Function at 0x4346d0
Capabilities:
Create process on windows
Create thread
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x54]
push edi
push str._keysym_0x_x
mov ecx, 8
mov eax, 0x48b3f0
call fcn.00401000
lea eax, [edi - 0xfe50]
add esp, 8
cmp eax, 0x10
ja 0x434725
push str.__DEAD_KEY
mov ecx, 8
mov eax, 0x48b3f0
mov dword [0x4a66fc], edi
call fcn.00401000
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
cmp edi, 0x20
jb 0x43472f
cmp edi, 0x7e
jbe 0x43473e
lea ecx, [edi - 0xa0]
cmp ecx, 0x5f
ja 0x434ca1
mov eax, dword [0x4a66fc]
test eax, eax
je 0x434977
cmp byte [esp + 0x58], 0
je 0x434977
push edi
push eax
push str._Compose_dead_0x_x_0x_x
mov ecx, 8
mov eax, 0x48b3f0
call fcn.00401000
mov eax, dword [0x4a66fc]
add eax, 0xffff01b0
add esp, 0xc
cmp eax, 0xb
ja case.0x434782.65108
jmp dword [eax*4 + 0x434e58]
lea eax, [edi - 0x41]
cmp eax, 0x34
ja case.0x434798.66
movzx edx, byte [eax + 0x434eb4]
jmp dword [edx*4 + 0x434e88]
mov edi, 0xc0
jmp case.0x434798.66
mov edi, 0xc8
jmp case.0x434798.66
mov edi, 0xcc
jmp case.0x434798.66
mov edi, 0xd2
jmp case.0x434798.66
mov edi, 0xd9
jmp case.0x434798.66
mov edi, 0xe0
jmp case.0x434798.66
mov edi, 0xe8
jmp case.0x434798.66
mov edi, 0xec
jmp case.0x434798.66
mov edi, 0xf2
jmp case.0x434798.66
mov edi, 0xf9
lea eax, [edi - 0x41]
cmp eax, 0x38
ja case.0x4347f2.66
movzx eax, byte [eax + 0x434f20]
jmp dword [eax*4 + 0x434eec]
mov edi, 0xc1
jmp case.0x4347f2.66
mov edi, 0xc9
jmp case.0x4347f2.66
mov edi, 0xcd
jmp case.0x4347f2.66
mov edi, 0xd3
jmp case.0x4347f2.66
mov edi, 0xda
jmp case.0x4347f2.66
mov edi, 0xe1
jmp case.0x4347f2.66
mov edi, 0xe9
jmp case.0x4347f2.66
mov edi, 0xed
jmp case.0x4347f2.66
mov edi, 0xf3
jmp case.0x4347f2.66
mov edi, 0xfa
jmp case.0x4347f2.66
mov edi, 0xfd
jmp case.0x4347f2.66
mov edi, 0xdd
lea eax, [edi - 0x41]
cmp eax, 0x34
ja case.0x43485a.66
movzx ecx, byte [eax + 0x434f88]
jmp dword [ecx*4 + 0x434f5c]
mov edi, 0xc2
jmp case.0x43485a.66
mov edi, 0xca
jmp case.0x43485a.66
mov edi, 0xce
jmp case.0x43485a.66
mov edi, 0xd4
jmp case.0x43485a.66
mov edi, 0xdb
jmp case.0x43485a.66
mov edi, 0xe2
jmp case.0x43485a.66
mov edi, 0xea
jmp case.0x43485a.66
mov edi, 0xee
jmp case.0x43485a.66
mov edi, 0xf4
jmp case.0x43485a.66
mov edi, 0xfb
lea eax, [edi - 0x41]
cmp eax, 0x2e
ja case.0x4348b4.66
movzx edx, byte [eax + 0x434fd8]
jmp dword [edx*4 + 0x434fc0]
mov edi, 0xd1
jmp case.0x4348b4.66
mov edi, 0xd5
jmp case.0x4348b4.66
mov edi, 0xe3
jmp case.0x4348b4.66
mov edi, 0xf1
jmp case.0x4348b4.66
mov edi, 0xf5
lea eax, [edi - 0x41]
cmp eax, 0x38
ja case.0x4348eb.66
movzx eax, byte [eax + 0x435038]
jmp dword [eax*4 + 0x435008]
mov edi, 0xc4
jmp case.0x434782.65108
mov edi, 0xcb
jmp case.0x434782.65108
mov edi, 0xcf
jmp case.0x434782.65108
mov edi, 0xd6
jmp case.0x434782.65108
mov edi, 0xdc
jmp case.0x434782.65108
mov edi, 0xe4
jmp case.0x434782.65108
mov edi, 0xeb
jmp case.0x434782.65108
mov edi, 0xef
jmp case.0x434782.65108
mov edi, 0xf6
jmp case.0x434782.65108
mov edi, 0xfc
jmp case.0x434782.65108
mov edi, 0xff
jmp case.0x434782.65108
cmp edi, 0x43
je 0x434950
cmp edi, 0x63
jne case.0x434782.65108
mov edi, 0xe7
jmp case.0x434782.65108
mov edi, 0xc7
push edi
push str._Composed_0x_x
mov ecx, 8
mov eax, 0x48b3f0
mov dword [0x4a66fc], 0
call fcn.00401000
add esp, 8
push edi
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp byte [esp + 0x5c], 0
movzx ebx, ax
je 0x4349b0
cmp edi, 0x4a6
jne 0x434997
mov ebx, 0x130
jmp 0x4349b0
cmp edi, 0x5c
jne 0x4349a3
mov ebx, 0xe2
jmp 0x4349b0
cmp edi, 0xa5
jne 0x4349b0
mov ebx, 0xdc
movsx esi, bx
push esi
push str._SHORT_s__i
mov ecx, 8
mov eax, 0x48b3f0
call fcn.00401000
add esp, 8
cmp bx, 0xffff
jne 0x434b3f
cmp byte [esp + 0x58], 0
je 0x434e4b
push str.down
mov ecx, 8
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
push str._Found_key
mov ecx, 8
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
xor ecx, ecx
movzx edx, word [ecx*2 + 0x48a7b8]
cmp edi, edx
je 0x434a25
inc ecx
cmp ecx, 0x100
jl 0x434a10
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x58], eax
imul eax, eax, 0xffffff9c
add ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, ebx
neg eax
add eax, eax
add eax, eax
sub eax, ebx
lea ecx, [ecx + eax*2]
mov dword [esp + 0x5c], ecx
cmp ecx, 0xff
je 0x434b1d
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x12
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call edi
mov al, byte [esp + 0x58]
push 0
movzx ebp, al
push 0
push 0
add ebp, 0x60
add al, 0x60
push ebp
mov byte [esp + 0x68], al
call esi
mov ecx, dword [esp + 0x60]
push eax
push ecx
call edi
push 0
push 2
push 0
push ebp
call esi
mov edx, dword [esp + 0x60]
push eax
push edx
call edi
push 0
movzx ebp, bl
push 0
push 0
add ebp, 0x60
push ebp
add bl, 0x60
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push ebp
call esi
push eax
push ebx
call edi
mov bl, byte [esp + 0x5c]
push 0
movzx ebp, bl
push 0
push 0
add ebp, 0x60
push ebp
add bl, 0x60
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push ebp
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push 0x12
call esi
push eax
push 0x12
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push edi
push str.ignoring_unrecognised_Latin_1_keysym_0x_x
mov ecx, 8
mov eax, 0x48b3f0
call fcn.00401000
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
mov eax, esi
and ebp, 1
xor ecx, ecx
shr eax, 8
cmp ebp, ecx
je 0x434b60
xor al, 1
mov byte [esp + 0x5c], al
jmp 0x434b64
mov byte [esp + 0x5c], al
mov dword [esp + 0x44], 0x11
mov dword [esp + 0x48], ecx
mov byte [esp + 0x4c], cl
mov byte [esp + 0x4d], cl
mov dword [esp + 0x38], 0x12
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x40], cl
mov byte [esp + 0x41], cl
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], cl
mov dword [esp + 0x2c], 0xa0
mov dword [esp + 0x30], ecx
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], cl
mov dword [esp + 0x14], 0xa1
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], cl
cmp byte [esp + 0x58], cl
je 0x434c25
test al, 2
je 0x434bdf
lea esi, [esp + 0x44]
call fcn.00434400
mov al, byte [esp + 0x5c]
test al, 4
je 0x434bf0
lea esi, [esp + 0x38]
call fcn.00434400
mov al, byte [esp + 0x5c]
test al, 1
je 0x434bff
lea esi, [esp + 0x20]
call fcn.00434400
jmp 0x434c25
cmp bl, 0x20
je 0x434c25
cmp dword [0x4a1090], 1
jne 0x434c13
lea esi, [esp + 0x20]
jmp 0x434c20
lea esi, [esp + 0x2c]
call fcn.00434460
lea esi, [esp + 0x14]
call fcn.00434460
movzx eax, byte [esp + 0x58]
push ebp
push eax
movzx esi, bl
push esi
push edi
push edi
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_capslockOn__d_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
add esp, 0x18
xor ecx, ecx
cmp byte [esp + 0x58], cl
push 0
setne cl
dec ecx
and ecx, 2
push ecx
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
lea esi, [esp + 0x14]
call fcn.004344c0
lea esi, [esp + 0x2c]
call fcn.004344c0
lea esi, [esp + 0x20]
call fcn.004344c0
lea esi, [esp + 0x38]
call fcn.004344c0
lea esi, [esp + 0x44]
call fcn.004344c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
mov edx, dword [0x4a6778]
mov ebp, dword [0x4a6760]
lea eax, [esp + 0x20]
push eax
lea ebx, [esp + 0x58]
mov dword [esp + 0x1c], edx
call fcn.00435370
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x434ccb
cmp eax, ebp
je 0x434cd0
call fcn.0045d131
mov ecx, dword [esp + 0x18]
cmp dword [esi + 4], ecx
jne 0x434ce4
push edi
push str.ignoring_unknown_keysym__d_n
jmp 0x434b23
lea edx, [esp + 0x54]
push edx
call fcn.00435270
mov bl, byte [eax]
lea eax, [esp + 0x54]
push eax
push 0x4a6780
mov byte [esp + 0x64], bl
xor edi, edi
call fcn.00435400
cmp byte [eax], 0
je 0x434d0f
mov edi, 1
cmp byte [esp + 0x58], 0
jne 0x434d4d
or edi, 2
cmp dword [0x4a1090], 1
jne 0x434e30
movzx eax, bl
sub eax, 0xa1
je 0x434e2a
sub eax, 2
je 0x434e26
sub eax, 2
jne 0x434e30
mov bl, 0x12
jmp 0x434e2c
cmp bl, 0x2e
jne 0x434d19
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
je 0x434d19
push 0x12
call esi
mov edx, 0x8000
test dx, ax
je 0x434d19
cmp dword [0x4a1090], 2
jne 0x434d19
push str.CAD_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
cmp dword [0x4a1088], 6
mov ecx, 9
mov eax, 0x48b3f0
jb 0x434e0a
cmp dword [0x4a6728], 0
je 0x434de6
push str.Vista_and_runnning_as_system____CAD_n
call fcn.00401000
add esp, 4
lea eax, [esp + 0x58]
push eax
push 0
push 0
push 0x40d680
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push str.Vista_and_runnning_as_user____Taskmgr_n
call fcn.00401000
add esp, 4
push 1
push str.taskmgr.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push str.Not_Vista__use_old_method_n
call fcn.00401000
add esp, 4
call fcn.00448590
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
mov bl, 0x11
jmp 0x434e2c
mov bl, 0x10
mov byte [esp + 0x5c], bl
push 0
push edi
movzx ecx, bl
push 0
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, dword [esp + 0x64]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc