Function at 0x447690
Capabilities:
Create process on windows
Create thread
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push str._keysym_0x_x
mov eax, 8
mov ecx, 0x4ecb00
call fcn.00403230
lea eax, [edi - 0xfe50]
add esp, 8
cmp eax, 0x10
ja 0x4476e5
push str.__DEAD_KEY
mov eax, 8
mov ecx, 0x4ecb00
mov dword [0x544764], edi
call fcn.00403230
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x20
jb 0x4476ef
cmp edi, 0x7e
jbe 0x4476fe
lea ecx, [edi - 0xa0]
cmp ecx, 0x5f
ja 0x447d17
mov eax, dword [0x544764]
test eax, eax
je 0x447936
cmp byte [ebp + 0xc], 0
je 0x447936
push edi
push eax
push str._Compose_dead_0x_x_0x_x
mov eax, 8
mov ecx, 0x4ecb00
call fcn.00403230
mov eax, dword [0x544764]
add eax, 0xffff01b0
add esp, 0xc
cmp eax, 0xb
ja case.0x447741.65108
jmp dword [eax*4 + 0x447eac]
lea eax, [edi - 0x41]
cmp eax, 0x34
ja case.0x447757.66
movzx edx, byte [eax + 0x447f08]
jmp dword [edx*4 + 0x447edc]
mov edi, 0xc0
jmp case.0x447757.66
mov edi, 0xc8
jmp case.0x447757.66
mov edi, 0xcc
jmp case.0x447757.66
mov edi, 0xd2
jmp case.0x447757.66
mov edi, 0xd9
jmp case.0x447757.66
mov edi, 0xe0
jmp case.0x447757.66
mov edi, 0xe8
jmp case.0x447757.66
mov edi, 0xec
jmp case.0x447757.66
mov edi, 0xf2
jmp case.0x447757.66
mov edi, 0xf9
lea eax, [edi - 0x41]
cmp eax, 0x38
ja case.0x4477b1.66
movzx eax, byte [eax + 0x447f74]
jmp dword [eax*4 + 0x447f40]
mov edi, 0xc1
jmp case.0x4477b1.66
mov edi, 0xc9
jmp case.0x4477b1.66
mov edi, 0xcd
jmp case.0x4477b1.66
mov edi, 0xd3
jmp case.0x4477b1.66
mov edi, 0xda
jmp case.0x4477b1.66
mov edi, 0xe1
jmp case.0x4477b1.66
mov edi, 0xe9
jmp case.0x4477b1.66
mov edi, 0xed
jmp case.0x4477b1.66
mov edi, 0xf3
jmp case.0x4477b1.66
mov edi, 0xfa
jmp case.0x4477b1.66
mov edi, 0xfd
jmp case.0x4477b1.66
mov edi, 0xdd
lea eax, [edi - 0x41]
cmp eax, 0x34
ja case.0x447819.66
movzx ecx, byte [eax + 0x447fdc]
jmp dword [ecx*4 + 0x447fb0]
mov edi, 0xc2
jmp case.0x447819.66
mov edi, 0xca
jmp case.0x447819.66
mov edi, 0xce
jmp case.0x447819.66
mov edi, 0xd4
jmp case.0x447819.66
mov edi, 0xdb
jmp case.0x447819.66
mov edi, 0xe2
jmp case.0x447819.66
mov edi, 0xea
jmp case.0x447819.66
mov edi, 0xee
jmp case.0x447819.66
mov edi, 0xf4
jmp case.0x447819.66
mov edi, 0xfb
lea eax, [edi - 0x41]
cmp eax, 0x2e
ja case.0x447873.66
movzx edx, byte [eax + 0x44802c]
jmp dword [edx*4 + 0x448014]
mov edi, 0xd1
jmp case.0x447873.66
mov edi, 0xd5
jmp case.0x447873.66
mov edi, 0xe3
jmp case.0x447873.66
mov edi, 0xf1
jmp case.0x447873.66
mov edi, 0xf5
lea eax, [edi - 0x41]
cmp eax, 0x38
ja case.0x4478aa.66
movzx eax, byte [eax + 0x44808c]
jmp dword [eax*4 + 0x44805c]
mov edi, 0xc4
jmp case.0x447741.65108
mov edi, 0xcb
jmp case.0x447741.65108
mov edi, 0xcf
jmp case.0x447741.65108
mov edi, 0xd6
jmp case.0x447741.65108
mov edi, 0xdc
jmp case.0x447741.65108
mov edi, 0xe4
jmp case.0x447741.65108
mov edi, 0xeb
jmp case.0x447741.65108
mov edi, 0xef
jmp case.0x447741.65108
mov edi, 0xf6
jmp case.0x447741.65108
mov edi, 0xfc
jmp case.0x447741.65108
mov edi, 0xff
jmp case.0x447741.65108
cmp edi, 0x43
je 0x44790f
cmp edi, 0x63
jne case.0x447741.65108
mov edi, 0xe7
jmp case.0x447741.65108
mov edi, 0xc7
push edi
push str._Composed_0x_x
mov eax, 8
mov ecx, 0x4ecb00
mov dword [0x544764], 0
call fcn.00403230
add esp, 8
push edi
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp byte [ebp + 0x10], 0
movzx ebx, ax
je 0x44796e
cmp edi, 0x4a6
jne 0x447955
mov ebx, 0x130
jmp 0x44796e
cmp edi, 0x5c
jne 0x447961
mov ebx, 0xe2
jmp 0x44796e
cmp edi, 0xa5
jne 0x44796e
mov ebx, 0xdc
movsx esi, bx
push esi
push str._SHORT_s__i
mov eax, 8
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 8
cmp bx, 0xffff
jne 0x447bdd
cmp byte [ebp + 0xc], 0
je 0x447ea2
push str.down
mov eax, 8
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
push str._Found_key
mov eax, 8
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
cmp edi, 0xff
jg 0x447bbc
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp + 0x10], eax
imul eax, eax, 0x64
sub edi, eax
mov ecx, edi
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov dl, bl
add dl, dl
add dl, dl
mov dword [ebp - 8], ebx
mov dword [ebp - 0x30], 0x10
mov dword [ebp - 0x24], 0xa0
mov dword [ebp - 0x18], 0xa1
lea eax, [edx + ebx]
add al, al
sub cl, al
xor eax, eax
cmp dword [0x513790], 1
mov byte [ebp + 0xf], cl
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x14], eax
mov word [ebp - 0x10], ax
jne 0x447a50
lea esi, [ebp - 0x30]
jmp 0x447a5b
lea esi, [ebp - 0x24]
call fcn.00447260
lea esi, [ebp - 0x18]
call fcn.00447260
movzx eax, byte [ebp + 0xf]
movzx edx, byte [ebp + 0x10]
movzx ecx, bl
push eax
push ecx
push edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
push str._Simulating_ALT_d_d_d_n
mov eax, 8
mov ecx, 0x4ecb00
mov dword [ebp + 8], edx
call fcn.00403230
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
add esp, 0x10
push 0
push 0x12
call esi
push 0x12
xor edi, edi
mov bl, al
call fcn.00415230
add esp, 4
push edi
push 0x60
call esi
push 0x60
mov bl, al
call fcn.00415230
add esp, 4
push edi
push 0x60
call esi
push 0x60
mov edi, 2
mov bl, al
call fcn.00415230
mov eax, dword [ebp + 8]
mov bl, byte [ebp + 0x10]
add esp, 4
add eax, 0x60
push 0
add bl, 0x60
push eax
mov dword [ebp + 8], eax
mov byte [ebp + 0x10], bl
call esi
push ebx
xor edi, edi
mov bl, al
call fcn.00415230
mov ecx, dword [ebp + 8]
add esp, 4
push edi
push ecx
call esi
mov edx, dword [ebp + 0x10]
push edx
mov edi, 2
mov bl, al
call fcn.00415230
mov eax, dword [ebp - 4]
mov bl, byte [ebp - 8]
add esp, 4
add eax, 0x60
push 0
add bl, 0x60
push eax
mov dword [ebp + 0x10], eax
mov byte [ebp + 8], bl
call esi
push ebx
xor edi, edi
mov bl, al
call fcn.00415230
mov eax, dword [ebp + 0x10]
add esp, 4
push edi
push eax
call esi
mov ecx, dword [ebp + 8]
push ecx
mov edi, 2
mov bl, al
call fcn.00415230
mov eax, dword [ebp - 0xc]
mov bl, byte [ebp + 0xf]
add esp, 4
add eax, 0x60
push 0
add bl, 0x60
push eax
mov dword [ebp + 0x10], eax
mov byte [ebp + 0xc], bl
call esi
push ebx
xor edi, edi
mov bl, al
call fcn.00415230
mov edx, dword [ebp + 0x10]
add esp, 4
push edi
push edx
call esi
mov ecx, dword [ebp + 0xc]
push ecx
mov edi, 2
mov bl, al
call fcn.00415230
add esp, 4
push 0
push 0x12
call esi
push 0x12
mov bl, al
call fcn.00415230
add esp, 4
lea esi, [ebp - 0x18]
call fcn.004472d0
lea esi, [ebp - 0x24]
call fcn.004472d0
lea esi, [ebp - 0x30]
call fcn.004472d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
push str.ignoring_unrecognised_Latin_1_keysym_0x_x
mov eax, 8
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, esi
shr ecx, 8
and eax, 1
mov dword [ebp + 8], eax
test eax, eax
je 0x447bfc
xor cl, 1
mov byte [ebp + 0x13], cl
jmp 0x447bff
mov byte [ebp + 0x13], cl
