Function at 0x43e3d7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
mov ebx, ecx
cmp eax, 0xd
je 0x43e3f5
cmp eax, 0xf
jne 0x43e49d
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx + 0x994]
and dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x10]
add ecx, 0x4a0
mov dword [ebp - 0xc], eax
mov eax, dword [ecx]
mov byte [ebp - 1], 0
call dword [eax + 0xc]
test eax, eax
jle 0x43e493
mov ecx, dword [ebx + 0x994]
push dword [ebp - 8]
add ecx, 0x4a0
mov eax, dword [ecx]
call dword [eax]
mov edi, eax
mov eax, dword [edi]
push str.ListItem
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x43e474
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x30]
mov esi, eax
mov eax, dword [ebp - 0x10]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x20], eax
jg 0x43e471
cmp dword [ebp - 0x18], eax
jl 0x43e471
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1c], eax
jg 0x43e471
cmp dword [ebp - 0x14], eax
jl 0x43e471
mov byte [ebp - 1], 1
mov esi, dword [ebp + 8]
mov ecx, dword [ebx + 0x994]
inc dword [ebp - 8]
add ecx, 0x4a0
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp dword [ebp - 8], eax
jl 0x43e41e
cmp byte [ebp - 1], 0
jne 0x43e49d
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1cc]
mov eax, dword [esi]
cmp eax, 3
je 0x43e542
cmp eax, 0x12
jne 0x43e575
movzx eax, word [esi + 0x18]
xor ecx, ecx
sub eax, ecx
je 0x43e50c
dec eax
jne 0x43e575
cmp byte [ebx + 0x4f8], cl
je 0x43e4fd
cmp byte [ebx + 0x971], cl
je 0x43e4fd
push ecx
mov ecx, ebx
call fcn.0043f5d3
push eax
mov ecx, ebx
call fcn.0043f547
push 1
push 1
inc eax
mov edx, dword [ebx]
mov esi, dword [ebx + 0x4f4]
push eax
mov ecx, ebx
call dword [edx + 0x15c]
jmp 0x43e6a1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x170]
jmp 0x43e6c3
cmp byte [ebx + 0x4f8], cl
je 0x43e533
cmp byte [ebx + 0x971], cl
je 0x43e533
push ecx
mov ecx, ebx
call fcn.0043f5d3
push eax
mov ecx, ebx
call fcn.0043f547
push 1
push 0
dec eax
jmp 0x43e4e7
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x16c]
jmp 0x43e6c3
movzx eax, word [esi + 0x14]
sub eax, 0x21
je 0x43e6b9
dec eax
je 0x43e6ad
dec eax
je 0x43e672
dec eax
je 0x43e653
dec eax
dec eax
je 0x43e60f
dec eax
dec eax
je 0x43e5b4
sub eax, 0x19
je 0x43e582
push esi
mov ecx, ebx
call fcn.004365e8
jmp 0x43e6c3
cmp byte [ebx + 0x971], 0
jne 0x43e6c3
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x43e6c3
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c8]
jmp 0x43e6c3
mov ecx, dword [ebx + 0x984]
sub ecx, dword [ebx + 0x980]
sar ecx, 2
test ecx, ecx
je 0x43e6c3
mov ecx, ebx
call fcn.0043f6a5
lea esi, [eax + 1]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1cc]
mov ecx, dword [ebx + 0x994]
add ecx, 0x4a0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ecx, [esi + 1]
push 1
cmp ecx, eax
jle 0x43e604
lea ecx, [ebx + 0x4a0]
jmp 0x43e695
lea ecx, [ebx + 0x4f4]
mov eax, dword [ecx]
push esi
jmp 0x43e64e
mov ecx, dword [ebx + 0x984]
sub ecx, dword [ebx + 0x980]
sar ecx, 2
test ecx, ecx
je 0x43e6c3
mov ecx, ebx
call fcn.0043f64a
lea esi, [eax - 1]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1cc]
lea ecx, [ebx + 0x4f4]
push 1
test esi, esi
jg 0x43e60a
mov eax, dword [ebx + 0x4f4]
push 0
call dword [eax + 8]
jmp 0x43e6c3
mov ecx, dword [ebx + 0x994]
add ecx, 0x4a0
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jle 0x43e6c3
push 1
lea ecx, [ebx + 0x4f4]
jmp 0x43e646
mov ecx, dword [ebx + 0x994]
add ecx, 0x4a0
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jle 0x43e6c3
mov ecx, dword [ebx + 0x994]
add ecx, 0x4a0
push 1
mov eax, dword [ecx]
mov esi, dword [ebx + 0x4f4]
call dword [eax + 0xc]
dec eax
push eax
lea ecx, [ebx + 0x4f4]
call dword [esi + 8]
jmp 0x43e6c3
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x178]
jmp 0x43e6c3
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x174]
pop edi
pop esi
pop ebx
leave
ret 4