Function at 0x438cf0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
mov word [esi], ax
movzx eax, cl
cmp eax, 0xd3
ja case.0x438d14.3
movzx edx, byte [eax + 0x43904c]
jmp dword [edx*4 + 0x438fb4]
push 0x4d2d54
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Ctrl
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.LCtrl
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.RCtrl
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push 0x4d2d28
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.LAlt
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.RAlt
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Shift
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.LShift
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.RShift
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push 0x4d2cd8
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Left
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Right
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push 0x4d2cb8
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Down
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.PgUp
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.PgDn
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Space
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push 0x4d2c80
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push 0x4d2c78
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Insert
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Delete
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Home
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push 0x4d2c44
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Pause
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Enter
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.Backspace
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push 0x4d2c10
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push 0x4d2c08
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.WheelUp
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.WheelDown
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.WheelLeft
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.WheelRight
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.LButton
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.RButton
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
push str.MButton
push 0x20
push esi
call fcn.00401880
pop esi
pop ebp
ret
mov dl, cl
sub dl, 0x70
cmp dl, 0x17
ja 0x438f7b
add eax, 0xffffff91
push eax
push 0x4d2b80
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
pop esi
pop ebp
ret
cmp cl, 0x41
jb 0x438f85
cmp cl, 0x5a
jbe 0x438f8f
mov dl, cl
sub dl, 0x30
cmp dl, 9
ja 0x438f9f
movzx ax, cl
xor ecx, ecx
mov word [esi + 2], cx
mov word [esi], ax
pop esi
pop ebp
ret
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov word [esi + 2], dx
mov word [esi], ax
pop esi
pop ebp
ret