c.1
mov ecx, dword [ebp - 0x1c]
call fcn.0040e080
and eax, 4
je 0x415081
mov ecx, dword [ebp - 0x1c]
call fcn.0042cb21
and eax, 0x1000
je 0x41507f
mov ecx, dword [ebp - 0x1c]
call fcn.00413cf0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41507f
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x21c]
call eax
mov byte [ebp - 5], al
movzx ecx, byte [ebp - 5]
test ecx, ecx
sete dl
movzx eax, dl
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax + 0x220]
call edx
jmp case.0x414f2c.1
mov ecx, dword [ebp - 0x1c]
call fcn.00413cf0
cmp eax, 0xffffffff
je case.0x414f2c.1
mov ecx, dword [ebp - 0x1c]
call fcn.0040fe80
cmp eax, 0xffffffff
je case.0x414f2c.1
lea ecx, [ebp - 0x18]
call fcn.00408570
lea eax, [ebp - 0x18]
push eax
push 1
mov ecx, dword [ebp - 0x1c]
call fcn.0040fe80
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00413cf0
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00413d90
test eax, eax
je case.0x414f2c.1
lea ecx, [ebp - 0x18]
call fcn.00408570
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.0040fe80
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00413cf0
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x18c]
call eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0041a5a0
mov esp, ebp
pop ebp
ret 0xc