Function at 0x435920
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x34
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x4c]
cmp eax, ecx
jge 0x43593f
test eax, eax
jl 0x43593f
mov ecx, dword [ebp + 0x48]
mov esi, dword [ecx + eax*4]
jmp 0x435941
xor esi, esi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
test ah, 0x80
jne 0x43595d
push 0x11
call edi
test ah, 0x80
je 0x435ac6
mov eax, 1
test eax, eax
je 0x435ac6
test esi, esi
je 0x435ac6
mov ecx, esi
call fcn.00445190
test eax, eax
je 0x435ac6
push 0x80
mov dword [esp + 0x2c], 0x4aa684
call fcn.004985f0
add esp, 4
mov ecx, esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x1f
mov dword [esp + 0x3c], 0x40
mov dword [esp + 0x38], 0
call fcn.00445190
test eax, eax
mov dword [esp + 0x18], eax
je 0x435a46
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
lea edx, [ecx + 1]
cmp esi, edx
jne 0x435a32
mov eax, dword [esp + 0x3c]
add eax, ecx
lea ecx, [eax*4 + 4]
push ecx
call fcn.004985f0
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov ebx, eax
add esp, 4
lea ecx, [edx*4 + 4]
mov edi, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00498600
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
add esp, 4
add eax, edx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ebx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x30]
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
push eax
mov eax, dword [ebp + 0xc]
push ecx
lea edx, [esp + 0x30]
mov ecx, dword [eax + 0x44]
push edx
push ecx
call fcn.00406f30
add esp, 0x10
test eax, eax
jne 0x435a70
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], 0x4aa684
test eax, eax
je 0x435aaf
mov eax, dword [esp + 0x30]
xor esi, esi
test eax, eax
jle 0x435aaf
cmp esi, eax
jge 0x435a9b
test esi, esi
jl 0x435a9b
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + esi*4]
jmp 0x435a9d
xor eax, eax
push eax
call fcn.00498600
mov eax, dword [esp + 0x34]
add esp, 4
inc esi
cmp esi, eax
jl 0x435a8e
mov eax, dword [esp + 0x2c]
push eax
call fcn.00498600
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 8
mov ecx, dword [ebp + 8]
push 0x6d
push ecx
call dword [sym.imp.USER32.dll_LoadMenuA]
push 0
push eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ecx, dword [ebp + 0x4c]
mov esi, eax
mov eax, dword [ebp + 0x70]
cmp eax, ecx
jge 0x435af7
test eax, eax
jl 0x435af7
mov edx, dword [ebp + 0x48]
mov ecx, dword [edx + eax*4]
jmp 0x435af9
xor ecx, ecx
xor ebx, ebx
test ecx, ecx
setne bl
test ebx, ebx
je 0x435b2d
cmp eax, dword [ebp + 0x4c]
jge 0x435b15
test eax, eax
jl 0x435b15
mov ecx, dword [ebp + 0x48]
mov eax, dword [ecx + eax*4]
jmp 0x435b17
xor eax, eax
mov ecx, eax
call fcn.004465d0
cmp eax, 1
jle 0x435b2d
mov dword [esp + 0x10], 1
jmp 0x435b37
xor eax, eax
test eax, eax
mov dword [esp + 0x10], eax
je 0x435b4c
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x14], 1
mov eax, dword [edx + 0x6bc]
test eax, eax
jg 0x435b54
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x435b91
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x4c]
mov edi, dword [eax + 0x6bc]
mov eax, dword [ebp + 0x70]
cmp eax, ecx
jge 0x435b7b
test eax, eax
jl 0x435b7b
mov ecx, dword [ebp + 0x48]
mov eax, dword [ecx + eax*4]
jmp 0x435b7d
xor eax, eax
mov ecx, eax
call fcn.004465d0
dec eax
mov dword [esp + 0x18], 1
cmp edi, eax
jl 0x435b99
mov dword [esp + 0x18], 0
mov edx, dword [ebp + 0x14]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x4eb8
push 0x409
push edx
call edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x14]
push 0
push 0x4eb9
push 0x409
push eax
call edi
mov edi, dword [sym.imp.USER32.dll_RemoveMenu]
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x435bde
mov al, byte [0x4caba4]
test al, al
je 0x435be8
push 0x400
push 0x14
push esi
call edi
test ebx, ebx
jne 0x435bfa
push 0x400
push 0x13
push esi
call edi
test ebx, ebx
je 0x435c03
mov al, byte [0x4caba3]
test al, al
je 0x435c0d
push 0x400
push 0x12
push esi
call edi
mov al, byte [0x4caba1]
test al, al
je 0x435c20
push 0
push 0x4eba
push esi
call edi
mov al, byte [0x4caba6]
test al, al
je 0x435c33
push 0
push 0x4e90
push esi
call edi
test ebx, ebx
je 0x435c40
mov al, byte [0x4caba5]
test al, al
je 0x435c4a
push 0
push 0x4f22
push esi
call edi
test ebx, ebx
jne 0x435c57
push ebx
push 0x4eb7
push esi
call edi
mov al, byte [0x4caba2]
test al, al
je 0x435c6a
push 0
push 0x4f21
push esi
call edi
test ebx, ebx
jne 0x435c9c
push 0x400
push 0xb
push esi
call edi
push ebx
push 0x4eb8
push esi
call edi
push ebx
push 0x4eb9
push esi
call edi
push ebx
push 0x4f0a
push esi
call edi
push ebx
push 0x4f09
push esi
call edi
cmp dword [ebp + 0x4c], 2
jge 0x435cca
push 0x400
push 6
push esi
call edi
push 0
push 0x4eb4
push esi
call edi
push 0
push 0x4eb3
push esi
call edi
push 0
push 0x4eb6
push esi
call edi
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x435cf0
push 0x400
push 2
push esi
call edi
push 0
push 0x4efe
push esi
call edi
push 0
push 0x4eff
push esi
call edi
mov eax, dword [ebp + 0x70]
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
test eax, eax
jne 0x435d07
push 1
push 0x4eb3
push esi
call edi
mov ecx, dword [ebp + 0x4c]
mov eax, dword [ebp + 0x70]
dec ecx
cmp eax, ecx
jne 0x435d1c
push 1
push 0x4eb4
push esi
call edi
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x435d2e
push 1
push 0x4eb8
push esi
call edi
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x435d40
push 1
push 0x4eb9
push esi
call edi
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x435d52
push 1
push 0x4eff
push esi
call edi
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x435d64
push 1
push 0x4efe
push esi
call edi
mov edx, dword [ebp + 0x40]
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
neg edx
sbb edx, edx
and edx, 8
push edx
push 0x4eb6
push esi
call edi
mov ecx, ebp
call fcn.0043c070
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x4eb5
push esi
call edi
mov eax, dword [ebp + 0xc0]
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x4f60
push esi
call edi
mov al, byte [0x4caba1]
test al, al
jne 0x435dc1
push 0
push 0x4eba
push esi
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
push 0
push ecx
push 0
push edx
push eax
push 2
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.USER32.dll_DestroyMenu]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 8