Function at 0x437660
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x4810d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a4a28]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, edx
mov edi, dword [esp + 0x2c]
push str.CheckItemTerminateState
push str.CInstallAction
call fcn.00420ef0
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 8
push 0x12
mov dword [esp + 0x30], 0
call ebp
test ax, ax
jge 0x4376c8
push 0x11
call ebp
test ax, ax
jge 0x4376c8
mov ebp, 1
jmp 0x4376ca
xor ebp, ebp
call fcn.0042e940
test al, 1
je 0x437701
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x7f1c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test al, 2
jne 0x4376f5
test ebp, ebp
je 0x43789e
or dword [edi + 0x38], 0x110
jmp 0x437896
call fcn.0042e940
test eax, 0x800
je 0x4377f2
cmp ebx, 1
jne 0x4377cc
call fcn.00442c05
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x437734
push 0x80004005
call fcn.00402720
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ebx, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.00431970
test eax, eax
mov ebx, dword [esp + 0x18]
je 0x437796
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
push ebx
push 0
push 0x7f18
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x437796
call fcn.004378d0
test eax, eax
je 0x437789
mov dword [esp + 0x2c], 0x4d5
jmp 0x437796
cmp dword [edi + 0x1c], 3
jne 0x437796
or dword [edi + 0x38], 0x800
push 0
mov ecx, esi
call fcn.00431a50
lea eax, [ebx - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43789e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x43789e
cmp dword [edi + 0x1c], 3
jne 0x4377de
or dword [edi + 0x38], 0x800
jmp 0x43789e
test ebx, ebx
jne 0x43789e
push esi
push edi
call fcn.00437f60
jmp 0x43789e
call fcn.0042e940
test eax, 0x200
je 0x43787a
test ebp, ebp
jne 0x43789e
cmp ebx, 0xffffffff
je 0x437827
cmp ebx, 0xfffffffd
je 0x437871
cmp ebx, 0xffffff9e
je 0x437827
cmp ebx, 0xffffff9d
je 0x437827
cmp ebx, 0xfffffffa
je 0x437827
push edi
call fcn.00437dc0
jmp 0x43789e
cmp ebx, 0xfffffffd
je 0x437871
call fcn.004371a0
test eax, eax
je 0x437842
push 0x41
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x437871
cmp ebx, 0xffffff9e
je 0x437868
cmp ebx, 0xffffff9d
je 0x437868
call fcn.004371a0
test eax, eax
je 0x437862
push 0x5a
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x437868
or dword [edi + 0x38], 0x40
jmp 0x437896
or dword [edi + 0x38], 0x4000
jmp 0x437896
or dword [edi + 0x38], 0x2000
jmp 0x437896
call fcn.0042e940
test al, 0x20
je 0x43789e
test ebp, ebp
jne 0x43789e
cmp ebx, 0xbc2
jne 0x43789e
or dword [edi + 0x38], 0x120
mov dword [esp + 0x2c], 0x4c7
mov esi, dword [esp + 0x2c]
push esi
push str.CheckItemTerminateState
push str.CInstallAction
call fcn.00421170
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4