Function at 0x4230ec
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
mov eax, dword [0x47e5d0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x120]
push edi
mov edi, dword [esp + 0x120]
push esi
call ebx
lea ecx, [eax + 1]
mov eax, 0xff
cmp ecx, eax
jg 0x42312b
push esi
call ebx
inc eax
push eax
push esi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor ebx, ebx
push ebx
push ebx
push 0x464a50
mov ebp, 0x468d40
push ebp
lea eax, [esp + 0x28]
push eax
call fcn.0044923e
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSystemMenu]
test eax, eax
jne 0x423161
mov byte [esp + 0x18], bl
lea eax, [esp + 0x18]
push 0x468d68
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x423181
push ebx
push 0xf030
jmp 0x423210
lea eax, [esp + 0x18]
push 0x468d64
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42319e
push ebx
push 0xf020
jmp 0x423210
lea eax, [esp + 0x18]
push str.restore
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4231bb
push ebx
push 0xf120
jmp 0x423210
lea eax, [esp + 0x18]
push str.move
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4231d8
push ebx
push 0xf010
jmp 0x423210
lea eax, [esp + 0x18]
push str.close
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4231f5
push ebx
push 0xf060
jmp 0x423210
lea eax, [esp + 0x18]
push str.size
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x423221
push ebx
push 0xf000
push 0x112
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x423415
cmp esi, ebx
je 0x423230
push ebp
push esi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x423232
xor eax, eax
cmp eax, ebx
je 0x423415
push ebx
push edi
call fcn.0044a2f8
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
push ebx
push ebx
push 0x12
call edi
mov ebp, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call ebp
push ebx
push ebx
push ebx
push 0x20
call edi
push eax
push 0x20
call ebp
push ebx
push 2
push ebx
push 0x20
call edi
push eax
push 0x20
call ebp
push ebx
push 2
push ebx
push 0x12
call edi
push eax
push 0x12
call ebp
cmp esi, ebx
je 0x423292
push 0x468d40
push esi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x423294
xor eax, eax
cmp byte [eax + 1], 0x41
jl 0x4232b5
cmp esi, ebx
je 0x4232ad
push 0x468d40
push esi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x4232af
xor eax, eax
cmp byte [eax + 1], 0x5a
jle 0x423321
cmp esi, ebx
je 0x4232c8
push 0x468d40
push esi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x4232ca
xor eax, eax
cmp byte [eax + 1], 0x61
jl 0x4232eb
cmp esi, ebx
je 0x4232e3
push 0x468d40
push esi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x4232e5
xor eax, eax
cmp byte [eax + 1], 0x7a
jle 0x423321
cmp esi, ebx
je 0x4232fe
push 0x468d40
push esi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x423300
xor eax, eax
cmp byte [eax + 1], 0x30
jl 0x423343
cmp esi, ebx
je 0x423319
push 0x468d40
push esi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x42331b
xor eax, eax
cmp byte [eax + 1], 0x39
jg 0x423343
cmp esi, ebx
je 0x423334
push 0x468d40
push esi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x423336
xor eax, eax
movzx eax, byte [eax + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
jmp 0x42335b
cmp esi, ebx
je 0x423356
push 0x468d40
push esi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x423358
xor eax, eax
mov al, byte [eax + 1]
mov byte [esp + 0x14], al
cmp esi, ebx
je 0x423372
push 0x468d40
push esi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x423374
xor eax, eax
movzx eax, byte [eax + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
shr eax, 8
mov byte [esp + 0x13], al
cmp al, bl
je 0x423396
push ebx
push ebx
push ebx
push 0x10
call edi
push eax
push 0x10
call ebp
mov cl, byte [esp + 0x14]
cmp cl, 0x21
jb 0x4233a4
cmp cl, 0x2e
jbe 0x4233bc
cmp cl, 0x11
je 0x4233bc
cmp cl, 0x5b
je 0x4233bc
cmp cl, 0x5c
je 0x4233bc
cmp cl, 0x5d
je 0x4233bc
xor eax, eax
jmp 0x4233bf
xor eax, eax
inc eax
push ebx
push eax
movzx esi, cl
push ebx
push esi
call edi
push eax
push dword [esp + 0x20]
call ebp
mov al, byte [esp + 0x14]
cmp al, 0x21
jb 0x4233db
cmp al, 0x2e
jbe 0x4233ef
cmp al, 0x11
je 0x4233ef
cmp al, 0x5b
je 0x4233ef
cmp al, 0x5c
je 0x4233ef
cmp al, 0x5d
je 0x4233ef
xor eax, eax
jmp 0x4233f2
xor eax, eax
inc eax
push ebx
or eax, 2
push eax
push ebx
push esi
call edi
push eax
push dword [esp + 0x20]
call ebp
cmp byte [esp + 0x13], bl
je 0x423415
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call ebp
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.00452dee
add esp, 0x10c
ret 8