Function at 0x4217ef
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44c301
push eax
mov dword fs:[0], esp
sub esp, 0x158
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
lea edi, [esp + 0x68]
push 5
rep stosd dword es:[edi], eax
push 0x433
mov ecx, esi
call fcn.004418d8
mov ecx, eax
call fcn.00441ac9
mov eax, dword [esi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call ebx
xor ebp, ebp
cmp dword [0x45b940], 1
jne 0x421846
mov eax, dword [0x475718]
test eax, eax
je 0x421862
mov eax, dword [esi + 0x270]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov ebp, 1
jmp 0x421866
mov eax, dword [0x475710]
test eax, eax
je 0x421862
mov eax, dword [esi + 0x270]
push eax
mov edx, dword [eax]
call dword [edx + 0x64]
mov ebp, 1
jmp 0x421866
test ebp, ebp
je 0x4218c4
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x42191e
mov edi, dword [esi + 0x270]
lea ecx, [esp + 0x18]
push ecx
push 0x50
mov eax, dword [edi]
push edi
call dword [eax + 0x24]
test eax, eax
jge 0x4218ab
cmp eax, 0x8007001e
je 0x4218a0
cmp eax, 0x8007000c
jne 0x421941
mov edx, dword [edi]
push edi
call dword [edx + 0x1c]
jmp 0x421821
xor edi, edi
mov al, byte [esp + edi + 0x48]
test al, al
jne 0x421964
inc edi
cmp edi, 0x20
jl 0x4218ad
jmp 0x421821
mov edi, dword [esi + 0x270]
lea ecx, [esp + 0x68]
push ecx
push 0x100
mov eax, dword [edi]
push edi
call dword [eax + 0x24]
test eax, eax
jge 0x4218fb
cmp eax, 0x8007001e
je 0x4218f0
cmp eax, 0x8007000c
jne 0x4219c4
mov edx, dword [edi]
push edi
call dword [edx + 0x1c]
jmp 0x421821
test byte [esp + 0x69], 0x80
jne 0x42191e
xor edi, edi
mov al, byte [esp + edi + 0x68]
test al, al
jne 0x4219e4
inc edi
cmp edi, 0x100
jl 0x421904
jmp 0x421821
push 0
push 0x433
mov ecx, esi
call fcn.004418d8
mov ecx, eax
call fcn.00441ac9
mov eax, dword [esi + 0x1c]
push eax
call ebx
or eax, 0xffffffff
jmp 0x421a43
push 0
push 0x433
mov ecx, esi
call fcn.004418d8
mov ecx, eax
call fcn.00441ac9
mov ecx, dword [esi + 0x1c]
push ecx
call ebx
or eax, 0xffffffff
jmp 0x421a43
lea edx, [edi + 0x30]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.00421a60
mov ecx, dword [esp + 0x178]
push eax
mov dword [esp + 0x174], 0
call fcn.0043e785
lea ecx, [esp + 0x14]
mov dword [esp + 0x170], 0xffffffff
call fcn.0043e698
push 0
mov ecx, esi
call fcn.00440f98
push 0
push 0x433
mov ecx, esi
call fcn.004418d8
mov ecx, eax
call fcn.00441ac9
mov ecx, dword [esi + 0x1c]
push ecx
jmp 0x421a3f
push 0
push 0x433
mov ecx, esi
call fcn.004418d8
mov ecx, eax
call fcn.00441ac9
mov edx, dword [esi + 0x1c]
push edx
call ebx
or eax, 0xffffffff
jmp 0x421a43
lea ecx, [esp + 0x10]
push edi
push ecx
mov ecx, esi
call fcn.00421a60
mov ecx, dword [esp + 0x178]
push eax
mov dword [esp + 0x174], 1
call fcn.0043e785
lea ecx, [esp + 0x10]
mov dword [esp + 0x170], 0xffffffff
call fcn.0043e698
push 0
mov ecx, esi
call fcn.00440f98
push 0
push 0x433
mov ecx, esi
call fcn.004418d8
mov ecx, eax
call fcn.00441ac9
mov edx, dword [esi + 0x1c]
push edx
call ebx
mov eax, edi
mov ecx, dword [esp + 0x168]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret 4