Function at 0x41bbb0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467730
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x4b6100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1dc]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1d4], eax
mov eax, dword [0x4b616c]
push esi
mov dword [ebp - 0x1cc], esi
mov dword [ebp - 0x1e4], eax
call fcn.00404c80
lea eax, [esi + 4]
mov ecx, 0x62
mov esi, eax
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1dc]
lea edi, [ebp - 0x198]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xchg dword [eax], ecx
cmp dword [ebp - 0x16c], 0
xorps xmm0, xmm0
push 0
push 0x46ff86
jne 0x41bc66
mov esi, dword [ebp - 0x1e8]
mov ecx, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004051d0
mov eax, esi
jmp 0x41c018
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0x1a0], 0
movups xmmword [ebp - 0x1b0], xmm0
mov dword [ebp - 0x19c], 0
call fcn.004051d0
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 4], 0
mov eax, dword [eax + 0x34]
cmp byte [eax + 0x16], 0
je 0x41bf4a
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 0x1d8], 0
call fcn.00404c80
mov esi, dword [ebp - 0x1d0]
lea edi, [ebp - 0x198]
mov eax, dword [ebp - 0x1e0]
mov ecx, 0x62
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xchg dword [eax], ecx
cmp dword [ebp - 0x11c], 0
jle 0x41bef4
nop dword [eax + eax]
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x1f0]
call fcn.00404c80
mov esi, dword [ebp - 0x1d0]
lea edi, [ebp - 0x380]
mov eax, dword [ebp - 0x1f0]
mov ecx, 0x62
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xchg dword [eax], ecx
mov eax, dword [ebp - 0x1d8]
shl eax, 2
mov dword [ebp - 0x1dc], eax
cmp dword [ebp + eax - 0x354], 0
je 0x41bef4
mov ecx, dword [ebp - 0x1a0]
mov edx, dword [ebp - 0x19c]
mov esi, dword [ebp - 0x1b0]
test ecx, ecx
je 0x41bd91
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x41bd77
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1b0]
cmova eax, esi
mov word [ecx + eax], 0x2b
jmp 0x41bd91
push 1
push 0x4acf14
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1b0]
push 1
call fcn.00405400
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x1f4]
call fcn.00404c80
mov esi, dword [ebp - 0x1d0]
lea edi, [ebp - 0x380]
mov eax, dword [ebp - 0x1f4]
mov ecx, 0x62
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xchg dword [eax], ecx
mov eax, dword [ebp - 0x1dc]
push 0
push dword [ebp + eax - 0x354]
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0x100
lea ecx, [ebp - 0x110]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jne 0x41be9c
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x1d4]
call fcn.00404c80
mov esi, dword [ebp - 0x1d0]
lea edi, [ebp - 0x380]
mov eax, dword [ebp - 0x1d4]
mov ecx, 0x62
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xchg dword [eax], ecx
mov eax, dword [ebp - 0x1dc]
lea ecx, [ebp - 0x1c8]
mov edx, dword [ebp + eax - 0x354]
call fcn.0040c200
cmp dword [ebp - 0x1b4], 0xf
lea eax, [ebp - 0x1c8]
cmova eax, dword [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x110]
push 0x100
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov ecx, dword [ebp - 0x1b4]
add esp, 0xc
cmp ecx, 0xf
jbe 0x41be9c
mov edx, dword [ebp - 0x1c8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41be92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41bf2a
push ecx
push edx
call fcn.004640ea
add esp, 8
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x1b0]
call fcn.00404ab0
push dword [ebp - 0x1cc]
inc dword [ebp - 0x1d8]
lea ecx, [ebp - 0x1e0]
call fcn.00404c80
mov esi, dword [ebp - 0x1d0]
lea edi, [ebp - 0x198]
mov eax, dword [ebp - 0x1e0]
mov ecx, 0x62
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xchg dword [eax], ecx
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x11c]
jl 0x41bcf0
mov edx, dword [ebp - 0x19c]
mov eax, edx
mov ecx, dword [ebp - 0x1a0]
sub eax, ecx
cmp eax, 1
jb 0x41bf30
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1b0]
cmova eax, dword [ebp - 0x1b0]
mov word [eax + ecx], 0x20
jmp 0x41bf4a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push 1
push 0x4acf18
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1b0]
push 1
call fcn.00405400
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x1d4]
call fcn.00404c80
mov esi, dword [ebp - 0x1d0]
lea edi, [ebp - 0x380]
mov eax, dword [ebp - 0x1d4]
mov ecx, 0x62
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xchg dword [eax], ecx
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x1b0]
call fcn.00404ab0
mov edx, dword [ebp - 0x1e4]
mov eax, dword [edx + 0x34]
cmp byte [eax + 0x15], 0
je 0x41bfe7
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x1d4]
call fcn.00404c80
mov esi, dword [ebp - 0x1d0]
lea edi, [ebp - 0x380]
mov eax, dword [ebp - 0x1d4]
mov ecx, 0x62
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xchg dword [eax], ecx
cmp byte [ebp - 0x204], 0
mov ecx, str.__off_
mov eax, str.__on_
cmove eax, ecx
lea ecx, [ebp - 0x1b0]
push eax
call fcn.00404ab0
mov eax, dword [ebp - 0x1e8]
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
movups xmm0, xmmword [ebp - 0x1b0]
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x1a0]
movq qword [eax + 0x10], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004640a7
mov esp, ebp
pop ebp
ret 8