Function at 0x4159d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x838
mov eax, dword [esp + 0x840]
push ebx
push ebp
push esi
test eax, eax
mov eax, dword [0x44ca9c]
push edi
mov edi, 0x800
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], edi
mov byte [esp + 0x18], 0x42
mov byte [esp + 0x19], 0x4b
mov byte [esp + 0x1a], 0x47
mov byte [esp + 0x1b], 0x4f
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x15], 0
lea eax, [eax + eax*2]
jne 0x415a3f
shl eax, 1
mov cl, byte [eax + 0x431a80]
mov dl, byte [eax + 0x431a82]
mov al, byte [eax + 0x431a84]
mov byte [esp + 0x10], cl
mov byte [esp + 0x12], dl
jmp 0x415a5b
shl eax, 1
mov cl, byte [eax + 0x431a81]
mov dl, byte [eax + 0x431a83]
mov al, byte [eax + 0x431a85]
mov byte [esp + 0x10], cl
mov byte [esp + 0x12], dl
mov ebp, dword [esp + 0x84c]
lea ecx, [esp + 0x10]
and ebp, 0xff
push 6
push ecx
push ebp
mov byte [esp + 0x20], al
call dword [0x44d8e0]
mov eax, dword [0x439fc8]
add esp, 0xc
mov edx, dword [eax*4 + 0x439fcc]
mov eax, dword [eax*4 + 0x431580]
shl edx, 7
mov eax, dword [edx + eax + 0x18]
cmp eax, 1
jne 0x415aa8
mov dword [esp + 0x24], 0x400
mov edi, dword [esp + 0x24]
mov ecx, dword [0x42e558]
cmp ecx, 1
jne 0x415acb
mov ecx, dword [0x44ccb4]
mov edx, dword [0x439eb0]
mov esi, dword [esp + 0x30]
add edx, ecx
mov dword [esp + 0x1c], edx
jmp 0x415b23
cmp ecx, 2
jne 0x415afe
lea ecx, [esp + 0x48]
cmp eax, 1
mov eax, dword [0x439eb0]
mov dword [esp + 0x1c], ecx
jne 0x415af6
test al, 2
jne 0x415aee
shr eax, 1
shl eax, 1
mov esi, eax
jmp 0x415b23
shr eax, 1
lea esi, [eax + eax + 2]
jmp 0x415b23
test al, 1
mov esi, eax
je 0x415b23
jmp 0x415b22
lea edx, [esp + 0x48]
cmp eax, 1
mov eax, dword [0x439eb0]
mov dword [esp + 0x1c], edx
jne 0x415b1c
test al, 2
je 0x415aee
shr eax, 1
shl eax, 1
mov esi, eax
jmp 0x415b23
test al, 1
mov esi, eax
jne 0x415b23
inc esi
mov eax, dword [0x42e59c]
mov ecx, dword [0x439eb4]
mov edx, eax
mov ebx, ecx
sub edx, ecx
inc edx
cmp ebx, eax
mov dword [0x44d520], edx
ja 0x415dba
lea eax, [ebx + ebx*4]
lea eax, [eax + eax*4]
shl eax, 2
mov dword [esp + 0x28], eax
lea eax, [edi + edi*4]
lea eax, [eax + eax*4]
shl eax, 2
mov dword [esp + 0x30], eax
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x435918]
movsx eax, ax
test eax, ecx
je 0x415b84
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x43a174]
je 0x415d00
cmp dword [0x43a1b0], 5
je 0x415d00
lea ecx, [esp + 0x1a]
push 2
push ecx
push ebp
call dword [0x44d8e0]
lea edx, [ebp*8]
mov ecx, 1
sub edx, ebp
add esp, 0xc
lea edi, [ebp + edx*4]
shl edi, 2
cmp eax, ecx
mov dword [edi + 0x44cd08], eax
jne 0x415d4f
cmp dword [0x42e558], ecx
je 0x415c29
mov eax, dword [0x439fc8]
mov edx, dword [eax*4 + 0x439fcc]
mov eax, dword [eax*4 + 0x431580]
shl edx, 7
cmp dword [edx + eax + 0x18], ecx
jne 0x415c0f
mov ecx, dword [0x44ccb4]
xor eax, eax
mov dl, byte [ecx + esi]
add esi, 4
mov byte [esp + eax + 0x48], dl
mov dl, byte [ecx + esi - 3]
mov byte [esp + eax + 0x49], dl
add eax, 2
cmp eax, 0x800
jl 0x415bf1
jmp 0x415c29
mov ecx, dword [0x44ccb4]
xor eax, eax
mov dl, byte [ecx + esi]
add esi, 2
mov byte [esp + eax + 0x48], dl
inc eax
cmp eax, 0x800
jl 0x415c17
mov eax, dword [esp + 0x1c]
push 0x800
push eax
push ebp
call dword [0x44d8e0]
add esp, 0xc
cmp eax, 1
mov dword [edi + 0x44cd08], eax
jne 0x415d88
cmp dword [0x42e558], 1
jne 0x415c5d
add dword [esp + 0x1c], 0x800
lea ecx, [esp + 0x22]
push 2
push ecx
push ebp
call dword [0x44d484]
add esp, 0xc
cmp eax, 1
mov dword [edi + 0x44cd08], eax
jne 0x415d88
mov ax, word [esp + 0x22]
cmp al, 0x4f
je 0x415c8f
cmp ah, 0x4b
jne 0x415d5c
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
add ebx, ecx
mov ecx, dword [esp + 0x28]
add ecx, eax
mov eax, dword [0x439eb4]
push 0x25
mov dword [esp + 0x2c], ecx
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, ecx
shl edx, 2
sub eax, edx
xor edx, edx
div dword [0x44d520]
lea edx, [edi + 0x44cd0e]
and eax, 0xff
push eax
mov eax, dword [esp + 0x858]
mov ecx, dword [eax*4 + 0x435794]
push ecx
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x42e59c]
add esp, 0x10
cmp ebx, eax
jbe 0x415b5d
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x838
ret
push 5
push 0x43a1b0
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea eax, [esp + 0x18]
push 2
push eax
push ebp
call dword [0x44d8e0]
lea ecx, [ebp*8]
add esp, 0xc
sub ecx, ebp
cmp eax, 1
lea edx, [ebp + ecx*4]
mov dword [edx*4 + 0x44cd08], eax
je 0x415dba
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x838
ret
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x838
ret
lea eax, [esp + 0x34]
push 6
push eax
push ebp
call dword [0x44d484]
lea ecx, [ebp*8]
add esp, 0xc
sub ecx, ebp
lea ecx, [ebp + ecx*4]
shl ecx, 2
cmp eax, 1
mov dword [ecx + 0x44cd08], eax
je 0x415d98
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x838
ret
mov dl, byte [esp + 0x34]
mov ax, word [esp + 0x36]
mov byte [ecx + 0x44cd53], dl
mov dx, word [esp + 0x38]
mov word [ecx + 0x44cd66], ax
mov word [ecx + 0x44cd68], dx
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x838
ret