Function at 0x443670
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x4a90e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea eax, [esp + 0x18]
push 0xb
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x40], 0
call fcn.0048801f
mov eax, dword [eax]
mov byte [esp + 0x38], 1
mov esi, 0x4d5164
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4436da
test cl, cl
je 0x4436d6
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4436da
add eax, 2
add esi, 2
test cl, cl
jne 0x4436b2
xor eax, eax
jmp 0x4436df
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x443793
lea eax, [esp + 0x10]
push 9
push eax
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.vbscript:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443726
test cl, cl
je 0x443722
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443726
add eax, 2
add esi, 2
test cl, cl
jne 0x4436fe
xor eax, eax
jmp 0x44372b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x443793
lea eax, [esp + 0x14]
push 7
push eax
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov esi, 0x4d5150
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44377c
test cl, cl
je 0x443778
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44377c
add eax, 2
add esi, 2
test cl, cl
jne 0x443754
xor eax, eax
jmp 0x443781
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0048fb71
test bl, bl
je 0x443795
mov bl, 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0
call fcn.0048fb71
test bl, bl
je 0x4437b1
mov eax, dword [esp + 0x44]
push eax
jmp 0x443cb9
push 0x2e
lea ecx, [esp + 0x44]
call fcn.00490038
test eax, eax
jg 0x44385d
push 0x2f
lea ecx, [esp + 0x44]
call fcn.00490038
test eax, eax
jg 0x44385d
push 0x5c
lea ecx, [esp + 0x44]
call fcn.00490038
test eax, eax
jge 0x44385d
lea ecx, [esp + 0x18]
push 2
push ecx
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov esi, 0x4d6188
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443825
test cl, cl
je 0x443821
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443825
add eax, 2
add esi, 2
test cl, cl
jne 0x4437fd
xor eax, eax
jmp 0x44382a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x44385d
mov ecx, dword [esp + 0x40]
cmp byte [ecx + 1], 0x3a
jne 0x443bb6
mov al, byte [ecx + 2]
cmp al, 0x5c
je 0x44385d
cmp al, 0x2f
je 0x44385d
test al, al
jne 0x443bb6
push 0x40
lea ecx, [esp + 0x44]
call fcn.00490038
test eax, eax
jle 0x443c1c
lea eax, [esp + 0x2c]
push 7
push eax
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov byte [esp + 0x38], 2
mov esi, str.http:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4438b4
test cl, cl
je 0x4438b0
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4438b4
add eax, 2
add esi, 2
test cl, cl
jne 0x44388c
xor eax, eax
jmp 0x4438b9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x443b9e
lea eax, [esp + 0x18]
push 7
push eax
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.file:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443900
test cl, cl
je 0x4438fc
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443900
add eax, 2
add esi, 2
test cl, cl
jne 0x4438d8
xor eax, eax
jmp 0x443905
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x443b9e
lea eax, [esp + 0x14]
push 8
push eax
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.https:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44395a
test cl, cl
je 0x443956
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44395a
add eax, 2
add esi, 2
test cl, cl
jne 0x443932
xor eax, eax
jmp 0x44395f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x443b9e
lea eax, [esp + 0x10]
push 7
push eax
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.file:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4439b4
test cl, cl
je 0x4439b0
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4439b4
add eax, 2
add esi, 2
test cl, cl
jne 0x44398c
xor eax, eax
jmp 0x4439b9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x443b9e
lea eax, [esp + 0x1c]
push 4
push eax
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.www.
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443a0e
test cl, cl
je 0x443a0a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443a0e
add eax, 2
add esi, 2
test cl, cl
jne 0x4439e6
xor eax, eax
jmp 0x443a13
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x1c]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x443b9e
lea eax, [esp + 0x24]
push 6
push eax
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov byte [esp + 0x38], 3
mov esi, str.ftp:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443a6d
test cl, cl
je 0x443a69
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443a6d
add eax, 2
add esi, 2
test cl, cl
jne 0x443a45
xor eax, eax
jmp 0x443a72
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x443acc
lea eax, [esp + 0x20]
push 4
push eax
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.ftp.
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443ab5
test cl, cl
je 0x443ab1
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443ab5
add eax, 2
add esi, 2
test cl, cl
jne 0x443a8d
xor eax, eax
jmp 0x443aba
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x20]
sete bl
call fcn.0048fb71
test bl, bl
je 0x443ace
mov bl, 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 2
call fcn.0048fb71
test bl, bl
jne 0x443b9e
lea eax, [esp + 0x28]
push 6
push eax
lea ecx, [esp + 0x48]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.res:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443b23
test cl, cl
je 0x443b1f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443b23
add eax, 2
add esi, 2
test cl, cl
jne 0x443afb
xor eax, eax
jmp 0x443b28
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x28]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x443b9e
mov edi, dword [esp + 0x40]
mov esi, str.about:blank
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443b6d
test cl, cl
je 0x443b69
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443b6d
add eax, 2
add esi, 2
test cl, cl
jne 0x443b45
xor eax, eax
jmp 0x443b72
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x443b9e
cmp byte [edi + 1], 0x3a
jne 0x443b9a
mov al, byte [edi + 2]
cmp al, 0x5c
je 0x443b9e
cmp al, 0x2f
sete cl
test cl, cl
jne 0x443b9e
test al, al
sete al
test al, al
jne 0x443b9e
mov bl, 1
jmp 0x443ba0
xor bl, bl
lea ecx, [esp + 0x2c]
mov byte [esp + 0x38], 0
call fcn.0048fb71
test bl, bl
je 0x443c1c
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx - 8]
test eax, eax
je 0x443c1c
mov eax, dword [ebp + 0xbb4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
mov eax, dword [eax + 0x1c]
push 0x407
push eax
call esi
push eax
call fcn.0048c2a9
mov ecx, dword [esp + 0x40]
push ecx
mov ecx, eax
call fcn.0048f12d
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
push 0
test ax, ax
mov eax, dword [ebp + 0x1c]
push 0xef1c
setge dl
dec edx
push 0x111
and edx, 3
push eax
inc edx
mov dword [ebp + 0x1ec], edx
call esi
jmp 0x443cc0
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.0048f8e6
push 0
mov ecx, ebp
call fcn.00444790
test eax, eax
jne 0x443cc0
mov eax, dword [ebp + 0xd4]
test eax, eax
jne 0x443cb4
lea eax, [esp + 0x2c]
push 1
push eax
lea ecx, [esp + 0x48]
call fcn.00487fa3
mov eax, dword [eax]
mov esi, 0x4d6cc4
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443c87
test cl, cl
je 0x443c83
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443c87
add eax, 2
add esi, 2
test cl, cl
jne 0x443c5f
xor eax, eax
jmp 0x443c8c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x2c]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x443cb4
mov eax, dword [esp + 0x40]
push 0
push 0
push eax
push 2
push 1
mov ecx, ebp
call fcn.00427110
jmp 0x443cc0
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, ebp
call fcn.0043ef50
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048fb71
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 8