xor eax, eax
mov dword [ebp - 0x48], 0x11
mov dword [ebp - 0x44], eax
mov word [ebp - 0x40], ax
mov dword [ebp - 0x3c], 0x12
mov dword [ebp - 0x38], eax
mov word [ebp - 0x34], ax
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x14], eax
mov word [ebp - 0x10], ax
mov dword [ebp - 0x24], 0xa0
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x30], 0xa1
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
cmp byte [ebp + 0xc], al
je 0x447c9e
test cl, 2
je 0x447c5c
lea esi, [ebp - 0x48]
call fcn.004471f0
mov cl, byte [ebp + 0x13]
test cl, 4
je 0x447c6c
lea esi, [ebp - 0x3c]
call fcn.004471f0
mov cl, byte [ebp + 0x13]
test cl, 1
je 0x447c7b
lea esi, [ebp - 0x18]
call fcn.004471f0
jmp 0x447c9e
cmp bl, 0x20
je 0x447c9e
cmp dword [0x513790], 1
jne 0x447c8e
lea esi, [ebp - 0x18]
jmp 0x447c99
lea esi, [ebp - 0x24]
call fcn.00447260
lea esi, [ebp - 0x30]
call fcn.00447260
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
push eax
push ecx
movzx esi, bl
push esi
push edi
push edi
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_capslockOn__d_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
xor eax, eax
add esp, 0x18
cmp byte [ebp + 0xc], al
push 0
setne al
push esi
dec eax
and eax, 2
mov edi, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
mov bl, al
call fcn.00415230
add esp, 4
lea esi, [ebp - 0x30]
call fcn.004472d0
lea esi, [ebp - 0x24]
call fcn.004472d0
lea esi, [ebp - 0x18]
call fcn.004472d0
lea esi, [ebp - 0x3c]
call fcn.004472d0
lea esi, [ebp - 0x48]
call fcn.004472d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ebx, [ebp + 8]
lea eax, [ebp + 0x10]
call fcn.00448330
mov edx, dword [eax]
cmp edx, dword [0x5448d4]
jne 0x447d37
push edi
push str.ignoring_unknown_keysym__d_n
jmp 0x447bc2
lea eax, [ebp + 8]
call fcn.004482c0
mov bl, byte [eax]
lea edx, [ebp + 8]
mov eax, 0x5448e0
mov byte [ebp + 0x10], bl
xor edi, edi
call fcn.00448390
cmp byte [eax], 0
je 0x447d5d
mov edi, 1
cmp byte [ebp + 0xc], 0
jne 0x447d9a
or edi, 2
cmp dword [0x513790], 1
jne 0x447e88
movzx eax, bl
sub eax, 0xa1
je 0x447e83
sub eax, 2
je 0x447e7f
sub eax, 2
jne 0x447e88
mov bl, 0x12
jmp 0x447e85
cmp bl, 0x2e
jne 0x447d66
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
je 0x447d66
push 0x12
call esi
mov edx, 0x8000
test dx, ax
je 0x447d66
cmp dword [0x513790], 2
jne 0x447d66
push str.CAD_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
cmp dword [0x513788], 6
mov eax, 9
mov ecx, 0x4ecb00
jb 0x447e38
cmp dword [0x544798], 0
je 0x447e31
push str.Vista_and_runnning_as_system____CAD_n
call fcn.00403230
add esp, 4
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push 0x4176d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Vista_and_runnning_as_user____Taskmgr_n
jmp 0x447e61
cmp dword [0x544798], 0
je 0x447e5c
push str.Not_Vista_and_runnning_as_system__use_old_method_n
call fcn.00403230
add esp, 4
call fcn.0045e480
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Not_Vista_and_runnning_as_user____Taskmgr_n
call fcn.00403230
add esp, 4
push 1
push str.taskmgr.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov bl, 0x11
jmp 0x447e85
mov bl, 0x10
mov byte [ebp + 0x10], bl
movzx ecx, bl
push 0
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, dword [ebp + 0x10]
push edx
mov bl, al
call fcn.00415230
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc