Function at 0x43b010
Capabilities:
Create process on windows
Create thread
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x54]
push edi
push str._keysym_0x_x
mov ecx, 8
mov eax, 0x4bc990
call fcn.00401110
lea eax, [edi - 0xfe50]
add esp, 8
cmp eax, 0x10
ja 0x43b065
push str.__DEAD_KEY
mov ecx, 8
mov eax, 0x4bc990
mov dword [0x4f3760], edi
call fcn.00401110
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
cmp edi, 0x20
jb 0x43b06f
cmp edi, 0x7e
jbe 0x43b07e
lea ecx, [edi - 0xa0]
cmp ecx, 0x5f
ja 0x43b68c
mov eax, dword [0x4f3760]
xor ebp, ebp
cmp eax, ebp
je 0x43b2b3
cmp byte [esp + 0x58], 0
je 0x43b2b3
push edi
push eax
push str._Compose_dead_0x_x_0x_x
lea ecx, [ebp + 8]
mov eax, 0x4bc990
call fcn.00401110
mov eax, dword [0x4f3760]
add eax, 0xffff01b0
add esp, 0xc
cmp eax, 0xb
ja case.0x43b0c2.65108
jmp dword [eax*4 + 0x43b850]
lea eax, [edi - 0x41]
cmp eax, 0x34
ja case.0x43b0d8.66
movzx edx, byte [eax + 0x43b8ac]
jmp dword [edx*4 + 0x43b880]
mov edi, 0xc0
jmp case.0x43b0d8.66
mov edi, 0xc8
jmp case.0x43b0d8.66
mov edi, 0xcc
jmp case.0x43b0d8.66
mov edi, 0xd2
jmp case.0x43b0d8.66
mov edi, 0xd9
jmp case.0x43b0d8.66
mov edi, 0xe0
jmp case.0x43b0d8.66
mov edi, 0xe8
jmp case.0x43b0d8.66
mov edi, 0xec
jmp case.0x43b0d8.66
mov edi, 0xf2
jmp case.0x43b0d8.66
mov edi, 0xf9
lea eax, [edi - 0x41]
cmp eax, 0x38
ja case.0x43b132.66
movzx eax, byte [eax + 0x43b918]
jmp dword [eax*4 + 0x43b8e4]
mov edi, 0xc1
jmp case.0x43b132.66
mov edi, 0xc9
jmp case.0x43b132.66
mov edi, 0xcd
jmp case.0x43b132.66
mov edi, 0xd3
jmp case.0x43b132.66
mov edi, 0xda
jmp case.0x43b132.66
mov edi, 0xe1
jmp case.0x43b132.66
mov edi, 0xe9
jmp case.0x43b132.66
mov edi, 0xed
jmp case.0x43b132.66
mov edi, 0xf3
jmp case.0x43b132.66
mov edi, 0xfa
jmp case.0x43b132.66
mov edi, 0xfd
jmp case.0x43b132.66
mov edi, 0xdd
lea eax, [edi - 0x41]
cmp eax, 0x34
ja case.0x43b19a.66
movzx ecx, byte [eax + 0x43b980]
jmp dword [ecx*4 + 0x43b954]
mov edi, 0xc2
jmp case.0x43b19a.66
mov edi, 0xca
jmp case.0x43b19a.66
mov edi, 0xce
jmp case.0x43b19a.66
mov edi, 0xd4
jmp case.0x43b19a.66
mov edi, 0xdb
jmp case.0x43b19a.66
mov edi, 0xe2
jmp case.0x43b19a.66
mov edi, 0xea
jmp case.0x43b19a.66
mov edi, 0xee
jmp case.0x43b19a.66
mov edi, 0xf4
jmp case.0x43b19a.66
mov edi, 0xfb
lea eax, [edi - 0x41]
cmp eax, 0x2e
ja case.0x43b1f4.66
movzx edx, byte [eax + 0x43b9d0]
jmp dword [edx*4 + 0x43b9b8]
mov edi, 0xd1
jmp case.0x43b1f4.66
mov edi, 0xd5
jmp case.0x43b1f4.66
mov edi, 0xe3
jmp case.0x43b1f4.66
mov edi, 0xf1
jmp case.0x43b1f4.66
mov edi, 0xf5
lea eax, [edi - 0x41]
cmp eax, 0x38
ja case.0x43b22b.66
movzx eax, byte [eax + 0x43ba30]
jmp dword [eax*4 + 0x43ba00]
mov edi, 0xc4
jmp case.0x43b0c2.65108
mov edi, 0xcb
jmp case.0x43b0c2.65108
mov edi, 0xcf
jmp case.0x43b0c2.65108
mov edi, 0xd6
jmp case.0x43b0c2.65108
mov edi, 0xdc
jmp case.0x43b0c2.65108
mov edi, 0xe4
jmp case.0x43b0c2.65108
mov edi, 0xeb
jmp case.0x43b0c2.65108
mov edi, 0xef
jmp case.0x43b0c2.65108
mov edi, 0xf6
jmp case.0x43b0c2.65108
mov edi, 0xfc
jmp case.0x43b0c2.65108
mov edi, 0xff
jmp case.0x43b0c2.65108
cmp edi, 0x43
je 0x43b290
cmp edi, 0x63
jne case.0x43b0c2.65108
mov edi, 0xe7
jmp case.0x43b0c2.65108
mov edi, 0xc7
push edi
push str._Composed_0x_x
mov ecx, 8
mov eax, 0x4bc990
mov dword [0x4f3760], ebp
call fcn.00401110
add esp, 8
push edi
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp byte [esp + 0x5c], 0
movzx ebx, ax
je 0x43b2ec
cmp edi, 0x4a6
jne 0x43b2d3
mov ebx, 0x130
jmp 0x43b2ec
cmp edi, 0x5c
jne 0x43b2df
mov ebx, 0xe2
jmp 0x43b2ec
cmp edi, 0xa5
jne 0x43b2ec
mov ebx, 0xdc
movsx esi, bx
push esi
push str._SHORT_s__i
mov ecx, 8
mov eax, 0x4bc990
call fcn.00401110
add esp, 8
cmp bx, 0xffff
jne 0x43b52a
cmp byte [esp + 0x58], 0
je 0x43b846
push str.down
mov ecx, 8
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
push str._Found_key
mov ecx, 8
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
cmp edi, 0xff
jg 0x43b508
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov ecx, ebx
imul ecx, ecx, 0x64
sub edi, ecx
mov ecx, edi
mov eax, 0x66666667
imul ecx
mov esi, edx
sar esi, 2
mov eax, esi
shr eax, 0x1f
add eax, esi
mov dl, 0xa
mov dword [esp + 0x5c], eax
imul dl
sub cl, al
cmp dword [0x4ee094], 1
mov byte [esp + 0x58], cl
mov dword [esp + 0x2c], 0x10
mov dword [esp + 0x30], ebp
mov byte [esp + 0x34], 0
mov byte [esp + 0x35], 0
mov dword [esp + 0x14], 0xa0
mov dword [esp + 0x18], ebp
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
mov dword [esp + 0x20], 0xa1
mov dword [esp + 0x24], ebp
mov byte [esp + 0x28], 0
mov byte [esp + 0x29], 0
jne 0x43b3e2
lea esi, [esp + 0x2c]
jmp 0x43b3ef
lea esi, [esp + 0x14]
call fcn.0043ada0
lea esi, [esp + 0x20]
call fcn.0043ada0
movzx ebp, byte [esp + 0x58]
movzx eax, byte [esp + 0x5c]
push ebp
movzx ecx, bl
push eax
push ecx
push str._Simulating_ALT_d_d_d_n
mov ecx, 8
mov eax, 0x4bc990
call fcn.00401110
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
add esp, 0x10
push 0
push 0
push 0
push 0x12
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call edi
push 0
push 0
push 0
push 0x60
call esi
push eax
push 0x60
call edi
push 0
push 2
push 0
push 0x60
call esi
push eax
push 0x60
call edi
push 0
movzx eax, bl
push 0
add eax, 0x60
push 0
push eax
mov dword [esp + 0x64], eax
add bl, 0x60
call esi
push eax
push ebx
call edi
mov eax, dword [esp + 0x54]
push 0
push 2
push 0
push eax
call esi
push eax
push ebx
call edi
movzx eax, byte [esp + 0x5c]
mov bl, byte [esp + 0x5c]
push 0
push 0
add eax, 0x60
push 0
push eax
mov dword [esp + 0x64], eax
add bl, 0x60
call esi
push eax
push ebx
call edi
mov ecx, dword [esp + 0x54]
push 0
push 2
push 0
push ecx
call esi
push eax
push ebx
call edi
mov bl, byte [esp + 0x58]
push 0
push 0
push 0
add ebp, 0x60
push ebp
add bl, 0x60
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push ebp
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push 0x12
call esi
push eax
push 0x12
call edi
lea esi, [esp + 0x20]
call fcn.0043ae00
lea esi, [esp + 0x14]
call fcn.0043ae00
lea esi, [esp + 0x2c]
call fcn.0043ae00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push edi
push str.ignoring_unrecognised_Latin_1_keysym_0x_x
mov ecx, 8
mov eax, 0x4bc990
call fcn.00401110
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
mov eax, esi
and ebp, 1
xor ecx, ecx
shr eax, 8
cmp ebp, ecx
je 0x43b54b
xor al, 1
mov byte [esp + 0x5c], al
jmp 0x43b54f
mov byte [esp + 0x5c], al
mov dword [esp + 0x44], 0x11
mov dword [esp + 0x48], ecx
mov byte [esp + 0x4c], cl
mov byte [esp + 0x4d], cl
mov dword [esp + 0x38], 0x12
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x40], cl
mov byte [esp + 0x41], cl
