Function at 0x43f450
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf0e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2bc
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
and al, 0x20
xor esi, esi
cmp al, 0x20
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x24], esi
sete byte [ebp - 0xd]
call fcn.004a4720
push esi
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [0x50b39c]
mov dword [ebp - 4], esi
call fcn.004065f0
test eax, eax
jl 0x43f4d7
lea ecx, [ebp - 0x2c]
call fcn.004a4800
mov ecx, eax
call fcn.004a4a70
test eax, eax
je 0x43f4d7
lea ecx, [ebp - 0x2c]
call fcn.004a4800
mov ecx, eax
call fcn.004a4a70
mov ecx, eax
call fcn.004786d0
mov dword [ebp - 0x24], eax
mov edx, dword [0x50b3a0]
mov eax, dword [edx + 0x115c]
push 0x1c68
lea ecx, [ebx + 0x1c]
push esi
push ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov byte [ebp - 0xf], 0
call fcn.004b03e0
lea edx, [ebx + 0x5c]
add esp, 0xc
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
lea edi, [ebx + 0x24]
mov dword [ebp - 0x28], edx
jmp 0x43f520
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x50b3a0]
push eax
call fcn.00443590
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x43f667
mov eax, dword [ebp - 0x18]
inc esi
cmp eax, 9
mov dword [ebp - 0x4c], esi
mov dword [edi - 8], esi
mov dword [edi - 4], 0
jge 0x43f563
inc eax
push eax
push 0x4d3c14
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x43f57a
jne 0x43f575
push str.10:
push edi
call fcn.0040ee90
add esp, 8
jmp 0x43f57a
xor ecx, ecx
mov word [edi], cx
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43f580
sub eax, edx
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 4]
sar eax, 1
mov ecx, eax
mov eax, edx
lea esi, [eax + 2]
mov dword [ebp - 0x1c], esi
nop
mov si, word [eax]
add eax, 2
test si, si
jne 0x43f5a0
sub eax, dword [ebp - 0x1c]
sar eax, 1
add eax, ecx
cmp eax, 0x1e
jge 0x43f5d9
mov eax, 0x20
sub eax, ecx
push eax
push edx
mov edx, dword [ebp - 0x20]
add edx, ecx
lea eax, [ebx + edx*2 + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x43f602
mov eax, 0x1f
sub eax, ecx
push eax
push edx
mov edx, dword [ebp - 0x20]
add edx, ecx
lea eax, [ebx + edx*2 + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp - 0x28]
mov ecx, 0x2026
mov word [edx], cx
mov eax, 0x1d
mov ecx, dword [ebp - 0x20]
add eax, ecx
mov ecx, 0xbb
mov word [ebx + eax*2 + 0x26], cx
mov edx, 9
mov word [ebx + eax*2 + 0x24], dx
xor edx, edx
xor ecx, ecx
cmp byte [ebp - 0xd], cl
push edi
setne cl
mov word [ebx + eax*2 + 0x28], dx
mov eax, dword [edi - 8]
mov edx, dword [ebp - 0x14]
push eax
push 0x400
dec ecx
push ecx
push edx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov esi, dword [ebp - 0x4c]
add dword [ebp - 0x20], 0x24
add dword [ebp - 0x28], 0x48
inc dword [ebp - 0x18]
add edi, 0x48
cmp dword [ebp - 0x34], 0
mov dword [ebp - 0x48], esi
jne 0x43f65d
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x18], 0x10
jl 0x43f520
xor eax, eax
inc esi
cmp byte [ebp - 0xd], al
push str.Setup_tasks...
setne al
push esi
push 0x400
mov dword [ebp - 0x5c], esi
dec eax
push eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
lea ecx, [esi + 1]
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x43f7d0
cmp word [ecx], 0
je 0x43f7d0
lea edx, [esi + esi*8]
lea eax, [ebx + edx*8]
lea edi, [eax + 0x24]
add eax, 0x62
mov byte [ebp - 0xe], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x28], eax
jmp 0x43f6d3
mov ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x18], 0x10
jge 0x43f7d0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x43f6f7
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43f7a5
mov ecx, dword [ebp - 0x30]
inc esi
mov eax, ecx
mov dword [ebp - 0x4c], esi
mov dword [edi - 8], esi
lea esi, [edi + 2]
lea edx, [eax + 2]
mov dword [esi - 6], ecx
mov dword [ebp - 0x1c], edx
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x43f710
sub eax, dword [ebp - 0x1c]
sar eax, 1
cmp eax, 0x20
jl 0x43f74b
lea eax, [ecx + eax*2 - 0x3c]
push eax
push 0
mov eax, 0x1f
mov edx, 0x2026
push esi
mov ecx, eax
mov word [edi], dx
call fcn.0043db00
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov word [edx], cx
jmp 0x43f75b
push ecx
push 0
mov eax, 0x20
push edi
mov ecx, eax
call fcn.0043db00
cmp byte [ebp - 0xe], 0
jne 0x43f77c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
push 0
push 0xffffffffffffffff
push 0xc00
push eax
push ecx
mov byte [ebp - 0xe], 1
call dword [sym.imp.USER32.dll_InsertMenuW]
mov edx, dword [edi - 8]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
push edi
push edx
push 0x400
push eax
push ecx
call dword [sym.imp.USER32.dll_InsertMenuW]
add dword [ebp - 0x28], 0x48
mov esi, dword [ebp - 0x4c]
add edi, 0x48
inc dword [ebp - 0x18]
mov byte [ebp - 0xf], 1
mov edx, dword [ebp - 0x30]
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x1c], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43f7b0
sub eax, dword [ebp - 0x1c]
sar eax, 1
lea eax, [edx + eax*2 + 2]
mov dword [ebp - 0x30], eax
cmp word [eax], cx
jne 0x43f6d0
mov edx, dword [ebp - 0x24]
test edx, edx
je 0x43f8a0
cmp word [edx], 0
je 0x43f8a0
lea eax, [esi + esi*8]
lea ecx, [ebx + eax*8]
lea eax, [esi + 1]
mov dword [ecx + 0x1c], eax
mov eax, edx
lea edi, [eax + 2]
mov dword [ebp - 0x24], ecx
mov dword [ecx + 0x20], edx
mov dword [ebp - 0x1c], edi
nop
mov di, word [eax]
add eax, 2
test di, di
jne 0x43f800
sub eax, dword [ebp - 0x1c]
sar eax, 1
cmp eax, 0x20
jl 0x43f83c
push 0x1f
lea edx, [edx + eax*2 - 0x3c]
push edx
mov edi, 0x2026
mov word [ecx + 0x24], di
push 0x1f
add ecx, 0x26
push ecx
call fcn.004097c0
lea eax, [esi + esi*8]
xor ecx, ecx
mov word [ebx + eax*8 + 0x62], cx
jmp 0x43f84a
push 0x20
push edx
lea eax, [ecx + 0x24]
push 0x20
push eax
call fcn.004097c0
movzx edi, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
push 0
push 0
neg edi
push 0xc00
sbb edi, edi
push edi
push edx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
add eax, 0x24
push eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x1c]
push ecx
push 0x400
push edi
push edx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov eax, dword [ebp - 0x14]
push str.New_console_dialog...
add esi, 2
push esi
push 0x400
push edi
push eax
mov dword [ebp - 0x54], esi
call dword [sym.imp.USER32.dll_InsertMenuW]
cmp byte [ebp - 0xf], 0
je 0x43f8c3
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
push str.Clear_history...
inc esi
push esi
push 0x400
push ecx
push edx
mov dword [ebp - 0x50], esi
call dword [sym.imp.USER32.dll_InsertMenuW]
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], eax
lea edi, [eax + 8]
mov eax, dword [ebp + 8]
test eax, eax
je 0x43f8fb
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edx
test eax, eax
je 0x43f97c
mov edi, eax
jmp 0x43f97c
mov eax, dword [0x50b39c]
cmp dword [eax + 0x4234], 0
je 0x43f94b
mov ecx, dword [eax + 0x4234]
call fcn.00491b20
test al, al
je 0x43f94b
mov ecx, dword [0x50b39c]
mov ecx, dword [ecx + 0x4234]
lea eax, [ebp - 0x44]
push eax
push 2
call fcn.00492770
mov eax, dword [0x50b384]
push 2
lea edx, [ebp - 0x44]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x24], ecx
jmp 0x43f97c
mov eax, dword [0x50b384]
lea edx, [ebp - 0x44]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [0x50b384]
push 2
lea ecx, [ebp - 0x44]
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x3c]
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x38]
mov byte [ebx + 1], 0
mov byte [ebx], 1
mov edx, dword [0x50b384]
push edx
mov edx, dword [ebp - 0x14]
push eax
push ecx
or edi, 0x100
push edi
push edx
push 3
mov ecx, ebx
call fcn.0043e200
mov edi, eax
mov eax, dword [ebp - 0x54]
mov byte [ebx + 1], 0
mov byte [ebx], 0
test eax, eax
je 0x43f9ea
cmp edi, eax
jne 0x43f9ea
mov ecx, dword [0x50b3a0]
push 0
push 1
call fcn.00442960
mov ecx, dword [0x50b39c]
push eax
call fcn.0040bd90
jmp 0x43fb29
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x43fa07
cmp edi, eax
jne 0x43fa07
push 0x9d
call fcn.0044f610
add esp, 4
jmp 0x43fb29
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x43fa24
cmp edi, eax
jne 0x43fa24
mov ecx, dword [0x50b3a4]
push 0
call fcn.00450d40
jmp 0x43fb29
cmp edi, 1
jl 0x43fb29
cmp edi, esi
jg 0x43fb29
lea ecx, [ebp - 0x2c8]
call fcn.0046bb70
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 1
test eax, eax
jle 0x43fa6c
cmp edi, eax
jg 0x43fa6c
sub edi, dword [ebp - 0x34]
mov ecx, dword [0x50b3a0]
push edi
call fcn.00443590
test eax, eax
je 0x43fb1a
mov eax, dword [eax + 4]
push eax
jmp 0x43fa79
cmp edi, dword [ebp - 0x58]
jl 0x43fa87
lea ecx, [edi + edi*8]
mov edx, dword [ebx + ecx*8 - 0x28]
push edx
call fcn.00441380
mov dword [ebp - 0x2b8], eax
add esp, 4
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x43facf
mov ecx, dword [0x50b39c]
lea eax, [ebp - 0x2c8]
push eax
call fcn.00405df0
cmp eax, 0x5f4
je 0x43fac8
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0
call fcn.0046bdb0
jmp 0x43fb33
call fcn.004a1ac0
jmp 0x43fae1
mov ecx, dword [ebp - 0x2b8]
push ecx
mov ecx, dword [0x50b3a0]
call fcn.00447fd0
mov edx, dword [0x50b3a0]
cmp byte [edx + 0x11406], 0
je 0x43fb08
mov ecx, dword [0x50b39c]
push 0
push 1
lea eax, [ebp - 0x2c8]
push eax
call fcn.0040b3e0
jmp 0x43fb1a
lea ecx, [ebp - 0x2c8]
push ecx
mov ecx, dword [0x50b39c]
call fcn.0040b170
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0
call fcn.0046bdb0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_DestroyMenu]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8