Function at 0x43d8a4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x4de188
mov edi, 0x4de184
call sub.USER32.dll_GetFocus
mov dword [esi], eax
cmp dword [esi], 0
jne 0x43d8d1
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
jmp 0x43dca5
push 0x14
push 0x4de19c
mov edx, dword [esi]
push edx
call sub.USER32.dll_GetClassNameA
push str.edit
push 0x4de19c
call fcn.004bcfe4
add esp, 8
test eax, eax
je 0x43d91a
push 0x4cd196
push 0x4de19c
call fcn.004bcfe4
add esp, 8
test eax, eax
je 0x43d91a
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
jmp 0x43dca5
mov edx, dword [esi]
push edx
call sub.USER32.dll_GetParent
mov dword [0x4de18c], eax
mov ecx, dword [0x4de18c]
push ecx
call fcn.004b7934
test eax, eax
je 0x43d943
mov dword [0x4de198], 1
jmp 0x43d9b8
mov eax, dword [0x4de18c]
cmp eax, dword [0x4d2c6c]
je 0x43d970
cmp eax, dword [0x4ca9fc]
je 0x43d970
cmp eax, dword [0x4ccd50]
je 0x43d970
cmp eax, dword [0x4cdd8c]
je 0x43d970
cmp eax, dword [0x4cdd98]
jne 0x43d97c
mov dword [0x4de198], 2
jmp 0x43d9b8
mov edx, dword [0x4cc16c]
mov dword [edi], edx
jmp 0x43d99c
mov ecx, dword [eax + 0xc8]
cmp ecx, dword [0x4de18c]
je 0x43d9a2
mov eax, dword [eax + 0x16c]
mov dword [edi], eax
mov eax, dword [edi]
test eax, eax
jne 0x43d986
cmp dword [edi], 0
jne 0x43d9ae
xor eax, eax
jmp 0x43dca5
mov dword [0x4de198], 2
cmp bl, 3
jne 0x43d9d5
cmp dword [0x4cb050], 0
je 0x43d9d5
mov edx, dword [0x4de198]
push edx
mov ecx, dword [esi]
push ecx
call fcn.004167b4
push 0
push 0
push 0xb0
mov eax, dword [esi]
push eax
call sub.USER32.dll_SendMessageA
mov edi, eax
mov dword [0x4de1b0], edi
movzx edx, word [0x4de1b0]
mov dword [0x4de190], edx
mov eax, edi
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
mov dword [0x4de194], eax
cmp edx, eax
jne 0x43db03
cmp bl, 3
jne 0x43da58
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x43da3f
xor eax, eax
mov al, bl
push eax
push eax
push 0x4cd1a0
push 0x4de19c
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x43da95
xor edx, edx
mov dl, bl
push edx
push 0x4cd1a6
push 0x4de19c
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x43da95
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x43da7e
xor eax, eax
mov al, bl
push eax
push eax
push 0x4cd1aa
push 0x4de19c
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x43da95
xor edx, edx
mov dl, bl
push edx
push 0x4cd1b0
push 0x4de19c
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x4de190]
push eax
push eax
push 0xb1
mov edx, dword [esi]
push edx
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SendMessageA
push 0x4de19c
push 0
push 0xc2
mov eax, dword [esi]
push eax
call sub.USER32.dll_SendMessageA
inc dword [0x4de190]
mov eax, dword [0x4de190]
push eax
push eax
push 0xb1
mov edx, dword [esi]
push edx
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x43dca5
cmp bl, 3
jne 0x43dbea
mov edi, ebx
and edi, 0xff
push edi
push 0x4cd1b4
push 0x4de19c
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x4de194]
push eax
push eax
push 0xb1
mov edx, dword [esi]
push edx
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SendMessageA
push 0x4de19c
push 0
push 0xc2
mov eax, dword [esi]
push eax
call sub.USER32.dll_SendMessageA
push edi
push 0x4cd1b8
push 0x4de19c
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x4de190]
push eax
push eax
push 0xb1
mov edx, dword [esi]
push edx
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SendMessageA
push 0x4de19c
push 0
push 0xc2
mov eax, dword [esi]
push eax
call sub.USER32.dll_SendMessageA
push 0x4de19c
call fcn.004bceac
pop ecx
mov ebx, eax
add ebx, dword [0x4de190]
mov dword [0x4de190], ebx
push ebx
push ebx
push 0xb1
mov eax, dword [esi]
push eax
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov edx, dword [esi]
push edx
call sub.USER32.dll_SendMessageA
jmp 0x43dca0
mov edi, ebx
and edi, 0xff
push edi
push 0x4cd1bc
push 0x4de19c
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x4de190]
push eax
push eax
push 0xb1
mov edx, dword [esi]
push edx
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SendMessageA
push 0x4de19c
push 0
push 0xc2
mov eax, dword [esi]
push eax
call sub.USER32.dll_SendMessageA
push 0x4de19c
call fcn.004bceac
pop ecx
add eax, dword [0x4de194]
mov dword [0x4de194], eax
push edi
push 0x4cd1c0
push 0x4de19c
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x4de194]
push eax
push eax
push 0xb1
mov edx, dword [esi]
push edx
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SendMessageA
push 0x4de19c
push 0
push 0xc2
mov eax, dword [esi]
push eax
call sub.USER32.dll_SendMessageA
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4