Function at 0x432710
Capabilities:
Inspect section memory permissions
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi]
call fcn.004b2b30
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov eax, dword [esi]
test dword [eax + 0x214], 0x10000000
je 0x432737
mov dword [esi + 8], 0x1000000
test dword [eax + 0x214], 0x20000000
je 0x43274a
or dword [esi + 8], 0x2000000
test dword [eax + 0x214], 0x40000000
je 0x43275d
or dword [esi + 8], 0x4000000
test dword [eax + 0x214], 0x80000000
je 0x432770
or dword [esi + 8], 0x8000000
mov ecx, dword [esi + 0x10]
mov edx, dword [eax + 0x214]
test edx, ecx
je 0x432781
or dword [esi + 8], 1
mov edx, dword [esi + 0x14]
mov ecx, dword [eax + 0x214]
test ecx, edx
je 0x432792
or dword [esi + 8], 2
mov ecx, dword [esi + 0x18]
mov edx, dword [eax + 0x214]
test edx, ecx
je 0x4327a3
or dword [esi + 8], 4
mov edx, dword [esi + 0x1c]
mov ecx, dword [eax + 0x214]
test ecx, edx
je 0x4327b4
or dword [esi + 8], 8
mov ecx, dword [esi + 0x24]
mov edx, dword [eax + 0x214]
test edx, ecx
je 0x4327c5
or dword [esi + 8], 0x20
mov edx, dword [esi + 0x28]
mov ecx, dword [eax + 0x214]
test ecx, edx
je 0x4327d6
or dword [esi + 8], 0x40
mov ecx, dword [esi + 0x2c]
mov edx, dword [eax + 0x214]
test edx, ecx
je 0x4327ec
mov ecx, dword [esi + 8]
or cl, 0x80
mov dword [esi + 8], ecx
mov edx, dword [esi + 0x30]
mov ecx, dword [eax + 0x214]
test ecx, edx
je 0x432802
mov ecx, dword [esi + 8]
or ch, 1
mov dword [esi + 8], ecx
mov ecx, dword [esi + 0x34]
mov edx, dword [eax + 0x214]
test edx, ecx
je 0x432818
mov eax, dword [esi + 8]
or ah, 2
mov dword [esi + 8], eax
mov edx, dword [esi + 0x38]
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x432836
or dword [esi + 8], 0x1000000
mov ecx, dword [esi + 0x3c]
push ecx
call edi
movsx edx, ax
test edx, 0x80000000
je 0x43284e
or dword [esi + 8], 0x2000000
mov eax, dword [esi + 0x40]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x432866
or dword [esi + 8], 0x4000000
mov edx, dword [esi + 0x44]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x43287d
or dword [esi + 8], 0x8000000
mov ecx, dword [esi + 0x48]
push ecx
call edi
movsx edx, ax
test edx, 0x80000000
je 0x432896
mov eax, dword [esi + 8]
or al, 1
mov dword [esi + 8], eax
mov eax, dword [esi + 0x4c]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x4328af
mov eax, dword [esi + 8]
or al, 2
mov dword [esi + 8], eax
mov edx, dword [esi + 0x50]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x4328c7
mov eax, dword [esi + 8]
or al, 4
mov dword [esi + 8], eax
mov ecx, dword [esi + 0x54]
push ecx
call edi
movsx edx, ax
test edx, 0x80000000
je 0x4328e0
mov eax, dword [esi + 8]
or al, 8
mov dword [esi + 8], eax
mov eax, dword [esi + 0x5c]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x4328f9
mov eax, dword [esi + 8]
or al, 0x20
mov dword [esi + 8], eax
mov edx, dword [esi + 0x60]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x432911
mov eax, dword [esi + 8]
or al, 0x40
mov dword [esi + 8], eax
mov ecx, dword [esi + 0x64]
push ecx
call edi
movsx edx, ax
test edx, 0x80000000
je 0x43292a
mov eax, dword [esi + 8]
or al, 0x80
mov dword [esi + 8], eax
mov eax, dword [esi + 0x68]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x432944
mov eax, dword [esi + 8]
or ah, 1
mov dword [esi + 8], eax
mov edx, dword [esi + 0x6c]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x43295d
mov eax, dword [esi + 8]
or ah, 2
mov dword [esi + 8], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
test ecx, 0x1000000
mov dword [esi + 0x70], ecx
je 0x432988
test eax, 0x1000000
jne 0x432990
mov edi, dword [esi + 4]
or edi, 0x1000000
or eax, 0x1000000
mov dword [esi + 4], edi
jmp 0x43298d
and eax, 0xfeffffff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test ecx, 0x2000000
je 0x4329b5
test eax, 0x2000000
jne 0x4329bd
mov edi, dword [esi + 4]
or edi, 0x2000000
or eax, 0x2000000
mov dword [esi + 4], edi
jmp 0x4329ba
and eax, 0xfdffffff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test ecx, 0x4000000
je 0x4329e2
test eax, 0x4000000
jne 0x4329ea
mov edi, dword [esi + 4]
or edi, 0x4000000
or eax, 0x4000000
mov dword [esi + 4], edi
jmp 0x4329e7
and eax, 0xfbffffff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test ecx, 0x8000000
je 0x432a0f
test eax, 0x8000000
jne 0x432a17
mov edi, dword [esi + 4]
or edi, 0x8000000
or eax, 0x8000000
mov dword [esi + 4], edi
jmp 0x432a14
and eax, 0xf7ffffff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 1
je 0x432a30
test al, 1
jne 0x432a35
mov edi, dword [esi + 4]
or edi, 1
or al, 1
mov dword [esi + 4], edi
jmp 0x432a32
and al, 0xfe
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 2
je 0x432a4e
test al, 2
jne 0x432a53
mov edi, dword [esi + 4]
or edi, 2
or al, 2
mov dword [esi + 4], edi
jmp 0x432a50
and al, 0xfd
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 4
je 0x432a6c
test al, 4
jne 0x432a71
mov edi, dword [esi + 4]
or edi, 4
or al, 4
mov dword [esi + 4], edi
jmp 0x432a6e
and al, 0xfb
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 8
je 0x432a8a
test al, 8
jne 0x432a8f
mov edi, dword [esi + 4]
or edi, 8
or al, 8
mov dword [esi + 4], edi
jmp 0x432a8c
and al, 0xf7
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 0x20
je 0x432aa8
test al, 0x20
jne 0x432aad
mov edi, dword [esi + 4]
or edi, 0x20
or al, 0x20
mov dword [esi + 4], edi
jmp 0x432aaa
and al, 0xdf
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 0x40
je 0x432ac6
test al, 0x40
jne 0x432acb
mov edi, dword [esi + 4]
or edi, 0x40
or al, 0x40
mov dword [esi + 4], edi
jmp 0x432ac8
and al, 0xbf
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test cl, 0x80
je 0x432ae7
test al, 0x80
jne 0x432aec
mov edi, dword [esi + 4]
or edi, 0x80
or al, 0x80
mov dword [esi + 4], edi
jmp 0x432ae9
and al, 0x7f
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
test ch, 1
je 0x432b0a
test ah, 1
jne 0x432b10
mov edi, dword [esi + 4]
or edi, 0x100
or ah, 1
mov dword [esi + 4], edi
jmp 0x432b0d
and ah, 0xfe
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
pop edi
test ch, 2
je 0x432b34
test ah, 2
jne 0x432b3a
mov edx, dword [esi + 4]
or dh, 2
or ah, 2
mov dword [esi + 4], edx
mov dword [esi + 0xc], eax
mov eax, 1
pop esi
ret
and ah, 0xfd
mov dword [esi + 0xc], eax
mov eax, 1
pop esi
ret