Function at 0x41845d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp word [edi + 0xc], 9
jne 0x41848d
mov eax, dword [edi]
cmp eax, dword [ecx + 0x80]
jne 0x41848d
mov ecx, dword [ecx + 0x50]
mov eax, dword [ecx]
call dword [eax]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and al, 1
push 0x11
mov byte [ebp - 1], al
call esi
shr eax, 0xf
and al, 1
push 0xa3
mov byte [ebp + 0xb], al
call esi
mov bx, ax
push 0x10
shr ebx, 0xf
and bl, 1
call esi
shr eax, 0xf
and al, 1
xor esi, esi
mov byte [ebp - 8], al
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov ax, word [edi + 0xc]
cmp ax, 0x30
jb 0x41850b
cmp ax, 0x39
ja 0x41850b
test bl, bl
jne 0x4184e7
cmp byte [ebp - 1], bl
je 0x41850b
mov ecx, dword [ebp - 0xc]
movzx eax, ax
sub eax, 0x30
cmp byte [ebp - 8], 0
push eax
je 0x418501
call fcn.004142fc
jmp 0x41885d
call fcn.00414397
jmp 0x41885d
cmp ax, 0x71
je 0x418517
cmp ax, 0x70
jne 0x418543
cmp byte [ebp - 1], 0
je 0x418543
cmp byte [ebp + 0xb], 0
jne 0x418543
cmp byte [ebp - 8], 0
jne 0x418543
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
cmp ax, 0x70
mov ecx, dword [ecx + 0x50]
setne bl
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
jmp 0x41885d
cmp ax, 0x78
jne 0x418565
cmp byte [ebp - 1], 0
jne 0x418565
cmp byte [ebp + 0xb], 0
jne 0x418565
cmp byte [ebp - 8], 0
jne 0x418565
mov ecx, 0x455378
call fcn.0040194c
mov cx, word [edi + 0xc]
cmp cx, 0x72
jb 0x418597
cmp cx, 0x7b
ja 0x418597
cmp byte [ebp + 0xb], 0
je 0x418597
call fcn.004188f7
cmp eax, esi
jl 0x418597
mov ebx, dword [ebp - 0xc]
push dword [eax*8 + 0x453cbc]
mov ecx, ebx
call fcn.0041c484
jmp 0x41859a
mov ebx, dword [ebp - 0xc]
movzx eax, word [edi + 0xc]
cmp eax, 0x4e
jg 0x418742
je 0x41872c
cmp eax, 0x28
jg 0x418662
je 0x4185ed
sub eax, 8
je 0x418656
sub eax, 8
je 0x418639
sub eax, 0x12
je 0x418616
sub eax, 3
je 0x4185da
dec eax
je 0x418603
dec eax
jne 0x418484
cmp byte [ebp - 1], 0
je 0x4185ed
mov ecx, dword [ebx + 0x50]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x418484
cmp byte [ebp - 8], 0
je 0x418484
mov ecx, ebx
call fcn.0041bab6
jmp 0x418484
cmp byte [ebp - 1], 0
je 0x4185ed
mov ecx, dword [ebx + 0x50]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x418484
cmp byte [ebp + 0xb], 0
je 0x418484
cmp byte [ebp - 1], 0
jne 0x418484
cmp byte [ebp - 8], 0
jne 0x418484
jmp 0x41885d
and byte [ebx + 0x188], 0
lea ecx, [ebx + 0x80]
call fcn.00402fa1
mov dword [ebx + 0x18c], eax
jmp 0x418484
mov ecx, ebx
call fcn.00414ea3
jmp 0x41885d
cmp eax, 0x2d
je 0x4186d5
cmp eax, 0x2e
je 0x4186c1
cmp eax, 0x30
jle 0x418484
cmp eax, 0x34
jle 0x4186a7
cmp eax, 0x41
je 0x418694
cmp eax, 0x43
jne 0x418484
cmp byte [ebp + 0xb], 0
je 0x418484
jmp 0x4186eb
cmp byte [ebp + 0xb], 0
je 0x418484
push 1
mov ecx, ebx
jmp 0x418815
cmp byte [ebp + 0xb], 0
je 0x418484
add eax, 0xffffffcf
mov ecx, ebx
push eax
call fcn.0040fbc0
jmp 0x41885d
cmp byte [ebp - 8], 0
mov ecx, ebx
sete al
push eax
call fcn.0041a257
jmp 0x41885d
cmp byte [ebp - 1], 0
jne 0x418484
cmp byte [ebp + 0xb], 0
je 0x4186f7
cmp byte [ebp - 8], 0
jne 0x4186fd
mov ecx, ebx
call fcn.0041976f
jmp 0x41885d
cmp byte [ebp - 8], 0
je 0x418713
cmp byte [ebp + 0xb], 0
jne 0x418484
mov ecx, ebx
call fcn.0043bd57
jmp 0x41885d
cmp byte [ebx + 0x9b], 0
je 0x418484
mov ecx, ebx
call fcn.0041bb64
jmp 0x41885d
cmp byte [ebp + 0xb], 0
je 0x418484
mov ecx, ebx
call fcn.0041b234
jmp 0x41885d
cmp eax, 0x6d
jg 0x41881c
je 0x4187fc
sub eax, 0x52
je 0x4187e9
sub eax, 4
je 0x4187da
dec eax
dec eax
je 0x4187c4
dec eax
dec eax
je 0x4187ae
sub eax, 0x10
je 0x4187a2
dec eax
jne 0x418484
cmp byte [ebp - 1], 0
je 0x418780
push 1
jmp 0x418803
cmp byte [ebp - 8], 0
jne 0x41869e
cmp byte [ebp + 0xb], 0
jne 0x41885d
push 1
mov ecx, ebx
call fcn.0041bcfb
jmp 0x41885d
mov ecx, ebx
call fcn.0041c063
jmp 0x41885d
cmp byte [ebp + 0xb], 0
je 0x418484
mov ecx, ebx
call fcn.0041b502
jmp 0x41885d
cmp byte [ebp + 0xb], 0
je 0x418484
mov ecx, ebx
call fcn.0043bd57
jmp 0x41885d
cmp byte [ebp + 0xb], 0
je 0x418484
jmp 0x418707
cmp byte [ebp + 0xb], 0
je 0x418484
mov ecx, ebx
call fcn.00418156
jmp 0x41885d
cmp byte [ebp - 1], 0
je 0x41880c
push esi
mov ecx, ebx
call fcn.0041be4c
jmp 0x41885d
cmp byte [ebp - 8], 0
push esi
mov ecx, ebx
je 0x418798
call fcn.0041c031
jmp 0x41885d
sub eax, 0x71
je 0x4188cd
dec eax
dec eax
je 0x4188a6
dec eax
je 0x418887
dec eax
je 0x418864
sub eax, 6
jne 0x418484
cmp byte [ebp - 1], 0
je 0x418484
cmp byte [ebp + 0xb], 0
jne 0x418484
cmp byte [ebp - 8], 0
jne 0x418484
mov ecx, ebx
call fcn.00414c44
mov al, 1
jmp 0x418486
cmp byte [ebp - 1], 0
jne 0x418484
cmp byte [ebp + 0xb], 0
jne 0x418484
mov ecx, dword [ebx + 0x50]
push dword [ebp - 8]
mov eax, dword [ecx]
push 1
call dword [eax + 8]
jmp 0x41885d
cmp byte [ebp - 1], 0
jne 0x418484
cmp byte [ebp + 0xb], 0
jne 0x418484
mov ecx, dword [ebx + 0x50]
push dword [ebp - 8]
mov eax, dword [ecx]
push esi
jmp 0x418882
cmp byte [ebp - 1], 0
jne 0x418484
cmp byte [ebp + 0xb], 0
jne 0x418484
cmp byte [ebp - 8], 0
mov ecx, ebx
jne 0x418738
call fcn.00417843
jmp 0x41885d
cmp byte [ebp - 1], 0
jne 0x418484
cmp byte [ebp + 0xb], 0
jne 0x418484
cmp byte [ebp - 8], 0
jne 0x418484
mov ecx, ebx
call fcn.0041b4de
jmp 0x41885d