Function at 0x43e220
Capabilities:
Log keystrokes via polling
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x140
mov eax, dword [0x4642d0]
xor eax, esp
mov dword [esp + 0x13c], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov esi, dword [esp + 0x150]
push 0
push 0
push 0x229
push dword [0x464d10]
call ebx
test eax, eax
je 0x43e782
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, dword [esp + 0x14c]
mov dword [esp + 0xc], eax
test cl, 1
je 0x43e297
test esi, esi
jne 0x43e280
push 0x45935c
jmp 0x43e281
push esi
push 0
push 0x401
push dword [0x464e48]
call ebx
mov ecx, dword [esp + 0x14c]
mov esi, dword [esp + 0xc]
test cl, 8
je 0x43e2dd
mov dword [esp + 0x18], 2
mov eax, dword [esi + 0x18]
mov dword [esp + 0x2c], eax
lea eax, [esi + 0x148]
push eax
call fcn.0043e080
add esp, 4
cmp eax, 0xffffffff
je 0x43e2d6
lea ecx, [esp + 0x18]
push ecx
push eax
push 0x1306
push dword [0x464e54]
call ebx
mov ecx, dword [esp + 0x14c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
mov edx, dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ebp
xor ebp, ebp
rol eax, 0
push edi
rol eax, 1
mov dword [esp + 0x1c], eax
test ecx, eax
je 0x43e772
lea edi, [ebp*2]
add edi, ebp
cmp byte [edi*2 + 0x46a67c], 0
je 0x43e772
cmp ebp, 0xc
ja case.default.0x43e323
jmp dword [ebp*4 + 0x43e79c]
push 0xffffffffffffffff
push 4
mov ecx, esi
call fcn.00403ad0
inc eax
mov ecx, esi
push eax
push 0xffffffffffffffff
push 2
call fcn.00403ad0
inc eax
push eax
lea eax, [esp + 0x54]
push 0x459370
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp case.default.0x43e323
cmp dword [esi + 0x34], 0x80
mov ecx, esi
je 0x43e3c5
call fcn.00403cf0
mov ecx, esi
cmp eax, 0x2800
jge 0x43e397
push eax
push 0
call fcn.00403ab0
inc eax
push eax
lea eax, [esp + 0x54]
push 0x45937c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp case.default.0x43e323
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
push eax
push 0
call fcn.00403ab0
inc eax
push eax
lea eax, [esp + 0x54]
push 0x459390
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp case.default.0x43e323
push 0
call fcn.00403ab0
inc eax
push eax
lea eax, [esp + 0x50]
push 0x4593a4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.default.0x43e323
cmp dword [esi + 0x18], 0
lea eax, [esp + 0x4c]
je 0x43e3fd
push 0x4593ac
push eax
call ebx
jmp case.default.0x43e323
push 0x4593b8
push eax
call ebx
jmp case.default.0x43e323
mov eax, dword [esi + 0x34]
and eax, 0xffff
cmp eax, 0x80
ja case.0x43e420.3
movzx eax, byte [eax + 0x43e7f8]
jmp dword [eax*4 + 0x43e7d0]
push str.Unknown
jmp 0x43e464
push str.Ansi
jmp 0x43e464
push str.Unicode
jmp 0x43e464
push str.UniBig
jmp 0x43e464
push str.UniNB
jmp 0x43e464
push str.UniBigNB
jmp 0x43e464
push str.Utf8
jmp 0x43e464
push str.Utf8NB
jmp 0x43e464
push str.Binary
lea eax, [esp + 0x50]
push eax
call ebx
mov eax, dword [esi + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
and eax, 0xffff0000
cmp eax, 0x20000
je 0x43e49c
cmp eax, 0x40000
jne 0x43e6ca
push str._LF_
lea eax, [esp + 0x50]
push eax
call esi
jmp 0x43e6ca
push str._CR_
lea eax, [esp + 0x50]
push eax
call esi
jmp 0x43e6ca
mov ecx, esi
call fcn.00403ae0
test eax, eax
lea eax, [esp + 0x4c]
je 0x43e4c9
push 0x45941c
push eax
call ebx
jmp case.default.0x43e323
push 0x459428
push eax
call ebx
jmp case.default.0x43e323
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
lea eax, [esp + 0x4c]
je 0x43e4f3
push 0x459434
push eax
call ebx
jmp case.default.0x43e323
push 0x45943c
push eax
call ebx
jmp case.default.0x43e323
push dword [esi + 4]
call fcn.0043f820
add esp, 4
test eax, eax
lea eax, [esp + 0x4c]
je 0x43e520
push 0x459444
push eax
call ebx
jmp case.default.0x43e323
push 0x45944c
push eax
call ebx
jmp case.default.0x43e323
mov ecx, esi
call fcn.00403b30
mov dword [esp + 0x18], eax
lea ecx, [eax + 2]
push ecx
push eax
push 0xa
lea eax, [esp + 0xd8]
mov ecx, esi
push eax
call fcn.00403bd0
push dword [esp + 0xcc]
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
movzx eax, word [esp + 0xcc]
jne 0x43e56f
movzx eax, byte [esp + 0xcc]
push eax
push eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x54]
push str._d__x_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp case.default.0x43e323
push 1
lea eax, [esp + 0x14]
mov ecx, esi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00403bc0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp ecx, eax
jne 0x43e5bd
push 0x45945c
lea eax, [esp + 0x50]
push eax
call ebx
jmp case.default.0x43e323
sub eax, ecx
push eax
lea eax, [esp + 0x50]
push 0x459468
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp case.default.0x43e323
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x43e63e
push dword [0x464d0c]
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x40
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0
push 0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.0043f9f0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp case.default.0x43e323
push 0x459470
lea eax, [esp + 0x50]
push eax
call ebx
jmp case.default.0x43e323
cmp dword [esi + 0xc], 0
lea eax, [esp + 0x4c]
je 0x43e660
push 0x45947c
push eax
call ebx
jmp case.default.0x43e323
push 0x459488
push eax
call ebx
jmp case.default.0x43e323
lea eax, [esp + 0x3c]
push eax
call edx
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x48]
push eax
lea eax, [esp + 0x54]
push 0x458094
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp case.default.0x43e323
lea eax, [esp + 0x3c]
push eax
call edx
movzx eax, word [esp + 0x40]
push dword [eax*4 + 0x4642a8]
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x46]
push eax
lea eax, [esp + 0x58]
push 0x459494
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
movzx eax, byte [edi*2 + 0x46a681]
sub eax, 0
je 0x43e6ef
sub eax, 1
je 0x43e6e8
sub eax, 1
jne 0x43e6fe
push 0x4594a4
jmp 0x43e6f4
push 0x454ee4
jmp 0x43e6f4
push 0x45279c
lea eax, [esp + 0xd0]
push eax
call ebx
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0xd0]
push eax
call esi
mov edx, 1
mov ecx, 0x46a67d
cmp byte [ecx - 1], 0
je 0x43e729
mov al, byte [edi*2 + 0x46a67d]
cmp al, byte [ecx]
jbe 0x43e729
inc edx
add ecx, 6
cmp ecx, 0x46a6cb
jl 0x43e717
lea eax, [esp + 0xcc]
mov ecx, 0x200
push eax
xor eax, eax
cmp byte [edi*2 + 0x46a680], al
cmovne eax, ecx
or eax, edx
push eax
push 0x401
push dword [0x464e48]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x154]
mov edx, dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, dword [esp + 0x14]
inc ebp
cmp ebp, 0xd
jl 0x43e2f5
pop edi
pop ebp
mov ecx, dword [esp + 0x144]
pop esi
pop ebx
xor ecx, esp
call fcn.0043fe9e
add esp, 0x140
ret