Function at 0x431b97
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
test byte [ebx + 0x464], 1
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebx + 0x174], edi
je 0x431bea
xor esi, esi
cmp edi, esi
je 0x432191
mov ecx, dword [ebx + 0x14c]
mov eax, dword [ecx]
call dword [eax + 0x88]
test eax, eax
je 0x431c22
mov ecx, dword [ebp + 0xc]
xor eax, eax
inc eax
mov dword [ecx], eax
mov ebx, dword [ebx + 0x178]
cmp ebx, esi
je 0x43218d
mov dword [ebx], eax
jmp 0x43218d
fild dword [ebx + 0x42c]
fstp dword [ebp + 0x10]
fld dword [ebp + 0x10]
fsub dword [ebp + 8]
call fcn.00693530
mov dword [ebx + 0x42c], eax
mov eax, dword [ebx + 0x178]
xor esi, esi
cmp eax, esi
je 0x431c16
mov dword [eax], 1
cmp dword [ebx + 0x42c], esi
jle 0x43218d
cmp edi, esi
je 0x432191
mov eax, dword [ebx + 0x464]
test al, 0x14
push 0x14
pop edi
je 0x431cbe
mov ecx, dword [ebx + 0x164]
cmp ecx, esi
je 0x431ca8
mov eax, dword [ecx]
call dword [eax + 0x88]
test eax, eax
je 0x431ca8
lea eax, [ebx + 0x178]
mov ecx, dword [eax]
cmp ecx, esi
je 0x431c61
mov dword [ecx], edi
mov dword [eax], esi
lea eax, [ebx + 0x3e8]
mov ecx, dword [eax]
cmp ecx, esi
je 0x431c71
mov dword [ecx], esi
mov dword [eax], esi
lea eax, [ebx + 0x3ec]
mov ecx, dword [eax]
cmp ecx, esi
je 0x431c82
mov byte [ecx], 0
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
test byte [ebx + 0x464], 0x80
je 0x43218d
mov ecx, dword [ebx + 0x168]
call fcn.00425087
jmp 0x43218d
mov ecx, dword [ebx + 0x160]
cmp ecx, esi
je 0x431cbe
mov eax, dword [ecx]
call dword [eax + 0x88]
test eax, eax
jne 0x431c51
mov eax, dword [ebx + 0x464]
test al, 0xa
jne 0x431cd1
test ah, 2
je 0x432191
cmp dword [ebx + 0x158], esi
je 0x43208f
cmp dword [ebx + 0x468], esi
je 0x431cf2
push 0xd
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jne 0x431d20
mov ecx, dword [ebx + 0x158]
mov eax, dword [ecx]
call dword [eax + 0x88]
test eax, eax
je 0x432191
cmp dword [0x1071030], esi
jne 0x432191
cmp dword [0x1071034], esi
je 0x432191
lea eax, [ebx + 0x178]
mov ecx, dword [eax]
cmp ecx, esi
je 0x431d34
mov dword [ecx], 0xa
mov dword [eax], esi
cmp dword [ebx + 0x3e8], esi
je 0x431d90
mov ecx, dword [ebx + 0x168]
mov edi, 0x6d05b8
call fcn.0042539d
xor ecx, ecx
mov esi, eax
inc ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x431d7e
mov ecx, dword [ebx + 0x168]
call fcn.0042539d
push eax
call fcn.00693e7e
test edx, edx
pop ecx
jl 0x431d74
jg 0x431d7e
cmp eax, 0xffffffff
ja 0x431d7e
mov ecx, dword [ebx + 0x3e8]
mov dword [ecx], eax
jmp 0x431d87
mov eax, dword [ebx + 0x3e8]
and dword [eax], 0
and dword [ebx + 0x3e8], 0
xor esi, esi
cmp dword [ebx + 0x3ec], esi
je 0x431de2
mov ecx, dword [ebx + 0x16c]
mov edi, 0x6d05b8
call fcn.0042539d
xor ecx, ecx
mov esi, eax
inc ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x431dd0
mov ecx, dword [ebx + 0x16c]
call fcn.0042539d
mov edx, dword [ebx + 0x3ec]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x431dc4
jmp 0x431dd9
mov eax, dword [ebx + 0x3ec]
mov byte [eax], 0
and dword [ebx + 0x3ec], 0
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
test byte [ebx + 0x464], 0x80
je 0x431dff
mov ecx, dword [ebx + 0x168]
call fcn.00425087
test byte [ebx + 0x465], 1
je 0x431e13
mov ecx, dword [ebx + 0x16c]
call fcn.00425087
mov edi, dword [ebx + 0x458]
lea ecx, [ebx + 0x448]
inc edi
call fcn.005770db
cmp eax, edi
jbe 0x432034
mov eax, dword [ebx + 0x44c]
lea eax, [eax + edi*4]
mov dword [ebx + 0x458], edi
push dword [eax]
mov ecx, ebx
call fcn.004317fd
mov ecx, ebx
call fcn.00430185
mov ecx, dword [ebx + 0x148]
cmp ecx, esi
je 0x431e88
mov eax, dword [ecx]
call dword [eax + 0x150]
push dword [ebx + 0x148]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xec]
mov ecx, dword [ebx + 0x148]
cmp ecx, esi
je 0x431e88
mov eax, dword [ecx]
xor edi, edi
inc edi
push edi
call dword [eax]
mov dword [ebx + 0x148], esi
jmp 0x431e8b
xor edi, edi
inc edi
mov eax, dword [ebx + 0x14c]
cmp eax, esi
je 0x431eb5
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0xec]
mov ecx, dword [ebx + 0x14c]
cmp ecx, esi
je 0x431eb5
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [ebx + 0x14c], esi
mov eax, dword [ebx + 0x150]
cmp eax, esi
je 0x431edf
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0xec]
mov ecx, dword [ebx + 0x150]
cmp ecx, esi
je 0x431edf
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [ebx + 0x150], esi
mov eax, dword [ebx + 0x154]
cmp eax, esi
je 0x431f09
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0xec]
mov ecx, dword [ebx + 0x154]
cmp ecx, esi
je 0x431f09
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [ebx + 0x154], esi
mov eax, dword [ebx + 0x158]
cmp eax, esi
je 0x431f33
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0xec]
mov ecx, dword [ebx + 0x158]
cmp ecx, esi
je 0x431f33
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [ebx + 0x158], esi
mov eax, dword [ebx + 0x15c]
cmp eax, esi
je 0x431f5d
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0xec]
mov ecx, dword [ebx + 0x15c]
cmp ecx, esi
je 0x431f5d
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [ebx + 0x15c], esi
mov eax, dword [ebx + 0x160]
cmp eax, esi
je 0x431f87
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0xec]
mov ecx, dword [ebx + 0x160]
cmp ecx, esi
je 0x431f87
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [ebx + 0x160], esi
mov eax, dword [ebx + 0x164]
cmp eax, esi
je 0x431fb1
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0xec]
mov ecx, dword [ebx + 0x164]
cmp ecx, esi
je 0x431fb1
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [ebx + 0x164], esi
mov eax, dword [ebx + 0x168]
cmp eax, esi
je 0x431fdb
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0xec]
mov ecx, dword [ebx + 0x168]
cmp ecx, esi
je 0x431fdb
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [ebx + 0x168], esi
mov eax, dword [ebx + 0x16c]
cmp eax, esi
je 0x432005
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0xec]
mov ecx, dword [ebx + 0x16c]
cmp ecx, esi
je 0x432005
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [ebx + 0x16c], esi
mov ecx, ebx
call fcn.00436c18
cmp eax, esi
je 0x432017
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov ecx, ebx
call fcn.00430280
push esi
push esi
push dword [ebx + 0x464]
mov ecx, ebx
call fcn.004304b7
mov eax, edi
jmp 0x432194
lea ecx, [ebx + 0x448]
call fcn.005770db
test eax, eax
je 0x43218d
test byte [ebx + 0x465], 4
je 0x43218d
mov edi, dword [0x73acd4]
mov byte [edi + 0x24d8], 0
mov ecx, dword [0x73c768]
push 4
call fcn.00475589
push 1
mov ecx, eax
call fcn.00483a22
cmp dword [edi + 0x21fc], esi
je 0x43218d
mov ecx, edi
call fcn.0045b5bb
jmp 0x43218d
lea edi, [ebx + 0x15c]
cmp dword [edi], esi
je 0x432191
cmp dword [ebx + 0x468], esi
je 0x4320b2
push 0xd
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jne 0x4320c4
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x88]
test eax, eax
je 0x432191
lea eax, [ebx + 0x178]
mov ecx, dword [eax]
cmp ecx, esi
je 0x4320d8
mov dword [ecx], 0xa
mov dword [eax], esi
cmp dword [ebx + 0x3e8], esi
je 0x432134
mov ecx, dword [ebx + 0x168]
mov edi, 0x6d05b8
call fcn.0042539d
xor ecx, ecx
mov esi, eax
inc ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x432122
mov ecx, dword [ebx + 0x168]
call fcn.0042539d
push eax
call fcn.00693e7e
test edx, edx
pop ecx
jl 0x432118
jg 0x432122
cmp eax, 0xffffffff
ja 0x432122
mov ecx, dword [ebx + 0x3e8]
mov dword [ecx], eax
jmp 0x43212b
mov eax, dword [ebx + 0x3e8]
and dword [eax], 0
and dword [ebx + 0x3e8], 0
xor esi, esi
cmp dword [ebx + 0x3ec], esi
je 0x432184
mov ecx, dword [ebx + 0x16c]
mov edi, 0x6d05b8
call fcn.0042539d
xor ecx, ecx
mov esi, eax
inc ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x432174
mov ecx, dword [ebx + 0x16c]
call fcn.0042539d
mov edx, dword [ebx + 0x3ec]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x432168
jmp 0x43217d
mov eax, dword [ebx + 0x3ec]
mov byte [eax], 0
and dword [ebx + 0x3ec], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
xor eax, eax
jmp 0x432194
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc