Function at 0x417f07
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp word [edi + 0xc], 9
jne 0x417f3f
lea eax, [ecx + 0x74]
lea edx, [ecx + 0x78]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [edi]
cmp edx, dword [eax]
jne 0x417f3f
mov ecx, dword [ecx + 0x44]
mov eax, dword [ecx]
call dword [eax]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and al, 1
push 0x11
mov byte [ebp - 1], al
call esi
shr eax, 0xf
and al, 1
push 0xa3
mov byte [ebp + 0xb], al
call esi
mov bx, ax
push 0x10
shr ebx, 0xf
and bl, 1
call esi
shr eax, 0xf
and al, 1
xor esi, esi
mov byte [ebp - 8], al
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov ax, word [edi + 0xc]
cmp ax, 0x30
jb 0x417fbd
cmp ax, 0x39
ja 0x417fbd
test bl, bl
jne 0x417f99
cmp byte [ebp - 1], bl
je 0x417fbd
mov ecx, dword [ebp - 0xc]
movzx eax, ax
sub eax, 0x30
cmp byte [ebp - 8], 0
push eax
je 0x417fb3
call fcn.00412bac
jmp 0x418341
call fcn.00412c47
jmp 0x418341
cmp ax, 0x71
je 0x417fc9
cmp ax, 0x70
jne 0x417ff5
cmp byte [ebp - 1], 0
je 0x417ff5
cmp byte [ebp + 0xb], 0
jne 0x417ff5
cmp byte [ebp - 8], 0
jne 0x417ff5
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
cmp ax, 0x70
mov ecx, dword [ecx + 0x44]
setne bl
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
jmp 0x418341
cmp ax, 0x78
jne 0x418017
cmp byte [ebp - 1], 0
jne 0x418017
cmp byte [ebp + 0xb], 0
jne 0x418017
cmp byte [ebp - 8], 0
jne 0x418017
mov ecx, 0x45c060
call fcn.004017ba
mov cx, word [edi + 0xc]
cmp cx, 0x72
jb 0x418049
cmp cx, 0x7b
ja 0x418049
cmp byte [ebp + 0xb], 0
je 0x418049
call fcn.004183d4
cmp eax, esi
jl 0x418049
mov ebx, dword [ebp - 0xc]
push dword [eax*8 + 0x45ab44]
mov ecx, ebx
call fcn.0041bffa
jmp 0x41804c
mov ebx, dword [ebp - 0xc]
movzx eax, word [edi + 0xc]
cmp eax, 0x52
jg 0x418210
je 0x4181fa
cmp eax, 0x28
jg 0x418111
je 0x41809f
sub eax, 8
je 0x418105
sub eax, 8
je 0x4180eb
sub eax, 0x12
je 0x4180c8
sub eax, 3
je 0x41808c
dec eax
je 0x4180b5
dec eax
jne 0x417f36
cmp byte [ebp - 1], 0
je 0x41809f
mov ecx, dword [ebx + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x417f36
cmp byte [ebp - 8], 0
je 0x417f36
mov ecx, ebx
call fcn.0041b658
jmp 0x417f36
cmp byte [ebp - 1], 0
je 0x41809f
mov ecx, dword [ebx + 0x44]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x417f36
cmp byte [ebp + 0xb], 0
je 0x417f36
cmp byte [ebp - 1], 0
jne 0x417f36
cmp byte [ebp - 8], 0
jne 0x417f36
jmp 0x418341
and byte [ebx + 0x180], 0
lea ecx, [ebx + 0x78]
call fcn.00402d50
mov dword [ebx + 0x184], eax
jmp 0x417f36
mov ecx, ebx
call fcn.004137e1
jmp 0x418341
cmp eax, 0x2d
je 0x4181a3
cmp eax, 0x2e
je 0x41818f
cmp eax, 0x30
jle 0x417f36
cmp eax, 0x34
jle 0x418175
cmp eax, 0x41
je 0x418162
cmp eax, 0x43
je 0x418156
cmp eax, 0x4e
jne 0x417f36
cmp byte [ebp + 0xb], 0
je 0x417f36
mov ecx, ebx
call fcn.0041ae1c
jmp 0x418341
cmp byte [ebp + 0xb], 0
je 0x417f36
jmp 0x4181b9
cmp byte [ebp + 0xb], 0
je 0x417f36
push 1
mov ecx, ebx
jmp 0x418260
cmp byte [ebp + 0xb], 0
je 0x417f36
add eax, 0xffffffcf
mov ecx, ebx
push eax
call fcn.0040e498
jmp 0x418341
cmp byte [ebp - 8], 0
mov ecx, ebx
sete al
push eax
call fcn.00419f4a
jmp 0x418341
cmp byte [ebp - 1], 0
jne 0x417f36
cmp byte [ebp + 0xb], 0
je 0x4181c5
cmp byte [ebp - 8], 0
jne 0x4181cb
mov ecx, ebx
call fcn.0041929d
jmp 0x418341
cmp byte [ebp - 8], 0
je 0x4181e1
cmp byte [ebp + 0xb], 0
jne 0x417f36
mov ecx, ebx
call fcn.00441c40
jmp 0x418341
cmp byte [ebx + 0x93], 0
je 0x417f36
mov ecx, ebx
call fcn.0041b703
jmp 0x418341
cmp byte [ebp + 0xb], 0
je 0x417f36
mov ecx, ebx
call fcn.00417c1d
jmp 0x418341
cmp eax, 0x71
jg 0x418301
je 0x4182da
sub eax, 0x56
je 0x4182cb
dec eax
dec eax
je 0x4182b8
dec eax
dec eax
je 0x4182a2
sub eax, 0x10
je 0x418296
dec eax
je 0x41826a
dec eax
dec eax
jne 0x417f36
cmp byte [ebp - 1], 0
je 0x418257
push esi
mov ecx, ebx
call fcn.0041b9a5
jmp 0x418341
cmp byte [ebp - 8], 0
push esi
mov ecx, ebx
je 0x41828c
call fcn.0041bb87
jmp 0x418341
cmp byte [ebp - 1], 0
je 0x418274
push 1
jmp 0x41824b
cmp byte [ebp - 8], 0
jne 0x41816c
cmp byte [ebp + 0xb], 0
jne 0x418341
push 1
mov ecx, ebx
call fcn.0041b88e
jmp 0x418341
mov ecx, ebx
call fcn.0041bbb9
jmp 0x418341
cmp byte [ebp + 0xb], 0
je 0x417f36
mov ecx, ebx
call fcn.0041b08a
jmp 0x418341
cmp byte [ebp + 0xb], 0
je 0x417f36
mov ecx, ebx
call fcn.00441c40
jmp 0x418341
cmp byte [ebp + 0xb], 0
je 0x417f36
jmp 0x4181d5
cmp byte [ebp - 1], 0
jne 0x417f36
cmp byte [ebp + 0xb], 0
jne 0x417f36
cmp byte [ebp - 8], 0
jne 0x417f36
mov ecx, ebx
call fcn.0041b069
jmp 0x418341
sub eax, 0x72
je 0x4183b3
dec eax
je 0x41838a
dec eax
je 0x41836b
dec eax
je 0x418348
sub eax, 6
jne 0x417f36
cmp byte [ebp - 1], 0
je 0x417f36
cmp byte [ebp + 0xb], 0
jne 0x417f36
cmp byte [ebp - 8], 0
jne 0x417f36
mov ecx, ebx
call fcn.0041358a
mov al, 1
jmp 0x417f38
cmp byte [ebp - 1], 0
jne 0x417f36
cmp byte [ebp + 0xb], 0
jne 0x417f36
mov ecx, dword [ebx + 0x44]
push dword [ebp - 8]
mov eax, dword [ecx]
push 1
call dword [eax + 8]
jmp 0x418341
cmp byte [ebp - 1], 0
jne 0x417f36
cmp byte [ebp + 0xb], 0
jne 0x417f36
mov ecx, dword [ebx + 0x44]
push dword [ebp - 8]
mov eax, dword [ecx]
push esi
jmp 0x418366
cmp byte [ebp - 1], 0
jne 0x417f36
cmp byte [ebp + 0xb], 0
jne 0x417f36
cmp byte [ebp - 8], 0
jne 0x41814a
push 1
mov ecx, ebx
call fcn.0041729b
jmp 0x418341
cmp byte [ebp - 1], 0
jne 0x417f36
cmp byte [ebp + 0xb], 0
jne 0x417f36
cmp byte [ebp - 8], 0
jne 0x417f36
push esi
jmp 0x4183aa