Function at 0x432b3c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov edi, ecx
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
push 0x49f778
push 8
push 0x481eac
call fcn.00407ffc
add esp, 0x10
mov ebx, dword [ebp + 8]
cmp ebx, 0xfe50
jb 0x432bc6
cmp ebx, 0xfe60
ja 0x432bc6
mov dword [0x493140], ebx
push 0x49f788
push 8
push 0x481eac
call fcn.00407ffc
add esp, 0xc
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
cmp ebx, 0x20
jb 0x432bd0
cmp ebx, 0x7e
jbe 0x432be8
cmp ebx, 0xa0
jb 0x432fcc
cmp ebx, 0xff
ja 0x432fcc
mov edx, dword [0x493140]
test edx, edx
je 0x432dac
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x432dac
push ebx
push edx
push 0x49f7a4
push 8
push 0x481eac
call fcn.00407ffc
add esp, 0x14
mov eax, dword [0x493140]
cmp eax, 0xfe50
je 0x43322e
cmp eax, 0xfe51
je 0x43310e
cmp eax, 0xfe52
je 0x43304c
cmp eax, 0xfe53
je 0x432c67
cmp eax, 0xfe57
jne 0x432c50
mov eax, dword [ebp + 8]
jmp 0x432cb3
cmp eax, 0xfe5b
jne 0x432c5f
mov eax, dword [ebp + 8]
jmp case.0x432cc6.66
mov eax, dword [ebp + 8]
jmp 0x432d8a
mov eax, dword [ebp + 8]
cmp eax, 0x41
je 0x43303b
cmp eax, 0x4f
je 0x43302a
cmp eax, 0x61
je 0x432ca7
cmp eax, 0x6e
jne 0x432c94
mov eax, 0xf1
mov dword [ebp + 8], 0xf1
jmp 0x432cb3
cmp eax, 0x6f
jne 0x432cb3
mov eax, 0xf5
mov dword [ebp + 8], 0xf5
jmp 0x432cb3
mov eax, 0xe3
mov dword [ebp + 8], 0xe3
lea edx, [eax - 0x41]
cmp edx, 0x38
ja case.0x432cc6.66
mov edx, dword [edx*4 + 0x475be0]
jmp edx
mov eax, 0xff
mov dword [ebp + 8], 0xff
jmp case.0x432cc6.66
mov eax, 0xfc
mov dword [ebp + 8], 0xfc
jmp case.0x432cc6.66
mov eax, 0xf6
mov dword [ebp + 8], 0xf6
jmp case.0x432cc6.66
mov eax, 0xef
mov dword [ebp + 8], 0xef
jmp case.0x432cc6.66
mov eax, 0xeb
mov dword [ebp + 8], 0xeb
jmp case.0x432cc6.66
mov eax, 0xe4
mov dword [ebp + 8], 0xe4
jmp case.0x432cc6.66
mov eax, 0xdc
mov dword [ebp + 8], 0xdc
jmp case.0x432cc6.66
mov eax, 0xd6
mov dword [ebp + 8], 0xd6
jmp case.0x432cc6.66
mov eax, 0xcf
mov dword [ebp + 8], 0xcf
jmp case.0x432cc6.66
mov eax, 0xcb
mov dword [ebp + 8], 0xcb
jmp case.0x432cc6.66
mov eax, 0xc4
mov dword [ebp + 8], 0xc4
cmp eax, 0x43
jne 0x432d79
mov eax, 0xc7
mov dword [ebp + 8], 0xc7
jmp 0x432d8a
cmp eax, 0x63
jne 0x432d8a
mov eax, 0xe7
mov dword [ebp + 8], 0xe7
mov dword [0x493140], 0
push eax
push 0x49f7bc
push 8
push 0x481eac
call fcn.00407ffc
add esp, 0x10
mov ebx, dword [ebp + 8]
movsx eax, bl
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx eax, ax
mov dword [ebp - 0x18], eax
push eax
push 0x49f7cc
push 8
push 0x481eac
call fcn.00407ffc
add esp, 0x10
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
jne 0x432e63
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x433466
push 0x49f7d8
push 8
push 0x481eac
call fcn.00407ffc
push 0x49f7e0
push 8
push 0x481eac
call fcn.00407ffc
add esp, 0x18
xor edi, edi
mov ecx, dword [ebp + 8]
movzx eax, word [edi*2 + 0x47e220]
cmp ecx, eax
je 0x433322
inc edi
movzx eax, word [edi*2 + 0x47e220]
cmp ecx, eax
je 0x433322
inc edi
movzx eax, word [edi*2 + 0x47e220]
cmp ecx, eax
je 0x433322
inc edi
movzx eax, word [edi*2 + 0x47e220]
cmp ecx, eax
je 0x433322
inc edi
cmp edi, 0x100
jl 0x432e12
jmp 0x433322
movzx eax, al
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x1c], eax
push 0
push 0x11
call fcn.00433620
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x58]
push 0x12
call fcn.00433620
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x4c]
push 0x10
call fcn.00433620
mov dword [ebp - 4], 2
push 0
lea ecx, [ebp - 0x40]
push 0xa0
call fcn.00433620
mov dword [ebp - 4], 3
push 0
lea ecx, [ebp - 0x34]
push 0xa1
call fcn.00433620
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x432f2a
mov ebx, dword [ebp - 0x18]
shr ebx, 8
movzx ebx, bl
test bl, 2
je 0x432eeb
lea ecx, [ebp - 0x64]
call fcn.00432ae8
test bl, 4
je 0x432ef8
lea ecx, [ebp - 0x58]
call fcn.00432ae8
test bl, 1
je 0x432f07
lea ecx, [ebp - 0x4c]
call fcn.00432ae8
jmp 0x432f2a
call fcn.00444ab8
test eax, eax
je 0x432f1a
lea ecx, [ebp - 0x4c]
call fcn.004335e0
jmp 0x432f2a
lea ecx, [ebp - 0x40]
call fcn.004335e0
lea ecx, [ebp - 0x34]
call fcn.004335e0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
push eax
push edx
push ecx
push ecx
push 0x49f818
push 9
push 0x481eac
call fcn.00407ffc
add esp, 0x1c
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x432f56
xor eax, eax
jmp 0x432f5b
mov eax, 2
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004335bc
add esp, 8
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x34]
call fcn.0043355c
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.0043355c
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.0043355c
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0043355c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.0043355c
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
lea edx, [ebp - 0x6c]
lea eax, [ebp + 8]
mov ecx, edi
push eax
push edx
call fcn.0043363c
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.00433770
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x6c]
push eax
call fcn.00440834
movzx eax, al
test eax, eax
je 0x433496
push dword [ebp + 8]
push 0x49f84c
push 8
push 0x481eac
call fcn.00407ffc
add esp, 0x10
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov eax, 0xd5
mov dword [ebp + 8], 0xd5
jmp 0x432cb3
mov eax, 0xd1
mov dword [ebp + 8], 0xd1
jmp 0x432cb3
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x41]
cmp ecx, 0x34
ja case.0x433062.1
mov edx, dword [ecx*4 + 0x475b00]
jmp edx
mov eax, 0xfb
mov dword [ebp + 8], 0xfb
jmp case.0x433062.1
mov eax, 0xf4
mov dword [ebp + 8], 0xf4
jmp case.0x433062.1
mov eax, 0xee
mov dword [ebp + 8], 0xee
jmp case.0x433062.1
mov eax, 0xea
mov dword [ebp + 8], 0xea
jmp case.0x433062.1
mov eax, 0xe2
mov dword [ebp + 8], 0xe2
jmp case.0x433062.1
mov eax, 0xdb
mov dword [ebp + 8], 0xdb
jmp case.0x433062.1
mov eax, 0xd4
mov dword [ebp + 8], 0xd4
jmp case.0x433062.1
mov eax, 0xce
mov dword [ebp + 8], 0xce
jmp case.0x433062.1
mov eax, 0xca
mov dword [ebp + 8], 0xca
jmp case.0x433062.1
mov eax, 0xc2
mov dword [ebp + 8], 0xc2
jmp case.0x433062.1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x41]
cmp ecx, 0x38
ja case.0x433124.1
mov edx, dword [ecx*4 + 0x475a00]
jmp edx
mov eax, 0xfd
mov ecx, 0xbc
mov dword [ebp + 8], 0xfd
jmp case.0x433124.1
mov eax, 0xfa
mov ecx, 0xb9
mov dword [ebp + 8], 0xfa
jmp case.0x433124.1
mov eax, 0xf3
mov ecx, 0xb2
mov dword [ebp + 8], 0xf3
jmp case.0x433124.1
mov eax, 0xed
mov ecx, 0xac
mov dword [ebp + 8], 0xed
jmp case.0x433124.1
mov eax, 0xe9
mov ecx, 0xa8
mov dword [ebp + 8], 0xe9
jmp case.0x433124.1
mov eax, 0xe1
mov ecx, 0xa0
mov dword [ebp + 8], 0xe1
jmp case.0x433124.1
mov eax, 0xdd
mov ecx, 0x9c
mov dword [ebp + 8], 0xdd
jmp case.0x433124.1
mov eax, 0xda
mov ecx, 0x99
mov dword [ebp + 8], 0xda
jmp case.0x433124.1
mov eax, 0xd3
mov ecx, 0x92
mov dword [ebp + 8], 0xd3
jmp case.0x433124.1
mov eax, 0xcd
mov ecx, 0x8c
mov dword [ebp + 8], 0xcd
jmp case.0x433124.1
mov eax, 0xc9
mov ecx, 0x88
mov dword [ebp + 8], 0xc9
jmp case.0x433124.1
mov eax, 0xc1
mov ecx, 0x80
mov dword [ebp + 8], 0xc1
jmp case.0x433124.1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x41]
cmp ecx, 0x34
ja case.0x433244.66
mov edx, dword [ecx*4 + 0x475920]
jmp edx
mov eax, 0xf9
mov ecx, 0xb8
mov dword [ebp + 8], 0xf9
jmp case.0x433244.66
mov eax, 0xf2
mov ecx, 0xb1
mov dword [ebp + 8], 0xf2
jmp case.0x433244.66
mov eax, 0xec
mov ecx, 0xab
mov dword [ebp + 8], 0xec
jmp case.0x433244.66
mov eax, 0xe8
mov ecx, 0xa7
mov dword [ebp + 8], 0xe8
jmp case.0x433244.66
mov eax, 0xe0
mov ecx, 0x9f
mov dword [ebp + 8], 0xe0
jmp case.0x433244.66
mov eax, 0xd9
mov ecx, 0x98
mov dword [ebp + 8], 0xd9
jmp case.0x433244.66
mov eax, 0xd2
mov ecx, 0x91
mov dword [ebp + 8], 0xd2
jmp case.0x433244.66
mov eax, 0xcc
mov ecx, 0x8b
mov dword [ebp + 8], 0xcc
jmp case.0x433244.66
mov eax, 0xc8
mov ecx, 0x87
mov dword [ebp + 8], 0xc8
jmp case.0x433244.66
mov eax, 0xc0
mov ecx, 0x7f
mov dword [ebp + 8], 0xc0
jmp case.0x433244.66
mov eax, 0x51eb851f
mov ebx, edi
sar ebx, 0x1f
imul edi
sar edx, 5
sub edx, ebx
lea esi, [edx + edx]
add esi, esi
sub esi, edx
lea eax, [edx + esi*8]
add eax, eax
add eax, eax
sub edi, eax
movzx edx, dl
mov dword [ebp - 0x1c], edx
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edi
sar eax, 0x1f
sub edx, eax
lea eax, [edx + edx]
add eax, eax
add eax, edx
add eax, eax
sub edi, eax
movzx ebx, dl
mov esi, edi
and esi, 0xff
cmp edi, 0xff
je 0x43347f
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx eax, al
xor ecx, ecx
push ecx
push ecx
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [ebp - 0x1c]
add eax, 0x60
mov dword [ebp - 0x1c], eax
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edi, dword [ebp - 0x1c]
and edi, 0xff
movzx eax, al
xor ecx, ecx
push ecx
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_keybd_event]
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx eax, al
push 0
push 2
push eax
push edi
call dword [sym.imp.USER32.dll_keybd_event]
add ebx, 0x60
push 0
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx edi, bl
movzx eax, al
xor ecx, ecx
push ecx
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx eax, al
push 0
push 2
push eax
push edi
call dword [sym.imp.USER32.dll_keybd_event]
add esi, 0x60
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, esi
and ebx, 0xff
movzx eax, al
xor edx, edx
push edx
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx eax, al
push 0
push 2
push eax
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx eax, al
push 0
push 2
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push ecx
push 0x49f7ec
push 8
push 0x481eac
call fcn.00407ffc
add esp, 0x10
jmp 0x433466
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00433a80
movzx esi, byte [eax]
xor ebx, ebx
add edi, 0x10
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.004342f8
movzx eax, byte [eax]
test eax, eax
je 0x4334c0
mov ebx, 1
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4334ca
or ebx, 2
test eax, eax
je 0x4334d3
cmp esi, 0x2e
je 0x433516
call fcn.00444ab8
test eax, eax
je 0x433507
cmp esi, 0xa1
je 0x433502
cmp esi, 0xa3
jne 0x4334f3
mov esi, 0x11
jmp 0x433507
cmp esi, 0xa5
jne 0x433507
mov esi, 0x12
jmp 0x433507
mov esi, 0x10
push ebx
push esi
call fcn.004335bc
add esp, 8
jmp 0x432fb3
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test eax, 0x8000
je 0x4334d3
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test eax, 0x8000
je 0x4334d3
call fcn.00443bd8
test eax, eax
je 0x4334d3
call fcn.00444c54
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8