Function at 0x43df90
Capabilities:
Log keystrokes via polling
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x599630
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x60f520]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov eax, dword [ebp + 0x14]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov dword [eax], 0
call esi
movzx edi, ax
push 0x11
and edi, 0x8000
call esi
and eax, 0xff00
push 0x12
mov dword [esp + 0x14], eax
call esi
movzx esi, ax
and esi, 0x8000
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x4c], 0
mov ecx, dword [ebx + 4]
push eax
call fcn.00471340
mov eax, dword [ebp + 0xc]
cmp eax, 0x71
jne 0x43e056
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
sub eax, esi
and eax, 0xfffffffc
cmp eax, 4
jne 0x43e554
mov ecx, dword [ebx + 4]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x154]
jmp 0x43e554
cmp dword [esp + 0x10], 0
je 0x43e3bf
cmp eax, 0x63
je 0x43e2b8
cmp eax, 0x43
je 0x43e2b8
cmp eax, 0x78
je 0x43e19a
cmp eax, 0x58
je 0x43e19a
cmp eax, 0x76
je 0x43e0f8
cmp eax, 0x56
je 0x43e0f8
cmp eax, 0x61
je 0x43e099
cmp eax, 0x41
jne 0x43e0e1
test esi, esi
jne 0x43e0e1
call fcn.004bdd20
push esi
push 0x637458
push 0x636d14
push esi
push dword [eax]
call fcn.00589362
mov esi, eax
add esp, 0x14
mov dword [esp + 0x14], esi
test esi, esi
je 0x43e0c8
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov byte [esp + 0x48], 7
test esi, esi
je 0x43e547
mov ecx, esi
call fcn.004220b0
jmp 0x43e545
cmp eax, 0x64
je 0x43e3c4
cmp eax, 0x44
jne 0x43e554
jmp 0x43e3c4
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov byte [esp + 0x48], 5
mov ecx, dword [ebx + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0xb0]
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.004250e0
mov eax, dword [esp + 0x2c]
add esp, 4
sub eax, dword [esp + 0x24]
sar eax, 2
test eax, eax
je 0x43e18c
call fcn.004bdd20
push 0
push 0x637458
push 0x636d14
push 0
push dword [eax]
call fcn.00589362
mov esi, eax
add esp, 0x14
mov dword [esp + 0x14], esi
test esi, esi
je 0x43e16b
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov byte [esp + 0x48], 6
test esi, esi
je 0x43e17d
push 0
mov ecx, esi
call fcn.00421be0
mov byte [esp + 0x48], 5
test esi, esi
je 0x43e18c
mov eax, dword [esi]
push esi
call dword [eax + 8]
lea ecx, [esp + 0x24]
call fcn.0040b790
jmp 0x43e554
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
call dword [eax + 0xb0]
mov ecx, eax
call fcn.00424c50
push ecx
mov ecx, esp
mov dword [esp + 0x3c], 0
push str.SetAllItemState
mov dword [esp + 0x3c], 0
lea esi, [esp + 0x38]
mov dword [esp + 0x38], 2
call fcn.0040c2d0
mov ecx, esi
call fcn.0040ba40
xor edi, edi
add esp, 4
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov byte [esp + 0x48], 3
xor esi, esi
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
sub eax, edx
sar eax, 2
test eax, eax
je 0x43e270
mov ecx, dword [edx + esi*4]
mov edi, dword [ecx + 0x104]
test edi, edi
je 0x43e25e
mov eax, dword [ecx]
push 1
call dword [eax + 0x154]
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.0044d300
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 4
call fcn.00409aa0
mov byte [esp + 0x48], 3
or ecx, 0xffffffff
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43e25a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
inc esi
sub eax, edx
sar eax, 2
cmp esi, eax
jb 0x43e205
mov edi, dword [esp + 0x24]
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
call dword [eax + 0xb0]
sub esp, 0xc
mov esi, eax
lea eax, [esp + 0x30]
mov ecx, esp
push eax
call fcn.00419790
mov edx, esi
xor ecx, ecx
call fcn.00424c70
add esp, 0xc
test edi, edi
je 0x43e554
push dword [esp + 0x28]
push edi
call fcn.0040b740
push edi
call fcn.00551995
add esp, 4
jmp 0x43e554
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x48], 1
xor esi, esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x43e351
mov eax, dword [ecx + esi*4]
mov edi, dword [eax + 0x104]
test edi, edi
je 0x43e33b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
cmp eax, 8
je 0x43e337
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.0044d300
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 2
call fcn.00409aa0
mov byte [esp + 0x48], 1
or ecx, 0xffffffff
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43e337
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
inc esi
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x43e2e0
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0xb0]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43e377
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0xb0]
sub esp, 0xc
mov esi, eax
lea eax, [esp + 0x30]
mov ecx, esp
push eax
call fcn.00419790
mov edx, esi
mov ecx, 1
call fcn.00424c70
add esp, 0xc
test edi, edi
je 0x43e554
push ebx
push edi
call fcn.0040b740
push edi
call fcn.00551995
add esp, 4
jmp 0x43e554
cmp eax, 0x2e
jne 0x43e3e0
push edi
sub esp, 0xc
lea eax, [esp + 0x28]
mov ecx, esp
push eax
call fcn.00409da0
mov ecx, ebx
call fcn.0043e890
jmp 0x43e554
cmp eax, 0xd
jne 0x43e40d
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
sub eax, esi
and eax, 0xfffffffc
cmp eax, 4
jne 0x43e554
mov ecx, dword [ebx + 4]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x158]
jmp 0x43e554
cmp eax, 0x74
jne 0x43e41f
sub esp, 0x10
call fcn.00421790
jmp 0x43e554
cmp eax, 0x25
jne 0x43e465
call fcn.004bdd20
push 0
push 0x637458
push 0x636d14
push 0
push dword [eax]
call fcn.00589362
mov esi, eax
add esp, 0x14
mov dword [esp + 0x10], esi
test esi, esi
je 0x43e451
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov byte [esp + 0x48], 8
test esi, esi
je 0x43e547
push 0
jmp 0x43e527
cmp eax, 0x26
jne 0x43e4ab
call fcn.004bdd20
push 0
push 0x637458
push 0x636d14
push 0
push dword [eax]
call fcn.00589362
mov esi, eax
add esp, 0x14
mov dword [esp + 0x10], esi
test esi, esi
je 0x43e497
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov byte [esp + 0x48], 9
test esi, esi
je 0x43e547
push 2
jmp 0x43e527
cmp eax, 0x27
jne 0x43e4ea
call fcn.004bdd20
push 0
push 0x637458
push 0x636d14
push 0
push dword [eax]
call fcn.00589362
mov esi, eax
add esp, 0x14
mov dword [esp + 0x10], esi
test esi, esi
je 0x43e4dd
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov byte [esp + 0x48], 0xa
test esi, esi
je 0x43e547
push 1
jmp 0x43e527
cmp eax, 0x28
jne 0x43e554
call fcn.004bdd20
push 0
push 0x637458
push 0x636d14
push 0
push dword [eax]
call fcn.00589362
mov esi, eax
add esp, 0x14
mov dword [esp + 0x10], esi
test esi, esi
je 0x43e51c
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov byte [esp + 0x48], 0xb
test esi, esi
je 0x43e547
push 3
mov ecx, dword [esi + 0x104]
lea eax, [esp + 0x18]
push eax
call fcn.00406ea0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43e545
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
mov byte [esp + 0x48], 0
je 0x43e554
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov dword [esp + 0x48], 0xffffffff
mov esi, dword [esp + 0x18]
test esi, esi
je 0x43e58f
mov edi, dword [esp + 0x1c]
cmp esi, edi
je 0x43e583
lea esp, [esp]
mov ecx, dword [esi]
test ecx, ecx
je 0x43e57c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
add esi, 4
cmp esi, edi
jne 0x43e570
push dword [esp + 0x18]
call fcn.00551995
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10