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], cl
mov dword [esp + 0x14], 0xa0
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], cl
mov dword [esp + 0x2c], 0xa1
mov dword [esp + 0x30], ecx
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], cl
cmp byte [esp + 0x58], cl
je 0x43b610
test al, 2
je 0x43b5ca
lea esi, [esp + 0x44]
call fcn.0043ad40
mov al, byte [esp + 0x5c]
test al, 4
je 0x43b5db
lea esi, [esp + 0x38]
call fcn.0043ad40
mov al, byte [esp + 0x5c]
test al, 1
je 0x43b5ea
lea esi, [esp + 0x20]
call fcn.0043ad40
jmp 0x43b610
cmp bl, 0x20
je 0x43b610
cmp dword [0x4ee094], 1
jne 0x43b5fe
lea esi, [esp + 0x20]
jmp 0x43b60b
lea esi, [esp + 0x14]
call fcn.0043ada0
lea esi, [esp + 0x2c]
call fcn.0043ada0
movzx edx, byte [esp + 0x58]
push ebp
push edx
movzx esi, bl
push esi
push edi
push edi
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_capslockOn__d_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 0x18
xor eax, eax
cmp byte [esp + 0x58], al
push 0
setne al
dec eax
and eax, 2
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
lea esi, [esp + 0x2c]
call fcn.0043ae00
lea esi, [esp + 0x14]
call fcn.0043ae00
lea esi, [esp + 0x20]
call fcn.0043ae00
lea esi, [esp + 0x38]
call fcn.0043ae00
lea esi, [esp + 0x44]
call fcn.0043ae00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
mov ecx, dword [0x4f3810]
mov ebp, dword [0x4f37f8]
lea edx, [esp + 0x20]
push edx
lea ebx, [esp + 0x58]
mov dword [esp + 0x1c], ecx
call fcn.0043bd60
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x43b6b6
cmp eax, ebp
je 0x43b6bb
call fcn.0047d091
mov eax, dword [esp + 0x18]
cmp dword [esi + 4], eax
jne 0x43b6cf
push edi
push str.ignoring_unknown_keysym__d_n
jmp 0x43b50e
lea ecx, [esp + 0x54]
push ecx
call fcn.0043bc60
mov bl, byte [eax]
lea edx, [esp + 0x54]
push edx
push 0x4f3818
mov byte [esp + 0x64], bl
xor edi, edi
call fcn.0043bdf0
cmp byte [eax], 0
je 0x43b6fa
mov edi, 1
cmp byte [esp + 0x58], 0
jne 0x43b738
or edi, 2
cmp dword [0x4ee094], 1
jne 0x43b82b
movzx eax, bl
sub eax, 0xa1
je 0x43b825
sub eax, 2
je 0x43b821
sub eax, 2
jne 0x43b82b
mov bl, 0x12
jmp 0x43b827
cmp bl, 0x2e
jne 0x43b704
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
je 0x43b704
push 0x12
call esi
mov edx, 0x8000
test dx, ax
je 0x43b704
cmp dword [0x4ee094], 2
jne 0x43b704
push str.CAD_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
cmp dword [0x4ee08c], 6
mov ecx, 9
mov eax, 0x4bc990
jb 0x43b7d8
cmp dword [0x4f3794], 0
je 0x43b7d1
push str.Vista_and_runnning_as_system____CAD_n
call fcn.00401110
add esp, 4
lea eax, [esp + 0x58]
push eax
push 0
push 0
push 0x410fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push str.Vista_and_runnning_as_user____Taskmgr_n
jmp 0x43b802
cmp dword [0x4f3794], 0
je 0x43b7fd
push str.Not_Vista_and_runnning_as_system__use_old_method_n
call fcn.00401110
add esp, 4
call fcn.00451ac0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push str.Not_Vista_and_runnning_as_user____Taskmgr_n
call fcn.00401110
add esp, 4
push 1
push str.taskmgr.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
mov bl, 0x11
jmp 0x43b827
mov bl, 0x10
mov byte [esp + 0x5c], bl
push 0
push edi
movzx ecx, bl
push 0
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, dword [esp + 0x64]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc