Function at 0x459340
Capabilities:
Create process on windows
Create thread
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push dword [ebp + 8]
push str._keysym_0x_x
push 8
push 0x4f6c50
call fcn.00414f90
mov esi, dword [ebp + 8]
add esp, 0x10
lea eax, [esi - 0xfe50]
cmp eax, 0x10
ja 0x459391
push str.__DEAD_KEY
push 8
push 0x4f6c50
mov dword [0x4f9148], esi
call fcn.00414f90
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x20
jb 0x45939b
cmp esi, 0x7e
jbe 0x4593aa
lea eax, [esi - 0xa0]
cmp eax, 0x5f
ja 0x459a7d
mov eax, dword [0x4f9148]
test eax, eax
je 0x45969f
cmp byte [ebp + 0xc], 0
je 0x45969f
push esi
push eax
push str._Compose_dead_0x_x_0x_x
push 8
push 0x4f6c50
call fcn.00414f90
mov eax, dword [0x4f9148]
add esp, 0x14
add eax, 0xffff01b0
cmp eax, 0xb
ja case.0x4593ea.65108
jmp dword [eax*4 + 0x459c30]
mov ecx, dword [ebp + 8]
lea eax, [ecx - 0x41]
cmp eax, 0x34
ja case.0x459403.66
movzx eax, byte [eax + 0x459c8c]
jmp dword [eax*4 + 0x459c60]
mov ecx, 0xc0
mov dword [ebp + 8], ecx
jmp case.0x459403.66
mov ecx, 0xc8
mov dword [ebp + 8], ecx
jmp case.0x459403.66
mov ecx, 0xcc
mov dword [ebp + 8], ecx
jmp case.0x459403.66
mov ecx, 0xd2
mov dword [ebp + 8], ecx
jmp case.0x459403.66
mov ecx, 0xd9
mov dword [ebp + 8], ecx
jmp case.0x459403.66
mov ecx, 0xe0
mov dword [ebp + 8], ecx
jmp case.0x459403.66
mov ecx, 0xe8
mov dword [ebp + 8], ecx
jmp case.0x459403.66
mov ecx, 0xec
mov dword [ebp + 8], ecx
jmp case.0x459403.66
mov ecx, 0xf2
mov dword [ebp + 8], ecx
jmp case.0x459403.66
mov ecx, 0xf9
mov dword [ebp + 8], ecx
jmp case.0x459403.66
mov ecx, dword [ebp + 8]
lea eax, [ecx - 0x41]
cmp eax, 0x38
ja case.0x459484.66
movzx eax, byte [eax + 0x459cf8]
jmp dword [eax*4 + 0x459cc4]
mov ecx, 0xc1
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xc9
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xcd
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xd3
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xda
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xe1
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xe9
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xed
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xf3
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xfa
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xfd
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, 0xdd
mov dword [ebp + 8], ecx
jmp case.0x459484.66
mov ecx, dword [ebp + 8]
lea eax, [ecx - 0x41]
cmp eax, 0x34
ja case.0x459515.66
movzx eax, byte [eax + 0x459d60]
jmp dword [eax*4 + 0x459d34]
mov ecx, 0xc2
mov dword [ebp + 8], ecx
jmp case.0x459515.66
mov ecx, 0xca
mov dword [ebp + 8], ecx
jmp case.0x459515.66
mov ecx, 0xce
mov dword [ebp + 8], ecx
jmp case.0x459515.66
mov ecx, 0xd4
mov dword [ebp + 8], ecx
jmp case.0x459515.66
mov ecx, 0xdb
mov dword [ebp + 8], ecx
jmp case.0x459515.66
mov ecx, 0xe2
mov dword [ebp + 8], ecx
jmp case.0x459515.66
mov ecx, 0xea
mov dword [ebp + 8], ecx
jmp case.0x459515.66
mov ecx, 0xee
mov dword [ebp + 8], ecx
jmp case.0x459515.66
mov ecx, 0xf4
mov dword [ebp + 8], ecx
jmp case.0x459515.66
mov ecx, 0xfb
mov dword [ebp + 8], ecx
jmp case.0x459515.66
mov ecx, dword [ebp + 8]
lea eax, [ecx - 0x41]
cmp eax, 0x2e
ja case.0x459592.66
movzx eax, byte [eax + 0x459db0]
jmp dword [eax*4 + 0x459d98]
mov ecx, 0xd1
mov dword [ebp + 8], ecx
jmp case.0x459592.66
mov ecx, 0xd5
mov dword [ebp + 8], ecx
jmp case.0x459592.66
mov ecx, 0xe3
mov dword [ebp + 8], ecx
jmp case.0x459592.66
mov ecx, 0xf1
mov dword [ebp + 8], ecx
jmp case.0x459592.66
mov ecx, 0xf5
mov dword [ebp + 8], ecx
jmp case.0x459592.66
mov ecx, dword [ebp + 8]
lea eax, [ecx - 0x41]
cmp eax, 0x38
ja case.0x4595e1.66
movzx eax, byte [eax + 0x459e10]
jmp dword [eax*4 + 0x459de0]
mov ecx, 0xc4
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xcb
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xcf
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xd6
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xdc
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xe4
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xeb
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xef
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xf6
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xfc
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xff
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, dword [ebp + 8]
cmp ecx, 0x43
je 0x459670
cmp ecx, 0x63
jne 0x45967d
mov ecx, 0xe7
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, 0xc7
mov dword [ebp + 8], ecx
jmp 0x45967d
mov ecx, dword [ebp + 8]
push ecx
push str._Composed_0x_x
push 8
push 0x4f6c50
mov dword [0x4f9148], 0
call fcn.00414f90
mov esi, dword [ebp + 8]
add esp, 0x10
push esi
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp byte [ebp + 0x10], 0
movzx ebx, ax
je 0x4596d9
mov eax, dword [ebp + 8]
cmp eax, 0x4a6
jne 0x4596c0
mov ebx, 0x130
jmp 0x4596d9
cmp eax, 0x5c
jne 0x4596cc
mov ebx, 0xe2
jmp 0x4596d9
cmp eax, 0xa5
mov ecx, 0xdc
cmove ebx, ecx
movsx eax, bx
push eax
push str._SHORT_s__i
push 8
push 0x4f6c50
mov dword [ebp + 0x10], eax
call fcn.00414f90
add esp, 0x10
cmp bx, 0xffff
jne 0x459930
cmp byte [ebp + 0xc], 0
je 0x459c27
push str.down
push 8
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
push str._Found_key
push 8
push 0x4f6c50
call fcn.00414f90
mov ebx, dword [ebp + 8]
add esp, 0xc
cmp ebx, 0xff
jg 0x459912
mov eax, 0x51eb851f
mov dword [ebp - 0x28], 0x10
imul ebx
mov dword [ebp - 0x24], 0
sar edx, 5
mov eax, edx
mov word [ebp - 0x20], 0
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x1c], 0xa0
mov dword [ebp + 0xc], eax
imul eax, eax, 0x64
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xa1
mov dword [ebp - 0xc], 0
sub ebx, eax
mov word [ebp - 8], 0
mov eax, 0x66666667
imul ebx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov al, cl
mov dword [ebp + 0x10], ecx
shl al, 2
add cl, al
add cl, cl
sub bl, cl
cmp dword [0x4fd48c], 1
mov dword [ebp - 4], ebx
jne 0x4597c4
lea ecx, [ebp - 0x28]
jmp 0x4597cf
lea ecx, [ebp - 0x1c]
call fcn.00458fc0
lea ecx, [ebp - 0x10]
call fcn.00458fc0
mov eax, dword [ebp + 0x10]
movzx ebx, bl
push ebx
movzx edi, al
mov eax, dword [ebp + 0xc]
push edi
movzx esi, al
push esi
push str._Simulating_ALT_d_d_d_n
push 8
push 0x4f6c50
call fcn.00414f90
add esp, 0x14
push 0
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, 0x12
call fcn.004273d0
add esp, 4
push 0
push 0
push 0x60
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, 0x60
call fcn.004273d0
add esp, 4
push 2
push 0
push 0x60
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, 0x60
call fcn.004273d0
add byte [ebp + 0xc], 0x60
add esp, 4
add esi, 0x60
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, dword [ebp + 0xc]
mov dl, al
call fcn.004273d0
add esp, 4
push 2
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov cl, byte [ebp + 0xc]
mov dl, al
call fcn.004273d0
add byte [ebp + 0x10], 0x60
lea esi, [edi + 0x60]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
add esp, 4
push 0
push 0
push esi
call edi
mov ecx, dword [ebp + 0x10]
mov dl, al
call fcn.004273d0
add esp, 4
push 2
push 0
push esi
call edi
mov cl, byte [ebp + 0x10]
mov dl, al
call fcn.004273d0
lea esi, [ebx + 0x60]
mov ebx, dword [ebp - 4]
add bl, 0x60
add esp, 4
push 0
push 0
push esi
call edi
mov dl, al
mov cl, bl
call fcn.004273d0
add esp, 4
push 2
push 0
push esi
call edi
mov dl, al
mov cl, bl
call fcn.004273d0
add esp, 4
push 2
push 0
push 0x12
call edi
mov dl, al
mov cl, 0x12
call fcn.004273d0
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.00459020
lea ecx, [ebp - 0x1c]
call fcn.00459020
lea ecx, [ebp - 0x28]
call fcn.00459020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push ebx
push str.ignoring_unrecognised_Latin_1_keysym_0x_x
push 8
push 0x4f6c50
call fcn.00414f90
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov di, ax
mov eax, dword [ebp + 0x10]
shr eax, 8
mov dword [ebp + 0x10], eax
and edi, 1
je 0x45994e
xor al, 1
mov dword [ebp + 0x10], eax
cmp byte [ebp + 0xc], 0
mov dword [ebp - 0x40], 0x11
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x38], 0
mov dword [ebp - 0x34], 0x12
mov dword [ebp - 0x30], 0
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0
mov word [ebp - 8], 0
mov dword [ebp - 0x1c], 0xa0
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov dword [ebp - 0x28], 0xa1
mov dword [ebp - 0x24], 0
mov word [ebp - 0x20], 0
je 0x459a07
test al, 2
je 0x4599c7
lea ecx, [ebp - 0x40]
call fcn.00458f70
mov eax, dword [ebp + 0x10]
test al, 4
je 0x4599d6
lea ecx, [ebp - 0x34]
call fcn.00458f70
mov eax, dword [ebp + 0x10]
test al, 1
je 0x4599e4
lea ecx, [ebp - 0x10]
call fcn.00458f70
jmp 0x459a07
cmp bl, 0x20
je 0x459a07
cmp dword [0x4fd48c], 1
jne 0x4599f7
lea ecx, [ebp - 0x10]
jmp 0x459a02
lea ecx, [ebp - 0x1c]
call fcn.00458fc0
lea ecx, [ebp - 0x28]
call fcn.00458fc0
movzx eax, byte [ebp + 0xc]
push edi
push eax
mov eax, dword [ebp + 8]
movzx esi, bl
push esi
push eax
push eax
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_capslockOn__d_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0x1c
xor ecx, ecx
cmp byte [ebp + 0xc], cl
mov eax, 2
cmovne eax, ecx
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, bl
call fcn.004273d0
add esp, 8
lea ecx, [ebp - 0x28]
call fcn.00459020
lea ecx, [ebp - 0x1c]
call fcn.00459020
lea ecx, [ebp - 0x10]
call fcn.00459020
lea ecx, [ebp - 0x34]
call fcn.00459020
lea ecx, [ebp - 0x40]
call fcn.00459020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.00459fc0
mov eax, dword [eax]
cmp eax, dword [0x503c2c]
jne 0x459ab2
push esi
push str.ignoring_unknown_keysym__d_n
push 8
push 0x4f6c50
call fcn.00414f90
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp + 8]
mov ecx, 0x503c2c
push eax
call fcn.00459f40
mov ecx, 0x503c34
xor esi, esi
mov bl, byte [eax]
lea eax, [ebp + 8]
push eax
call fcn.0045a020
mov ecx, 1
cmp byte [eax], 0
cmovne esi, ecx
cmp byte [ebp + 0xc], 0
jne 0x459b1a
or esi, 2
cmp dword [0x4fd48c], 1
jne 0x459c0d
movzx eax, bl
sub eax, 0xa1
je 0x459c0b
sub eax, 2
je 0x459c07
sub eax, 2
jne 0x459c0d
mov bl, 0x12
jmp 0x459c0d
cmp bl, 0x2e
jne 0x459ae6
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x459ae6
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x459ae6
cmp dword [0x4fd48c], 2
jne 0x459ae6
push str.CAD_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
cmp dword [0x4fd484], 6
jb 0x459bb2
cmp dword [0x501498], 0
je 0x459bab
push str.Vista_and_runnning_as_system____CAD_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push 0x4298f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Vista_and_runnning_as_user____Taskmgr_n
jmp 0x459be2
cmp dword [0x501498], 0
je 0x459bdd
push str.Not_Vista_and_runnning_as_system__use_old_method_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
call fcn.00470750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Not_Vista_and_runnning_as_user____Taskmgr_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
push 1
push str.taskmgr.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov bl, 0x11
jmp 0x459c0d
mov bl, 0x10
push ecx
push esi
push 0
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, bl
call fcn.004273d0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc