Function at 0x43dcb0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x12
mov ebx, eax
mov esi, ecx
mov edi, edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebp, ax
push 0x10
shr ebp, 0xf
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx eax, ax
shr eax, 0xf
and ebp, eax
mov dword [0x473234], 1
mov dword [0x47939c], 0
mov dword [0x4793b8], 0xbf19999a
mov dword [0x4793a8], 5
mov dword [0x4793ac], 8
mov dword [0x4793a4], 0x479278
mov dword [esp + 0x10], 0
nop
mov eax, dword [esp + 0x10]
call fcn.0043dbd0
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4793ac]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x43dd20
push 0x50
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov edx, 0x3f800000
jne 0x43dd53
xor ecx, ecx
jmp 0x43dd8b
mov ecx, edi
shr ecx, 1
mov dword [eax + 0x28], ecx
mov ecx, esi
shr ecx, 1
mov dword [eax + 0x2c], ecx
xor ecx, ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax], 0x42f00000
mov dword [eax + 4], edx
mov dword [eax + 0x20], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x24], esi
mov dword [eax + 0x18], esi
mov dword [eax + 0xc], 0x72c9f2ca
mov byte [eax + 8], 1
mov ecx, eax
mov eax, 1
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea eax, [esi - 1]
mov dword [ecx + 0x18], eax
lea eax, [edi - 1]
mov dword [ecx + 0x1c], eax
mov dword [ecx + 4], edx
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [ecx + 0x28], eax
mov eax, esi
cdq
sub eax, edx
push 0x18
sar eax, 1
push 0x40
mov dword [0x479354], ecx
mov dword [ecx + 0x20], edi
mov dword [ecx + 0x24], esi
mov dword [ecx + 0x2c], eax
mov byte [ecx + 8], 1
mov dword [ecx + 0x38], 0xc2700000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
mov esi, 0x479378
mov dword [0x479350], eax
call fcn.0043ef50
mov ecx, dword [0x479378]
mov eax, ebp
neg eax
sbb eax, eax
push ecx
and eax, 0xc
add eax, 0xc
push 0x43fa0000
call fcn.0043f390
mov edx, dword [0x47938c]
push edx
push 0x42000000
push 0x42000000
push 0x42000000
mov dword [0x479360], eax
call fcn.0043fce0
mov esi, 0xc2b40000
mov dword [0x479368], eax
mov dword [eax + 0x58], 0x42960000
mov dword [eax + 0x54], 0xc3260000
mov dword [eax + 0x68], esi
mov dword [eax + 0x64], 0x42b40000
mov byte [eax + 0x50], 0
mov eax, dword [0x479388]
push eax
push 0x42b40000
push 0x43260000
mov edi, 1
call fcn.004401b0
push ebx
mov dword [0x479370], eax
mov dword [eax + 0x58], 0x42960000
mov dword [eax + 0x54], 0x43260000
mov dword [eax + 0x68], esi
mov dword [eax + 0x64], 0x42b40000
mov byte [eax + 0x50], 0
call fcn.00442ff0
add esp, 0x2c
xor edi, edi
mov esi, ebp
neg esi
sbb esi, esi
and esi, 6
mov eax, 0x40
add esi, 6
sub eax, 0x479318
mov dword [esp + 0x10], 0x411ccccd
mov ebx, 0xc
mov dword [esp + 0x14], eax
lea ebx, [ebx]
push 0xec
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor ecx, ecx
cmp eax, ecx
jne 0x43ded7
xor eax, eax
jmp 0x43dee4
mov byte [eax + 0x52], 1
mov byte [eax + 0x50], 1
mov dword [eax], ecx
mov dword [eax + 4], ecx
cmp ebp, ecx
mov dword [edi*4 + 0x479318], eax
mov dword [eax + 0x54], ecx
mov edx, dword [edi*4 + 0x479318]
mov dword [edx + 0x58], 0x42b40000
mov eax, dword [edi*4 + 0x479318]
mov dword [eax + 0x5c], ecx
je 0x43df17
mov ecx, dword [esp + 0x14]
lea eax, [ecx + edi*4 + 0x479318]
jmp 0x43df19
mov eax, ebx
fld dword [esp + 0x10]
mov edx, edi
fadd qword [0x46ec38]
and edx, 1
mov ecx, dword [edx*4 + 0x47937c]
mov edx, dword [esp + 0x10]
push ecx
push esi
push eax
push ecx
fstp dword [esp]
push edx
call fcn.0043f5e0
fld dword [esp + 0x24]
mov ecx, dword [edi*4 + 0x479318]
fadd qword [0x46ec30]
add esp, 0x14
add ebx, 2
inc edi
fstp dword [esp + 0x10]
cmp ebx, 0x1c
mov dword [ecx + 0x10], eax
jb 0x43dec0
mov edx, dword [0x479384]
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0x10
add esi, 8
neg ebp
sbb ebp, ebp
push edx
and ebp, 0xa
add ebp, 6
push esi
push 0x41880000
mov eax, ebp
call fcn.0043f8f0
mov dword [0x479348], eax
mov eax, dword [0x479384]
push eax
push esi
push 0x41880000
mov eax, ebp
call fcn.0043f8f0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x18
mov dword [0x479364], eax
call esi
mov dword [0x479398], eax
mov dword [0x479344], 0
mov dword [0x47933c], 0xffffffff
call esi
pop edi
pop esi
pop ebp
mov dword [0x479340], eax
pop ebx
add esp, 8
ret