Function at 0x43db20
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x120
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x130]
push ebx
mov bl, byte [esp + 0x12c]
mov dword [esp + 0x14], eax
push ebp
mov ebp, dword [esp + 0x134]
movzx eax, bl
or ax, bp
mov byte [esp + 0xc], bl
je 0x43e1ba
mov eax, dword [esp + 0x140]
mov ecx, 0xffc3d44d
test eax, eax
push esi
mov esi, dword fs:[0x2c]
cmovne ecx, eax
mov eax, dword [0x62271c]
push edi
mov dword [esp + 0x1c], ecx
lea edi, [eax*4]
mov eax, dword [edi + esi]
cmp byte [eax + 0x2198], 0
jne 0x43dba1
call fcn.004ebad3
mov esi, dword fs:[0x2c]
mov esi, dword [edi + esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [esi + 0x290]
mov eax, dword [esi + 0x8f0]
sete bh
mov byte [esp + 0x12], bh
test eax, eax
je 0x43dbca
mov byte [esp + 0x11], 1
test bh, bh
je 0x43dbcf
mov byte [esp + 0x11], 0
cmp eax, 1
je 0x43dbd8
test bh, bh
je 0x43dbe0
mov byte [esp + 0x144], 0
test bl, bl
jne 0x43dc38
push ebp
call fcn.00443f20
mov ecx, dword [esp + 0x140]
mov bl, al
add esp, 4
mov byte [esp + 0x14], bl
mov esi, dword [esp + 0x14]
xor edx, edx
mov byte [esp + 0x28], cl
mov eax, ecx
shr eax, 8
test al, al
mov eax, dword fs:[0x2c]
setne dl
mov dword [esp + 0x24], edx
mov edx, dword [edi + eax]
cmp dword [edx + 0x8f0], 2
jne case.default.0x43dc31
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x43dc31
jmp dword [eax*4 + 0x43e1d4]
mov ecx, dword [esp + 0x13c]
test cx, cx
jne 0x43dbfa
mov esi, dword [esp + 0x14]
push 0
push esi
call fcn.00443f60
movzx ecx, ax
add esp, 8
mov dword [esp + 0x13c], ecx
jmp 0x43dbfe
mov bl, 0x11
jmp 0x43dc69
mov bl, 0x10
jmp 0x43dc69
mov bl, 0x12
mov byte [esp + 0x14], bl
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x20], 0
je 0x43ddd6
push 0
push ecx
push esi
call fcn.0043e280
mov ebp, dword [esp + 0x140]
add esp, 0xc
test al, al
je 0x43dd40
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test ebp, ebp
jne 0x43dcb0
movzx eax, bl
or byte [esp + eax + 0x2c], 0x80
jmp 0x43dcbd
cmp ebp, 1
jne 0x43dcbd
movzx eax, bl
and byte [esp + eax + 0x2c], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x43dcca
jmp dword [eax*4 + 0x43e1ec]
test byte [esp + 0xce], 0x80
jne 0x43dcec
test byte [esp + 0xcf], 0x80
jne 0x43dcec
and byte [esp + 0x3d], 0x7f
jmp case.default.0x43dcca
or byte [esp + 0x3d], 0x80
jmp case.default.0x43dcca
test byte [esp + 0xcc], 0x80
jne 0x43dd0e
test byte [esp + 0xcd], 0x80
jne 0x43dd0e
and byte [esp + 0x3c], 0x7f
jmp case.default.0x43dcca
or byte [esp + 0x3c], 0x80
jmp case.default.0x43dcca
test byte [esp + 0xd0], 0x80
jne 0x43dd30
test byte [esp + 0xd1], 0x80
jne 0x43dd30
and byte [esp + 0x3e], 0x7f
jmp case.default.0x43dcca
or byte [esp + 0x3e], 0x80
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov eax, dword [esp + 0x13c]
movzx esi, ax
shl esi, 0x10
cmp ebp, 1
je 0x43dd6b
mov eax, esi
or eax, 1
push eax
movzx eax, bl
push eax
push 0x100
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp byte [esp + 0x144], 0
je 0x43ddaf
cmp ebp, 2
jne 0x43ddaf
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x43dd99
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
mov eax, dword [eax + 0x29c]
push dword [eax + 0x74]
call fcn.0043d2b0
add esp, 4
jmp 0x43ddb7
test ebp, ebp
je 0x43e155
or esi, 0xc0000001
movzx eax, bl
push esi
push eax
push 0x101
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x43e155
cmp byte [edx + 0x2198], 0
mov eax, dword [esp + 0x134]
mov dword [edx + 0x924], eax
mov byte [edx + 0x8f7], bl
jne 0x43ddf7
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp byte [eax + 0x121], 0
je 0x43def5
cmp bl, 0x12
je 0x43de20
cmp bl, 0xa4
je 0x43de20
cmp bl, 0xa5
jne 0x43def5
test bh, bh
jne 0x43def5
push 0
mov byte [esp + 0x1f], 1
call fcn.0046cee0
add esp, 4
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
mov eax, dword [eax + 0x900]
cmp bl, 0xa5
mov dword [esp + 0x14], eax
mov bl, byte [esp + 0x11]
jne 0x43df1c
test eax, eax
je 0x43df1c
test bl, bl
jne 0x43df1c
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp byte [eax + 0x2198], bl
jne 0x43de7d
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp dword [eax + 0x1f4], 0
je 0x43df1c
mov byte [esp + 0x13], 1
mov ebx, dword [esp + 0x13c]
mov byte [esp + 0x20], 0
cmp byte [esp + 0x12], 0
jne 0x43df45
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp dword [eax + 0x8f0], 2
je 0x43df45
cmp byte [eax + 0x2198], 0
jne 0x43ded3
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp dword [eax + 0x1f4], 0
je 0x43deee
cmp dword [eax + 0x8f0], 1
jne 0x43df45
mov byte [esp + 0x12], 1
jmp 0x43df4a
mov byte [esp + 0x1b], 0
test bh, bh
je 0x43de37
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.0043d670
push eax
call fcn.0043e410
add esp, 8
jmp 0x43de46
mov byte [esp + 0x13], 0
test bl, bl
je 0x43de98
mov ebx, dword [esp + 0x13c]
push 0
push ebx
push esi
call fcn.0043e280
add esp, 0xc
mov byte [esp + 0x20], al
jmp 0x43dea4
mov byte [esp + 0x12], 0
mov eax, dword [esp + 0x134]
mov ebp, dword [esp + 0x20]
cmp eax, 1
je 0x43e002
cmp byte [esp + 0x11], 0
je 0x43df7a
push dword [esp + 0x1c]
push dword [esp + 0x28]
push ebx
push esi
push ebp
call fcn.0043fb60
add esp, 0x14
jmp 0x43dfe8
cmp byte [esp + 0x13], 0
je 0x43dfab
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp byte [eax + 0x2198], 0
jne 0x43df98
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + eax]
mov dword [eax + 0x200], edx
push dword [esp + 0x1c]
push dword [esp + 0x28]
push dword [esp + 0x30]
push esi
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp byte [eax + 0x2198], 0
jne 0x43dfd5
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
mov dword [eax + 0x200], 0
cmp byte [esp + 0x12], 0
je 0x43dffb
push ebx
push esi
push 0
call fcn.004438f0
add esp, 0xc
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x144], 0
je 0x43e075
cmp eax, 2
jne 0x43e075
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp dword [eax + 0x8f0], 2
mov cl, byte [eax + 0x2198]
jne 0x43e04f
test cl, cl
jne 0x43e032
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
mov eax, dword [eax + 0x29c]
mov eax, dword [eax + 0x78]
push eax
call fcn.0043d2b0
add esp, 4
jmp 0x43e07d
test cl, cl
jne 0x43e058
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
mov eax, dword [eax + 0x29c]
mov eax, dword [eax + 0x74]
push eax
call fcn.0043d2b0
add esp, 4
jmp 0x43e07d
test eax, eax
je 0x43e144
mov ecx, dword [esp + 0x24]
or ecx, 2
cmp byte [esp + 0x11], 0
mov dword [esp + 0x24], ecx
je 0x43e0a1
push dword [esp + 0x1c]
push ecx
push ebx
push esi
push ebp
call fcn.0043fb60
add esp, 0x14
jmp 0x43e110
cmp byte [esp + 0x13], 0
je 0x43e0d6
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp byte [eax + 0x2198], 0
jne 0x43e0c3
call fcn.004ebad3
mov ecx, dword [esp + 0x24]
mov eax, dword fs:[0x2c]
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + eax]
mov dword [eax + 0x200], edx
push dword [esp + 0x1c]
push ecx
push dword [esp + 0x30]
push esi
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp byte [eax + 0x2198], 0
jne 0x43e0fd
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
mov dword [eax + 0x200], 0
cmp dword [esp + 0x14], 0
je 0x43e131
mov eax, 0x138
cmp bx, ax
jne 0x43e131
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
and byte [eax + 0x8f4], 0xfe
cmp byte [esp + 0x12], 0
je 0x43e144
push ebx
push esi
push 1
call fcn.004438f0
add esp, 0xc
cmp byte [esp + 0x1b], 0
je 0x43e155
push 1
call fcn.0046cee0
add esp, 4
cmp byte [esp + 0x144], 0
je 0x43e1b8
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp dword [eax + 0x8f0], 2
mov cl, byte [eax + 0x2198]
jne 0x43e194
test cl, cl
jne 0x43e180
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
mov eax, dword [eax + 0x29c]
mov eax, dword [eax + 0x70]
jmp 0x43e1af
test cl, cl
jne 0x43e19d
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
mov eax, dword [eax + 0x29c]
mov eax, dword [eax + 0x6c]
push eax
call fcn.0043d2b0
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x124]
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebadf
add esp, 0x120
ret