Function at 0x434da9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x4c0760]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, ecx
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov dword [esp + 0x18], eax
lea esi, [eax - 0x668]
mov dword [esp + 0x1c], ecx
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0xc8]
test al, al
je 0x434e1f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
test al, al
je 0x434e1f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xdc]
mov edi, dword [ebp + 8]
test al, al
jne 0x434e0b
lea eax, [edi - 0x200]
cmp eax, 0xe
jbe 0x434e1f
mov ebx, dword [ebp + 0xc]
cmp edi, 0x20a
jne 0x434e35
test bl, 8
jne 0x434ef3
xor eax, eax
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045fbcc
mov esp, ebp
pop ebp
ret 0x10
cmp edi, 0x100
jne 0x434e62
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x434ef3
cmp ebx, 0x63
je 0x434e5b
cmp ebx, 0x43
jne 0x434ef3
mov ecx, esi
call fcn.0043374d
cmp edi, 0x102
jne 0x434e8e
cmp ebx, 9
jne 0x434ef3
mov eax, dword [esi]
xor ebx, ebx
push ecx
push ebx
push ebx
push str.tabswitch
push esi
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004241da
jmp 0x434e1f
cmp edi, 0x10f
jne 0x434ef3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push dword [eax]
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov edi, eax
test edi, edi
je 0x434e1f
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], ecx
call dword [sym.imp.IMM32.dll_ImmSetCompositionWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push edi
push dword [eax]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
jmp 0x434e1f
xor ebx, ebx
mov byte [esp + 0x13], 1
cmp edi, 0x200
jb 0x434f0a
cmp edi, 0x20e
jbe 0x434f13
cmp edi, 0x20
jne 0x43502c
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
test dword [eax + 0x14], 0x100
jne 0x434f5a
lea eax, [edi - 0x201]
cmp eax, 4
ja 0x434f5a
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00425124
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffff998
cmp eax, ecx
jne 0x434e1f
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 0x14]
and eax, 0x100
neg eax
sbb eax, eax
and eax, 3
jne 0x434fef
mov eax, dword [ecx + 0x30]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx + 0x38]
mov dword [esp + 0x34], eax
mov eax, dword [ecx + 0x2c]
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 0x34]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp edi, 0x20a
jne 0x434fc4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push dword [eax]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x434e1f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp byte [eax + 0xf2], bl
jne 0x434e1f
push 3
pop eax
cmp eax, 3
jne 0x434e1f
cmp edi, 0x20
je 0x4350a9
cmp edi, 0x201
je 0x43501d
cmp edi, 0x203
je 0x43501d
cmp edi, 0x204
jne 0x4350ad
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
jmp 0x4350ad
lea eax, [edi - 0x100]
cmp eax, 9
ja 0x43504a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xec]
test al, al
jne 0x4350ad
jmp 0x434e1f
cmp edi, 0x7b
jne 0x4350a0
mov ecx, dword [ebp + 0x10]
movsx eax, cx
mov dword [esp + 0x14], eax
mov eax, ecx
shr eax, 0x10
mov ecx, esi
cwde
mov dword [esp + 0x18], eax
mov eax, dword [esi]
call dword [eax + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push dword [eax]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [esp + 0x18]
mov eax, dword [esi]
mov ecx, esi
push dword [esp + 0x18]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00425124
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffff998
cmp eax, ecx
je 0x4350ad
jmp 0x434e1f
cmp edi, 0x53
jne 0x434e1f
mov byte [esp + 0x13], bl
mov eax, dword [esi]
lea ecx, [esp + 0x24]
push ecx
push dword [ebp + 0x10]
mov ecx, esi
mov dword [esp + 0x2c], ebx
push dword [ebp + 0xc]
push edi
call dword [eax + 0x1b0]
mov ecx, 0x100
mov dword [esp + 0x14], eax
cmp edi, ecx
jne 0x4350db
cmp word [ebp + 0xc], 0x2e
je 0x4350eb
cmp edi, 0x286
je 0x4350eb
cmp edi, 0x102
jne 0x43510b
mov eax, dword [esi]
push ecx
push ebx
push ebx
push str.textchanged
push esi
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004241da
mov eax, dword [esp + 0x14]
mov ecx, 0x100
test eax, eax
je 0x435142
cmp edi, ecx
jb 0x43511b
cmp edi, 0x109
jbe 0x435142
cmp edi, 0x102
je 0x435142
cmp edi, 0x286
je 0x435142
lea eax, [edi - 0x200]
cmp eax, 0xe
ja 0x43514c
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
test dword [eax + 0x14], ecx
je 0x43514c
mov ecx, dword [esp + 0x20]
mov al, byte [esp + 0x13]
mov byte [ecx], al
mov eax, dword [esp + 0x24]
jmp 0x434e21