Function at 0x436b57
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x401d78
push 0x466fde
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov edi, 0x204
cmp eax, edi
ja 0x436dcf
je 0x436d3f
sub eax, 0x20
je 0x436d31
sub eax, 0xe0
je 0x436d11
sub eax, 0x100
je 0x436bfa
dec eax
je 0x436bbf
dec eax
je 0x436e5c
jmp 0x436fc9
cmp dword [ebx + 0x40], 0
je 0x436fc9
push 1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
shr eax, 8
test al, al
je 0x436fc9
push 2
call esi
shr eax, 8
test al, al
je 0x436fc9
lea edx, [ebx + 0x29]
mov edi, 0x40d504
jmp 0x436ec0
xor edi, edi
cmp dword [ebx + 0x50], edi
je 0x436c12
push edi
lea eax, [ebx + 0x29]
push eax
mov ecx, ebx
call fcn.004370a4
jmp 0x436fc9
cmp dword [ebx + 0x40], edi
je 0x436fc9
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
jne 0x436c32
mov dword [ebx + 0x40], edi
jmp 0x436fc9
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
mov dword [ebp - 0x20], ecx
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.00437025
test eax, eax
je 0x436fc9
push dword [ebp - 0x24]
mov ecx, ebx
call fcn.00436fdc
cmp dword [ebx + 0x3c], edi
jne 0x436ca0
lea esi, [ebx + 0x29]
and byte [esi], 0
mov edx, dword [ebx + 0x34]
cmp dword [ebx + 0x38], edx
je 0x436c90
mov al, byte [ebx + edx + 0x24]
mov byte [esi + edi], al
inc edi
and byte [esi + edi], 0
lea eax, [edx + 1]
cdq
idiv dword [ebx + 0x30]
jmp 0x436c76
test edi, edi
jle 0x436c9e
push 0
push esi
mov ecx, ebx
call fcn.004370a4
xor edi, edi
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x20], eax
cmp dword [ebx + 0x3c], edi
je 0x436fc9
mov al, byte [ebp - 0x24]
cmp al, 0x55
jne 0x436cc4
push edi
push 0x7950
jmp 0x436ce6
cmp al, 0x44
jne 0x436cd0
push edi
push 0x7951
jmp 0x436ce6
cmp al, 0x4c
jne 0x436cdc
push edi
push 0x7952
jmp 0x436ce6
cmp al, 0x52
jne 0x436cf7
push edi
push 0x7953
push 0x111
push dword [0x46bb6c]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov ecx, ebx
call fcn.0043768d
mov ecx, ebx
call fcn.004374c1
jmp 0x436dc7
cmp dword [ebp + 0x10], 0x1b
jne 0x436fc9
cmp dword [ebx + 0x40], 0
je 0x436fc9
mov ecx, ebx
call fcn.00437270
jmp 0x436dc7
xor eax, eax
cmp dword [ebx + 8], 0xffffffff
setne al
jmp 0x436fcb
mov esi, dword [0x487394]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [ebx + 0x40], 1
xor edi, edi
mov dword [ebx + 0x3c], edi
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
mov dword [ebx + 0x1c], ecx
shr eax, 0x10
movsx eax, ax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x38], edi
mov ecx, esi
call fcn.0044a116
cmp eax, edi
je 0x436fc9
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], edi
mov ecx, dword [eax]
lea edx, [ebp - 0x4c]
push edx
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x4c]
cmp eax, edi
je 0x436fc9
mov ecx, dword [eax]
lea edx, [ebp - 0x50]
push edx
push str._D_3
push eax
call dword [ecx]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x50]
cmp eax, edi
je 0x436fc9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 1
pop eax
jmp 0x436fcb
sub eax, 0x205
je 0x436ef3
dec eax
dec eax
je 0x436e8a
dec eax
je 0x436e5c
dec eax
dec eax
jne 0x436fc9
cmp dword [ebx + 0x40], 0
je 0x436fc9
mov dword [ebx + 0x44], 1
mov eax, dword [ebp + 0x10]
shr eax, 0x10
test ax, ax
lea edx, [ebx + 0x29]
mov edi, 0x40d500
jg 0x436e16
mov edi, 0x40d4fc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea eax, [ebx + 0x29]
push eax
mov ecx, ebx
call fcn.004370a4
test eax, eax
je 0x436e4a
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 1
lea eax, [ebx + 0x29]
push eax
mov ecx, ebx
call fcn.004370a4
jmp 0x436dc7
cmp dword [ebx + 0x50], 0
je 0x436fc9
and dword [ebx + 0x50], 0
push 1
pop esi
push esi
lea eax, [ebx + 0x29]
push eax
mov ecx, ebx
call fcn.004370a4
mov ecx, ebx
call fcn.004372ed
mov dword [ebx + 0x4c], esi
mov eax, esi
jmp 0x436fcb
cmp dword [ebx + 0x40], 0
je 0x436fc9
push 4
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
shr eax, 8
test al, al
je 0x436fc9
push 2
call esi
shr eax, 8
test al, al
je 0x436fc9
lea edx, [ebx + 0x29]
mov edi, 0x40d4f8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push edx
mov ecx, ebx
call fcn.004370a4
mov dword [ebx + 0x50], 1
jmp 0x436fc9
xor esi, esi
cmp dword [ebx + 0x4c], esi
je 0x436f14
mov dword [ebx + 0x4c], esi
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0xbb8
mov ecx, ebx
call fcn.00437319
jmp 0x436dc7
cmp dword [ebx + 0x40], esi
je 0x436fc9
mov dword [ebp - 4], esi
mov dword [ebx + 0x40], esi
or dword [ebx + 8], 0xffffffff
mov ecx, ebx
call fcn.004372ed
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp dword [ebx + 0x44], esi
je 0x436f3e
mov dword [ebx + 0x44], esi
jmp 0x436f9f
cmp dword [ebx + 0x3c], esi
je 0x436f64
mov dword [ebx + 0x3c], esi
cmp dword [ebx + 0x48], esi
je 0x436f50
mov dword [ebx + 0x48], esi
jmp 0x436f9f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x436fa2
mov dword [ebp - 0x3c], esi
lea ecx, [ebx + 0x29]
and byte [ecx], 0
mov edi, dword [ebx + 0x34]
cmp dword [ebx + 0x38], edi
je 0x436f91
mov al, byte [edi + ebx + 0x24]
mov byte [ecx + esi], al
inc esi
mov dword [ebp - 0x3c], esi
and byte [ecx + esi], 0
mov eax, dword [ebx + 0x34]
inc eax
cdq
idiv dword [ebx + 0x30]
mov dword [ebx + 0x34], edx
jmp 0x436f6d
test esi, esi
jle 0x436fa8
push 1
push ecx
mov ecx, ebx
call fcn.004370a4
push 1
pop eax
or dword [ebp - 4], 0xffffffff
jmp 0x436fcb
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x204
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x436fc5
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10