Function at 0x43b7eb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
mov esi, ecx
xor edx, edx
cmp esi, edx
jne 0x43b801
xor al, al
jmp 0x43bb3b
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
push edi
cmp eax, 0xffffff6a
je 0x43ba97
cmp eax, 0xffffff4f
je 0x43ba97
cmp eax, 0xffffff94
jne 0x43b897
call fcn.0043b72d
lea edi, [esi + 0x10]
mov eax, dword [edi]
push 0xffffffffffffffff
and eax, 0x7f
push eax
mov ecx, esi
call fcn.0043937a
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x43b849
inc edi
mov ecx, dword [ebx + 0x10]
mov eax, dword [esi + 0x28]
mov al, byte [eax + ecx]
mov cl, byte [edi]
mov dl, cl
and dl, 0x7f
cmp dl, al
jne 0x43b867
movzx eax, cl
xor eax, 0x80
jmp 0x43b86a
movzx eax, al
mov byte [edi], al
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ecx, esi
call fcn.0043a4da
mov eax, dword [esi + 0x10]
mov ecx, eax
shr ecx, 7
not ecx
and ecx, 1
push ecx
and eax, 0x7f
push eax
mov ecx, esi
call fcn.0043937a
jmp 0x43bb37
cmp eax, 0xfffffff4
jne 0x43b9a3
mov edi, 0x10000
cmp byte [0x484979], dl
je 0x43b8cb
test dword [ebx + 0xc], edi
je 0x43b8d7
test byte [ebx + 0x24], 1
je 0x43b8d7
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call fcn.0043a863
mov dword [ebx + 0x34], eax
jmp 0x43b8d7
mov eax, dword [esi + 4]
cmp dword [eax + 0x24], edx
je 0x43ba3e
mov eax, dword [ebx + 0xc]
dec eax
je 0x43b994
sub eax, edi
je 0x43b984
sub eax, 0x20000
je 0x43b8f8
dec eax
je 0x43b919
jmp 0x43bb37
mov ecx, dword [esi + 0xc]
push 0x10
call fcn.0043d098
cmp byte [0x4847d8], 0
je 0x43bb37
cmp dword [ebx + 0x38], 0
jne 0x43bb37
mov ecx, dword [esi + 0x28]
mov eax, dword [ebx + 0x38]
mov cl, byte [eax + ecx]
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [esi + 4]
test dword [ecx + 0x24], edx
jne 0x43b933
push 0
jmp 0x43b996
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x24]
mov dword [ebp - 0x14], 2
push 0x1038
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [ebx + 0x38]
sub dword [ebp - 0x14], eax
mov ecx, dword [esi + 0x28]
movzx ecx, byte [ecx + edx]
push dword [esi + 0xc]
mov eax, dword [esi + 4]
push ecx
lea edx, [ebp - 0x14]
mov ecx, ebx
call dword [eax + 0x20]
mov ecx, dword [esi + 0xc]
test al, al
je 0x43b980
push 4
jmp 0x43b999
push 0
jmp 0x43b999
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x24]
neg eax
sbb eax, eax
and eax, 0x20
push eax
jmp 0x43b996
push 0x20
mov ecx, dword [esi + 0xc]
call fcn.0043d098
jmp 0x43bb37
cmp eax, 0xffffff65
jne 0x43ba45
cmp word [ebx + 0xc], 0x41
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
jne 0x43b9e5
push 0x11
call edi
test ax, ax
jge 0x43b9e5
push 2
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x43bb37
cmp word [ebx + 0xc], 0x43
jne 0x43ba01
push 0x11
call edi
test ax, ax
jge 0x43ba01
mov ecx, esi
call fcn.0043b3c6
jmp 0x43bb37
cmp word [ebx + 0xc], 0x71
jne 0x43ba3e
mov eax, dword [esi + 4]
test byte [eax + 0x30], 1
je 0x43ba3e
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebx]
call esi
mov edi, eax
test edi, edi
jl 0x43ba3e
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push edi
push 0x1076
push dword [ebx]
call esi
xor al, al
jmp 0x43bb39
cmp eax, 0xffffff4d
jne 0x43ba3e
mov eax, dword [esi + 4]
cmp dword [eax + 0x2c], edx
je 0x43ba3e
mov eax, dword [ebx + 0x10]
or dword [ebp - 4], 0xffffffff
test al, 2
je 0x43ba8f
mov edi, dword [ebx + 0xc]
and eax, 0x20
mov dword [ebp + 8], eax
cmp edi, dword [esi + 0x14]
jb 0x43ba77
xor edi, edi
cmp dword [ebp + 8], edi
je 0x43ba8f
mov dword [ebp + 8], edi
push dword [esi + 0xc]
mov eax, dword [esi + 4]
mov edx, dword [ebx + 0x14]
mov ecx, edi
call dword [eax + 0x2c]
test al, al
jne 0x43ba8c
inc edi
jmp 0x43ba68
mov dword [ebp - 4], edi
push dword [ebp - 4]
jmp 0x43b996
lea edi, [ebx + 0xc]
test byte [edi], 1
mov ecx, dword [edi + 0x18]
mov dword [ebp - 4], ecx
je 0x43bac2
mov eax, 0x104
cmp ecx, eax
jge 0x43bab0
mov eax, ecx
mov dword [edi + 0x18], eax
xor eax, eax
mov word [0x484030], ax
mov dword [edi + 0x14], 0x484030
mov ecx, dword [edi + 8]
mov dword [edi + 0x24], edx
mov eax, dword [esi + 0x28]
mov dword [ebp + 8], ecx
cmp eax, edx
je 0x43bad8
movzx eax, byte [eax + ecx]
jmp 0x43bada
xor eax, eax
mov dword [edi + 8], eax
mov eax, dword [esi + 4]
mov edx, dword [eax + 0xc]
imul edx, dword [edi + 4]
push dword [esi + 0xc]
add edx, dword [esi + 0x18]
mov ecx, edi
call dword [eax + 0x1c]
test byte [edi], 1
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
je 0x43bb21
mov eax, dword [edi + 0x14]
mov esi, 0x484030
cmp eax, esi
je 0x43bb21
test eax, eax
jne 0x43bb12
mov eax, 0x4652b0
push dword [edi + 0x18]
mov edx, eax
mov ecx, esi
call fcn.0040f153
mov dword [edi + 0x14], esi
mov eax, dword [ebp - 4]
mov dword [edi + 0x18], eax
cmp dword [ebx + 8], 0xffffff6a
jne 0x43bb37
mov ecx, edi
call fcn.00448f16
mov al, 1
pop edi
pop ebx
pop esi
leave
ret 4