Function at 0x438b40
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4dbc31
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x521a70]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x521a70]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, ecx
lea ecx, [edi + 0x4a0]
xor esi, esi
mov dword [esp + 0x28], esi
mov eax, dword [ecx]
mov edx, dword [eax + 0xd4]
push ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ecx
call edx
test eax, eax
je 0x439285
cmp dword [edi + 0x828], esi
jne 0x439285
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov dword [0x519ad4], esi
mov dword [0x519adc], esi
mov dword [esp + 0x20], ecx
call dword [0x521964]
push 0x103
lea edx, [esp + 0x131]
push esi
push edx
mov byte [esp + 0x138], 0
call fcn.004ba350
add esp, 0xc
cmp dword [ebx + 0x98], 0x10
jb 0x438c0d
mov ecx, dword [ebx + 0x84]
jmp 0x438c13
lea ecx, [ebx + 0x84]
lea edx, [esp + 0x12c]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x438c20
lea ecx, [ebx + 0x38]
mov edx, 0x4e9a2d
lea esi, [esp + 0xbc]
call fcn.0042b900
mov eax, dword [esp + 0xc0]
mov esi, 0x10
cmp dword [esp + 0xd4], esi
mov dword [esp + 0x248], 0
jae 0x438c69
lea eax, [esp + 0xc0]
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x7c]
mov ecx, edi
call eax
test eax, eax
je 0x43926c
push str.Please_select_a_folder_for_the_
lea ecx, [esp + 0xdc]
call fcn.004023f0
mov edx, dword [edi + 4]
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x12c]
push 0xffffffffffffffff
mov ecx, eax
mov dword [esp + 0x40], edx
push 0
lea edx, [esp + 0xc4]
mov dword [esp + 0x4c], ecx
push edx
lea ecx, [esp + 0xe4]
mov byte [esp + 0x254], 1
mov dword [esp + 0x58], 0x40
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], 0x421f50
call fcn.00402050
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x1c]
lea esi, [edi + 0xa60]
push ecx
mov ecx, esi
call fcn.00426ed0
cmp dword [esp + 0x20], 0
je 0x438df5
mov edx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], esi
call fcn.00422af0
test al, al
je 0x438df5
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00424a80
mov ecx, eax
add ecx, 0x1c
call fcn.0040f6a0
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x18], 0
jne 0x438d64
call fcn.004bb053
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp edx, dword [eax + 4]
jne 0x438d76
call fcn.004bb053
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x30]
add ecx, 0x28
cmp dword [ecx + 4], eax
mov dword [esp + 0x10], eax
jbe 0x438d8e
call fcn.004bb053
test esi, esi
je 0x438d9d
mov eax, dword [esp + 0x1c]
add eax, 0x28
cmp esi, eax
je 0x438da2
call fcn.004bb053
cmp ebx, dword [esp + 0x10]
je 0x438df1
push 1
push 0x4ebf50
lea ecx, [esp + 0xe0]
call fcn.00402300
test esi, esi
jne 0x438dc4
call fcn.004bb053
cmp ebx, dword [esi + 8]
jb 0x438dce
call fcn.004bb053
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [esp + 0xe4]
call fcn.00402050
cmp ebx, dword [esi + 8]
jb 0x438de9
call fcn.004bb053
add ebx, 0x1c
jmp 0x438d58
mov ebx, dword [esp + 0x30]
push 6
push str._pack
lea ecx, [esp + 0xe0]
call fcn.00402300
mov esi, 0x10
cmp dword [esp + 0xf0], esi
jb 0x438e23
mov ecx, dword [esp + 0xdc]
mov dword [esp + 0x48], ecx
jmp 0x438e2e
lea edx, [esp + 0xdc]
mov dword [esp + 0x48], edx
lea ecx, [esp + 0x80]
call fcn.00415460
mov eax, dword [esp + 0xb0]
test eax, eax
mov byte [esp + 0x248], 2
je 0x439221
cmp dword [esp + 0xb4], 0
je 0x439221
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
je 0x439221
lea edx, [esp + 0x12c]
push edx
push eax
call dword [esp + 0xbc]
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0xf8]
call fcn.004023f0
cmp dword [esp + 0x108], 0
mov byte [esp + 0x248], 3
jne 0x438f69
call dword [0x521964]
cmp dword [esp + 0xd4], esi
mov eax, dword [esp + 0xc0]
jae 0x438ec5
lea eax, [esp + 0xc0]
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0xa0]
mov ecx, edi
call eax
test eax, eax
je 0x438ef3
mov edx, dword [edi]
mov edx, dword [edx + 0x78]
lea eax, [esp + 0x5c]
push eax
mov ecx, edi
call edx
mov byte [esp + 0x248], 4
mov ebx, 1
jmp 0x438f14
mov eax, dword [edi]
mov edx, dword [eax + 0x74]
lea ecx, [esp + 0x110]
push ecx
mov ecx, edi
call edx
mov dword [esp + 0x248], 5
mov ebx, 2
cmp dword [eax + 0x18], 0x10
mov dword [esp + 0x28], ebx
jb 0x438f23
mov eax, dword [eax + 4]
jmp 0x438f26
add eax, 4
push eax
lea ecx, [esp + 0xf8]
call fcn.00409030
test bl, 2
je 0x438f47
lea ecx, [esp + 0x110]
and ebx, 0xfffffffd
call fcn.0046f4f0
test bl, 1
mov dword [esp + 0x248], 3
je 0x438f60
lea ecx, [esp + 0x5c]
call fcn.0046f4f0
mov ebx, dword [esp + 0x30]
mov esi, 0x10
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xfc]
push eax
lea ecx, [ebx + 0x80]
call fcn.00402150
mov edx, dword [edi]
mov edx, dword [edx + 0xe0]
lea eax, [esp + 0xf4]
push eax
lea ecx, [esp + 0xc0]
push ecx
lea eax, [esp + 0x64]
push eax
mov ecx, edi
call edx
cmp dword [eax + 0x18], esi
mov byte [esp + 0x248], 6
jb 0x438fb3
mov eax, dword [eax + 4]
jmp 0x438fb6
add eax, 4
mov edx, dword [ebx]
push eax
mov eax, dword [edx]
mov ecx, ebx
call eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x248], 3
call fcn.0046f4f0
lea edx, [esp + 0xbc]
lea ecx, [edi + 0xa48]
push edx
call fcn.004130b0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xfc]
push ecx
mov ecx, eax
call fcn.00402150
mov ecx, dword [edi + 0xa44]
lea edx, [esp + 0xbc]
push edx
add ecx, 4
call fcn.004130b0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xfc]
push ecx
mov ecx, eax
call fcn.00402150
cmp dword [esp + 0x20], 0
je 0x4391fd
mov edx, dword [edi + 0xa64]
lea eax, [edi + 0xa60]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edx
call fcn.00422af0
test al, al
je 0x4391fd
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00424a80
mov ecx, eax
add ecx, 0x1c
call fcn.0040f6a0
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x1c]
call fcn.00424a80
mov ecx, eax
add ecx, 0x1c
call fcn.00462ec0
push eax
lea ecx, [esp + 0x14]
call fcn.00422af0
test al, al
je 0x4391fd
lea ebx, [edi + 0x2bb8]
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x10]
call fcn.0040ecd0
push eax
lea ecx, [esp + 0x114]
call fcn.00408d20
lea eax, [esp + 0x110]
push eax
lea ecx, [edi + 0xa48]
mov byte [esp + 0x24c], 7
call fcn.004130b0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xfc]
push ecx
mov ecx, eax
call fcn.00402150
mov ecx, dword [edi + 0xa44]
lea edx, [esp + 0x110]
push edx
add ecx, 4
call fcn.004130b0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xfc]
push ecx
mov ecx, eax
call fcn.00402150
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x2c]
push eax
mov ecx, ebx
call fcn.00463a40
mov ecx, dword [ebx + 4]
lea edx, [esp + 0x20]
mov dword [esp + 0x24], ecx
push edx
lea ecx, [esp + 0x2c]
call fcn.00422af0
test al, al
je 0x4391aa
lea ecx, [esp + 0x28]
call fcn.00424a80
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x4391aa
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xfc]
push eax
lea ecx, [esi + 0x80]
call fcn.00402150
mov edx, dword [edi]
mov edx, dword [edx + 0xe0]
lea eax, [esp + 0xf4]
push eax
lea ecx, [esp + 0x114]
push ecx
lea eax, [esp + 0x64]
push eax
mov ecx, edi
call edx
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x248], 8
jb 0x439195
mov eax, dword [eax + 4]
jmp 0x439198
add eax, 4
mov edx, dword [esi]
push eax
mov eax, dword [edx]
mov ecx, esi
call eax
lea ecx, [esp + 0x5c]
call fcn.0046f4f0
lea ecx, [esp + 0x110]
mov byte [esp + 0x248], 3
call fcn.0046f4f0
push 0
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040f000
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x1c]
call fcn.00424a80
mov ecx, eax
add ecx, 0x1c
call fcn.00462ec0
push eax
lea ecx, [esp + 0x14]
call fcn.00422af0
test al, al
jne 0x4390a0
mov esi, 0x10
mov ecx, dword [edi + 0xa44]
push 0
call fcn.00436340
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
call edx
lea ecx, [esp + 0xf4]
call fcn.0046f4f0
lea ecx, [esp + 0x80]
mov byte [esp + 0x248], 1
call fcn.00415510
cmp dword [esp + 0xf0], esi
jb 0x43924e
mov eax, dword [esp + 0xdc]
push eax
call fcn.004b9684
add esp, 4
mov dword [esp + 0xf0], 0xf
mov dword [esp + 0xec], 0
mov byte [esp + 0xdc], 0
cmp dword [esp + 0xd4], esi
jb 0x439285
mov ecx, dword [esp + 0xc0]
push ecx
call fcn.004b9684
add esp, 4
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.004b9963
mov esp, ebp
pop ebp
ret 4