Function at 0x434150
Capabilities:
Inspect section memory permissions
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi]
call fcn.004bb190
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov eax, dword [esi]
test dword [eax + 0x214], 0x10000000
je 0x434178
mov dword [esi + 8], 0x1000000
test dword [eax + 0x214], 0x20000000
je 0x43418b
or dword [esi + 8], 0x2000000
test dword [eax + 0x214], 0x40000000
je 0x43419e
or dword [esi + 8], 0x4000000
test dword [eax + 0x214], 0x80000000
je 0x4341b1
or dword [esi + 8], 0x8000000
mov ecx, dword [esi + 0x10]
mov edx, dword [eax + 0x214]
test edx, ecx
je 0x4341c2
or dword [esi + 8], 1
mov edx, dword [esi + 0x14]
mov ecx, dword [eax + 0x214]
test ecx, edx
je 0x4341d3
or dword [esi + 8], 2
mov ecx, dword [esi + 0x18]
mov edx, dword [eax + 0x214]
test edx, ecx
je 0x4341e4
or dword [esi + 8], 4
mov edx, dword [esi + 0x1c]
mov ecx, dword [eax + 0x214]
test ecx, edx
je 0x4341f5
or dword [esi + 8], 8
mov ecx, dword [esi + 0x24]
mov edx, dword [eax + 0x214]
test edx, ecx
je 0x434206
or dword [esi + 8], 0x20
mov edx, dword [esi + 0x28]
mov ecx, dword [eax + 0x214]
test ecx, edx
je 0x434217
or dword [esi + 8], 0x40
mov ecx, dword [esi + 0x2c]
mov edx, dword [eax + 0x214]
test edx, ecx
je 0x43422d
mov ecx, dword [esi + 8]
or cl, 0x80
mov dword [esi + 8], ecx
mov edx, dword [esi + 0x30]
mov ecx, dword [eax + 0x214]
test ecx, edx
je 0x434243
mov ecx, dword [esi + 8]
or ch, 1
mov dword [esi + 8], ecx
mov ecx, dword [esi + 0x34]
mov edx, dword [eax + 0x214]
test edx, ecx
je 0x434259
mov eax, dword [esi + 8]
or ah, 2
mov dword [esi + 8], eax
mov edx, dword [esi + 0x38]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x434276
or dword [esi + 8], 0x1000000
mov ecx, dword [esi + 0x3c]
push ecx
call edi
movsx edx, ax
test edx, 0x80000000
je 0x43428e
or dword [esi + 8], 0x2000000
mov eax, dword [esi + 0x40]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x4342a6
or dword [esi + 8], 0x4000000
mov edx, dword [esi + 0x44]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x4342bd
or dword [esi + 8], 0x8000000
mov ecx, dword [esi + 0x48]
push ecx
call edi
movsx edx, ax
test edx, 0x80000000
je 0x4342d6
mov eax, dword [esi + 8]
or al, 1
mov dword [esi + 8], eax
mov eax, dword [esi + 0x4c]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x4342ef
mov eax, dword [esi + 8]
or al, 2
mov dword [esi + 8], eax
mov edx, dword [esi + 0x50]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x434307
mov eax, dword [esi + 8]
or al, 4
mov dword [esi + 8], eax
mov ecx, dword [esi + 0x54]
push ecx
call edi
movsx edx, ax
test edx, 0x80000000
je 0x434320
mov eax, dword [esi + 8]
or al, 8
mov dword [esi + 8], eax
mov eax, dword [esi + 0x5c]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x434339
mov eax, dword [esi + 8]
or al, 0x20
mov dword [esi + 8], eax
mov edx, dword [esi + 0x60]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x434351
mov eax, dword [esi + 8]
or al, 0x40
mov dword [esi + 8], eax
mov ecx, dword [esi + 0x64]
push ecx
call edi
movsx edx, ax
test edx, 0x80000000
je 0x43436a
mov eax, dword [esi + 8]
or al, 0x80
mov dword [esi + 8], eax
mov eax, dword [esi + 0x68]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x434384
mov eax, dword [esi + 8]
or ah, 1
mov dword [esi + 8], eax
mov edx, dword [esi + 0x6c]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x43439d
mov eax, dword [esi + 8]
or ah, 2
mov dword [esi + 8], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
test ecx, 0x1000000
mov dword [esi + 0x70], ecx
je 0x4343c8
test eax, 0x1000000
jne 0x4343d0
mov edi, dword [esi + 4]
or edi, 0x1000000
or eax, 0x1000000
mov dword [esi + 4], edi
jmp 0x4343cd
and eax, 0xfeffffff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test ecx, 0x2000000
je 0x4343f5
test eax, 0x2000000
jne 0x4343fd
mov edi, dword [esi + 4]
or edi, 0x2000000
or eax, 0x2000000
mov dword [esi + 4], edi
jmp 0x4343fa
and eax, 0xfdffffff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test ecx, 0x4000000
je 0x434422
test eax, 0x4000000
jne 0x43442a
mov edi, dword [esi + 4]
or edi, 0x4000000
or eax, 0x4000000
mov dword [esi + 4], edi
jmp 0x434427
and eax, 0xfbffffff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test ecx, 0x8000000
je 0x43444f
test eax, 0x8000000
jne 0x434457
mov edi, dword [esi + 4]
or edi, 0x8000000
or eax, 0x8000000
mov dword [esi + 4], edi
jmp 0x434454
and eax, 0xf7ffffff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 1
je 0x434470
test al, 1
jne 0x434475
mov edi, dword [esi + 4]
or edi, 1
or al, 1
mov dword [esi + 4], edi
jmp 0x434472
and al, 0xfe
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 2
je 0x43448e
test al, 2
jne 0x434493
mov edi, dword [esi + 4]
or edi, 2
or al, 2
mov dword [esi + 4], edi
jmp 0x434490
and al, 0xfd
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 4
je 0x4344ac
test al, 4
jne 0x4344b1
mov edi, dword [esi + 4]
or edi, 4
or al, 4
mov dword [esi + 4], edi
jmp 0x4344ae
and al, 0xfb
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 8
je 0x4344ca
test al, 8
jne 0x4344cf
mov edi, dword [esi + 4]
or edi, 8
or al, 8
mov dword [esi + 4], edi
jmp 0x4344cc
and al, 0xf7
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 0x20
je 0x4344e8
test al, 0x20
jne 0x4344ed
mov edi, dword [esi + 4]
or edi, 0x20
or al, 0x20
mov dword [esi + 4], edi
jmp 0x4344ea
and al, 0xdf
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 0x40
je 0x434506
test al, 0x40
jne 0x43450b
mov edi, dword [esi + 4]
or edi, 0x40
or al, 0x40
mov dword [esi + 4], edi
jmp 0x434508
and al, 0xbf
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 0x80
je 0x434527
test al, 0x80
jne 0x43452c
mov edi, dword [esi + 4]
or edi, 0x80
or al, 0x80
mov dword [esi + 4], edi
jmp 0x434529
and al, 0x7f
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test ch, 1
je 0x43454a
test ah, 1
jne 0x434550
mov edi, dword [esi + 4]
or edi, 0x100
or ah, 1
mov dword [esi + 4], edi
jmp 0x43454d
and ah, 0xfe
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test ch, 2
je 0x434574
test ah, 2
jne 0x43457a
mov edx, dword [esi + 4]
or dh, 2
or ah, 2
mov dword [esi + 0xc], eax
mov dword [esi + 4], edx
mov eax, 1
pop edi
pop esi
ret
and ah, 0xfd
mov dword [esi + 0xc], eax
pop edi
mov eax, 1
pop esi
ret