Function at 0x41d0ee
Capabilities:
Log keystrokes

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4705d0]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1a0]
mov esi, 0xff
push esi
mov dword [ebp - 0x70], eax
xor ebx, ebx
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], 0
call fcn.004464f0
push esi
lea eax, [ebp + 0x95]
push ebx
push eax
mov byte [ebp + 0x94], bl
call fcn.004464f0
mov eax, dword [ebp - 0x70]
add esp, 0x18
cmp eax, ebx
je 0x41d429
cmp byte [eax], bl
je 0x41d429
push ebx
push edi
call fcn.00440998
push 0x100
lea eax, [ebp + 0x94]
push ebx
push eax
call fcn.004464f0
add esp, 0xc
push ebx
push ebx
mov edi, 0x45c510
push edi
push 0x45b890
push dword [ebp - 0x70]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
call fcn.0043fa75
push ebx
push 1
push esi
lea eax, [ebp + 0x94]
push eax
push ebx
push edi
push dword [ebp - 0x70]
call fcn.004432d3
cmp byte [ebp + 0x94], bl
je 0x41d41f
jmp 0x41d1b7
xor ebx, ebx
cmp byte [ebp + 0x94], 0x20
je 0x41d1c9
cmp byte [ebp + 0x94], 0x3b
jne 0x41d200
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x41d1b7
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp + 0x95]
push eax
lea eax, [ebp + 0x94]
push eax
call fcn.00446570
add esp, 0xc
jmp 0x41d1b7
mov esi, 0x45d508
lea eax, [ebp + 0x94]
push esi
push eax
call fcn.00445d80
pop ecx
pop ecx
test eax, eax
je 0x41d22c
lea eax, [ebp + 0x94]
push esi
push eax
call fcn.00445d80
mov al, byte [eax + 1]
pop ecx
pop ecx
jmp 0x41d232
mov al, byte [ebp + 0x94]
mov byte [ebp - 0x6c], al
sub al, 0x61
cmp al, 0x19
ja 0x41d23f
add byte [ebp - 0x6c], 0xe0
cmp dword [ebp - 0x74], ebx
jne 0x41d24f
push ebx
push ebx
push ebx
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov bl, byte [ebp - 0x6c]
mov dl, byte [ebp - 0x6c]
push 0x19
pop eax
push 0xffffffffffffffe0
sub bl, 0x61
cmp al, bl
pop esi
sbb eax, eax
push 0x20
and eax, esi
pop edi
add eax, edi
mov cl, dl
sub cl, al
cmp cl, 0x21
jb 0x41d286
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov cl, dl
sub cl, al
cmp cl, 0x2e
jbe 0x41d2dc
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov cl, dl
sub cl, al
cmp cl, 0x11
je 0x41d2dc
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov cl, dl
sub cl, al
cmp cl, 0x5b
je 0x41d2dc
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov cl, dl
sub cl, al
cmp cl, 0x5c
je 0x41d2dc
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov cl, dl
sub cl, al
cmp cl, 0x5d
je 0x41d2dc
and dword [ebp - 0x7c], 0
jmp 0x41d2e3
mov dword [ebp - 0x7c], 1
push 0x19
pop eax
cmp al, bl
sbb eax, eax
push 0x19
pop ecx
and eax, esi
add eax, edi
cmp cl, bl
sbb ecx, ecx
push 0
push dword [ebp - 0x7c]
sub dl, al
movzx eax, dl
and ecx, esi
push 0
add ecx, edi
push eax
mov dword [ebp - 0x80], ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
mov al, byte [ebp - 0x6c]
sub al, byte [ebp - 0x80]
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_keybd_event]
mov cl, byte [ebp - 0x6c]
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov dl, cl
sub dl, al
cmp dl, 0x21
jb 0x41d34b
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov dl, cl
sub dl, al
cmp dl, 0x2e
jbe 0x41d39d
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov dl, cl
sub dl, al
cmp dl, 0x11
je 0x41d39d
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov dl, cl
sub dl, al
cmp dl, 0x5b
je 0x41d39d
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov dl, cl
sub dl, al
cmp dl, 0x5c
je 0x41d39d
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
sub cl, al
cmp cl, 0x5d
je 0x41d39d
xor ecx, ecx
jmp 0x41d3a0
xor ecx, ecx
inc ecx
push 0x19
pop eax
cmp al, bl
sbb eax, eax
and eax, esi
add eax, edi
mov dl, 0x19
cmp dl, bl
sbb ebx, ebx
push 0
or ecx, 2
push ecx
mov cl, byte [ebp - 0x6c]
sub cl, al
movzx eax, cl
push 0
and ebx, esi
push eax
add ebx, edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push eax
mov al, byte [ebp - 0x6c]
sub al, bl
movzx eax, al
push eax
call esi
xor edi, edi
cmp dword [ebp - 0x74], edi
jne 0x41d3ed
push edi
push 2
push edi
push 0x12
call esi
inc dword [ebp - 0x74]
inc dword [ebp - 0x78]
push edi
push 1
push 0xff
lea eax, [ebp + 0x94]
push eax
push dword [ebp - 0x78]
push 0x45c510
push dword [ebp - 0x70]
call fcn.004432d3
cmp byte [ebp + 0x94], 0
jne 0x41d1b5
xor eax, eax
cmp byte [ebp - 0x6c], al
setne al
jmp 0x41d42b
xor eax, eax
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464bf
add ebp, 0x198
leave
ret 8