Function at 0x43f9e3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
push ebx
mov ebx, ecx
mov ecx, dword [eax]
push esi
push edi
cmp ecx, 0xd
je 0x43fc39
cmp ecx, 0xf
je 0x43fc39
cmp ecx, 3
je 0x43faa4
cmp ecx, 0x12
jne 0x43fad7
movzx ecx, word [eax + 0x18]
xor edx, edx
sub ecx, edx
je 0x43fa70
dec ecx
jne 0x43fad7
cmp byte [ebx + 0x4f8], dl
je 0x43fa61
cmp byte [ebx + 0x971], dl
je 0x43fa61
push edx
mov ecx, ebx
call fcn.0043f5d3
push eax
call fcn.0043f547
push 1
push 1
inc eax
mov edx, dword [ebx]
mov esi, dword [ebx + 0x4f4]
push eax
mov ecx, ebx
call dword [edx + 0x15c]
jmp 0x43fc0c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x170]
jmp 0x43fcf0
cmp byte [ebx + 0x4f8], dl
je 0x43fa95
cmp byte [ebx + 0x971], dl
je 0x43fa95
push edx
mov ecx, ebx
call fcn.0043f5d3
push eax
call fcn.0043f547
push 1
push 0
dec eax
jmp 0x43fa4b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x16c]
jmp 0x43fcf0
movzx ecx, word [eax + 0x14]
sub ecx, 0x21
je 0x43fc2a
dec ecx
je 0x43fc1b
dec ecx
je 0x43fbd9
dec ecx
je 0x43fbb4
dec ecx
dec ecx
je 0x43fb71
dec ecx
dec ecx
je 0x43fb16
sub ecx, 0x19
je 0x43fae4
push eax
mov ecx, ebx
call fcn.004365e8
jmp 0x43fcf0
cmp byte [ebx + 0x971], 0
jne 0x43fcf0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x43fcf0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c8]
jmp 0x43fcf0
mov ecx, dword [ebx + 0x984]
sub ecx, dword [ebx + 0x980]
sar ecx, 2
test ecx, ecx
je 0x43fcf0
mov ecx, ebx
call fcn.0043f6a5
lea esi, [eax + 1]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1cc]
mov ecx, dword [ebx + 0x508]
add ecx, 0x4a0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ecx, [esi + 1]
push 1
cmp ecx, eax
jle 0x43fb66
lea ecx, [ebx + 0x4a0]
jmp 0x43fc00
lea ecx, [ebx + 0x4f4]
mov eax, dword [ecx]
push esi
jmp 0x43fbac
mov ecx, dword [ebx + 0x984]
sub ecx, dword [ebx + 0x980]
sar ecx, 2
test ecx, ecx
je 0x43fcf0
mov ecx, ebx
call fcn.0043f64a
lea esi, [eax - 1]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1cc]
lea ecx, [ebx + 0x4f4]
mov eax, dword [ecx]
push 1
test esi, esi
jg 0x43fb6e
push 0
call dword [eax + 8]
jmp 0x43fcf0
mov ecx, dword [ebx + 0x508]
add ecx, 0x4a0
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jle 0x43fcf0
lea ecx, [ebx + 0x4f4]
mov eax, dword [ecx]
push 1
jmp 0x43fbaa
mov ecx, dword [ebx + 0x508]
add ecx, 0x4a0
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jle 0x43fcf0
mov ecx, dword [ebx + 0x508]
add ecx, 0x4a0
push 1
mov eax, dword [ecx]
mov esi, dword [ebx + 0x4f4]
call dword [eax + 0xc]
dec eax
push eax
lea ecx, [ebx + 0x4f4]
call dword [esi + 8]
jmp 0x43fcf0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x178]
jmp 0x43fcf0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x174]
jmp 0x43fcf0
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
and dword [ebp - 4], 0
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebx + 0x508]
add ecx, 0x4a0
mov dword [ebp - 8], eax
mov eax, dword [ecx]
mov byte [ebp + 0xb], 0
call dword [eax + 0xc]
test eax, eax
jle 0x43fce6
mov ecx, dword [ebx + 0x508]
push dword [ebp - 4]
add ecx, 0x4a0
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
mov eax, dword [esi]
push str.ListItem
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x43fcc7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
test al, al
je 0x43fcc7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
mov esi, eax
mov eax, dword [ebp - 0xc]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x1c], eax
jg 0x43fcc7
cmp dword [ebp - 0x14], eax
jl 0x43fcc7
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x18], eax
jg 0x43fcc7
cmp dword [ebp - 0x10], eax
jl 0x43fcc7
mov byte [ebp + 0xb], 1
mov ecx, dword [ebx + 0x508]
inc dword [ebp - 4]
add ecx, 0x4a0
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp dword [ebp - 4], eax
jl 0x43fc66
cmp byte [ebp + 0xb], 0
jne 0x43fcf0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1cc]
pop edi
pop esi
pop ebx
leave
ret 4