Function at 0x43a426
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x11c
mov eax, dword [0x4755d0]
xor eax, esp
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x12c]
push ebp
push esi
mov esi, dword [esp + 0x128]
push 0xff
mov dword [esp + 0x1c], eax
xor ebp, ebp
lea eax, [esp + 0x25]
push ebp
push eax
mov byte [esp + 0x2c], 0
call fcn.00448090
add esp, 0xc
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], esi
cmp esi, ebp
je 0x43a6b0
push edi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push ebx
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0
je 0x43a6ae
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.004391e1
mov ebx, eax
cmp dword [0x47c470], ebp
je 0x43a4b8
mov dword [esp + 0x14], ebp
cmp ebx, ebp
je 0x43a67b
cmp dword [esp + 0x134], 1
jne 0x43a507
mov esi, dword [esp + 0x14]
and esi, 1
je 0x43a4e3
push ebp
push ebp
push ebp
push 0x10
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x10
call edi
push ebx
call fcn.0043a35f
cmp esi, ebp
je 0x43a67b
push ebp
push 2
push ebp
push 0x10
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x10
call edi
jmp 0x43a67b
test byte [esp + 0x14], 4
mov eax, dword [esp + 0x20]
je 0x43a574
cmp eax, ebp
je 0x43a519
add dword [eax], 4
push ebx
lea eax, [esp + 0x2c]
push str._04d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebp
push ebp
push ebp
push 0x12
call edi
movsx esi, byte [esp + ebp + 0x28]
xor eax, eax
push eax
push eax
push eax
add esi, 0x30
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call edi
push 0
push 2
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call edi
inc ebp
cmp ebp, 4
jl 0x43a534
push 0
push 2
push 0
push 0x12
call edi
xor ebp, ebp
jmp 0x43a625
cmp eax, ebp
je 0x43a57a
inc dword [eax]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
and eax, 1
mov dword [esp + 0x24], eax
je 0x43a599
push ebp
push ebp
push ebp
push 0x10
call esi
push eax
push 0x10
call edi
cmp dword [esp + 0x10], ebp
je 0x43a5a6
cmp dword [esp + 0x10], 2
jne 0x43a5d5
cmp ebx, 0x21
jl 0x43a5b0
cmp ebx, 0x2e
jle 0x43a5c8
cmp ebx, 0x11
je 0x43a5c8
cmp ebx, 0x5b
je 0x43a5c8
cmp ebx, 0x5c
je 0x43a5c8
cmp ebx, 0x5d
je 0x43a5c8
xor eax, eax
jmp 0x43a5cb
xor eax, eax
inc eax
push ebp
push eax
push ebp
push ebx
call esi
push eax
push ebx
call edi
xor eax, eax
inc eax
cmp dword [esp + 0x10], eax
je 0x43a5e5
cmp dword [esp + 0x10], 2
jne 0x43a612
cmp ebx, 0x21
jl 0x43a5ef
cmp ebx, 0x2e
jle 0x43a605
cmp ebx, 0x11
je 0x43a605
cmp ebx, 0x5b
je 0x43a605
cmp ebx, 0x5c
je 0x43a605
cmp ebx, 0x5d
je 0x43a605
xor eax, eax
push ebp
or eax, 2
push eax
push ebp
push ebx
call esi
push eax
push ebx
call edi
cmp dword [esp + 0x24], ebp
je 0x43a625
push ebp
push 2
push ebp
push 0x10
call esi
push eax
push 0x10
call edi
cmp dword [esp + 0x10], ebp
jne 0x43a650
cmp ebx, 0x11
jne 0x43a635
xor eax, eax
inc eax
jmp 0x43a64a
cmp ebx, 0x10
jne 0x43a63e
push 2
jmp 0x43a645
cmp ebx, 0x12
jne 0x43a648
push 4
pop eax
jmp 0x43a64a
xor eax, eax
or dword [0x47c470], eax
xor eax, eax
inc eax
cmp dword [esp + 0x10], eax
jne 0x43a67b
cmp ebx, 0x11
je 0x43a673
cmp ebx, 0x10
jne 0x43a667
push 2
jmp 0x43a66e
cmp ebx, 0x12
jne 0x43a671
push 4
pop eax
jmp 0x43a673
xor eax, eax
not eax
and dword [0x47c470], eax
mov esi, dword [esp + 0x1c]
add esi, dword [esp + 0x18]
mov eax, dword [esp + 0x138]
mov dword [esp + 0x1c], esi
cmp eax, ebp
jne 0x43a697
cmp ebx, 0x11
jne 0x43a6a6
cmp ebx, 0x11
jne 0x43a69f
push 0xa
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, ebp
jne 0x43a488
pop ebx
pop edi
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
xor ecx, esp
call fcn.00448080
add esp, 0x11c
ret 0x10