Function at 0x4368b0
Capabilities:
Create process on windows
Create thread
Log keystrokes
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x472288
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48ea40]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x60]
push esi
push str._keysym_0x_x
push 8
push 0x490660
call fcn.00401810
lea eax, [esi - 0xfe50]
add esp, 0x10
cmp eax, 0x10
ja 0x43691c
push str.__DEAD_KEY
push 8
push 0x490660
mov dword [0x4a5334], esi
call fcn.00401810
add esp, 0xc
jmp 0x43706f
cmp esi, 0x20
jb 0x436926
cmp esi, 0x7e
jbe 0x436935
lea ecx, [esi - 0xa0]
cmp ecx, 0x5f
ja 0x436eac
mov eax, dword [0x4a5334]
test eax, eax
mov bl, byte [esp + 0x64]
je 0x436b69
test bl, bl
je 0x436b69
push esi
push eax
push str._Compose_dead_0x_x_0x_x
push 8
push 0x490660
call fcn.00401810
mov eax, dword [0x4a5334]
add eax, 0xffff01b0
add esp, 0x14
cmp eax, 0xb
ja case.0x436977.65108
jmp dword [eax*4 + 0x437088]
lea eax, [esi - 0x41]
cmp eax, 0x34
ja case.0x43698d.66
movzx edx, byte [eax + 0x4370e4]
jmp dword [edx*4 + 0x4370b8]
mov esi, 0xc0
jmp case.0x43698d.66
mov esi, 0xc8
jmp case.0x43698d.66
mov esi, 0xcc
jmp case.0x43698d.66
mov esi, 0xd2
jmp case.0x43698d.66
mov esi, 0xd9
jmp case.0x43698d.66
mov esi, 0xe0
jmp case.0x43698d.66
mov esi, 0xe8
jmp case.0x43698d.66
mov esi, 0xec
jmp case.0x43698d.66
mov esi, 0xf2
jmp case.0x43698d.66
mov esi, 0xf9
lea eax, [esi - 0x41]
cmp eax, 0x38
ja case.0x4369e7.66
movzx eax, byte [eax + 0x437150]
jmp dword [eax*4 + 0x43711c]
mov esi, 0xc1
jmp case.0x4369e7.66
mov esi, 0xc9
jmp case.0x4369e7.66
mov esi, 0xcd
jmp case.0x4369e7.66
mov esi, 0xd3
jmp case.0x4369e7.66
mov esi, 0xda
jmp case.0x4369e7.66
mov esi, 0xe1
jmp case.0x4369e7.66
mov esi, 0xe9
jmp case.0x4369e7.66
mov esi, 0xed
jmp case.0x4369e7.66
mov esi, 0xf3
jmp case.0x4369e7.66
mov esi, 0xfa
jmp case.0x4369e7.66
mov esi, 0xfd
jmp case.0x4369e7.66
mov esi, 0xdd
lea eax, [esi - 0x41]
cmp eax, 0x34
ja case.0x436a4f.66
movzx ecx, byte [eax + 0x4371b8]
jmp dword [ecx*4 + 0x43718c]
mov esi, 0xc2
jmp case.0x436a4f.66
mov esi, 0xca
jmp case.0x436a4f.66
mov esi, 0xce
jmp case.0x436a4f.66
mov esi, 0xd4
jmp case.0x436a4f.66
mov esi, 0xdb
jmp case.0x436a4f.66
mov esi, 0xe2
jmp case.0x436a4f.66
mov esi, 0xea
jmp case.0x436a4f.66
mov esi, 0xee
jmp case.0x436a4f.66
mov esi, 0xf4
jmp case.0x436a4f.66
mov esi, 0xfb
lea eax, [esi - 0x41]
cmp eax, 0x2e
ja case.0x436aa9.66
movzx edx, byte [eax + 0x437208]
jmp dword [edx*4 + 0x4371f0]
mov esi, 0xd1
jmp case.0x436aa9.66
mov esi, 0xd5
jmp case.0x436aa9.66
mov esi, 0xe3
jmp case.0x436aa9.66
mov esi, 0xf1
jmp case.0x436aa9.66
mov esi, 0xf5
lea eax, [esi - 0x41]
cmp eax, 0x38
ja case.0x436ae0.66
movzx eax, byte [eax + 0x437268]
jmp dword [eax*4 + 0x437238]
mov esi, 0xc4
jmp case.0x436977.65108
mov esi, 0xcb
jmp case.0x436977.65108
mov esi, 0xcf
jmp case.0x436977.65108
mov esi, 0xd6
jmp case.0x436977.65108
mov esi, 0xdc
jmp case.0x436977.65108
mov esi, 0xe4
jmp case.0x436977.65108
mov esi, 0xeb
jmp case.0x436977.65108
mov esi, 0xef
jmp case.0x436977.65108
mov esi, 0xf6
jmp case.0x436977.65108
mov esi, 0xfc
jmp case.0x436977.65108
mov esi, 0xff
jmp case.0x436977.65108
cmp esi, 0x43
je 0x436b45
cmp esi, 0x63
jne case.0x436977.65108
mov esi, 0xe7
jmp case.0x436977.65108
mov esi, 0xc7
push esi
push str._Composed_0x_x
push 8
push 0x490660
mov dword [0x4a5334], 0
call fcn.00401810
add esp, 0x10
push esi
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp byte [esp + 0x68], 0
movzx ecx, ax
mov dword [esp + 0x60], ecx
je 0x436baf
cmp esi, 0x4a6
jne 0x436b90
mov dword [esp + 0x60], 0x130
jmp 0x436baf
cmp esi, 0x5c
jne 0x436b9f
mov dword [esp + 0x60], 0xe2
jmp 0x436baf
cmp esi, 0xa5
jne 0x436baf
mov dword [esp + 0x60], 0xdc
movsx edi, word [esp + 0x60]
push edi
push str._SHORT_s__i
push 8
push 0x490660
call fcn.00401810
add esp, 0x10
cmp word [esp + 0x60], 0xffff
jne 0x436d28
test bl, bl
je 0x43706f
push str.down
push 8
push 0x490660
call fcn.00401810
push str._Found_key
push 8
push 0x490660
call fcn.00401810
add esp, 0x18
xor ecx, ecx
movzx edx, word [ecx*2 + 0x48e608]
cmp esi, edx
je 0x436c1b
add ecx, 1
cmp ecx, 0x100
jl 0x436c04
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x64], eax
imul eax, eax, 0xffffff9c
add ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, ebx
neg eax
add eax, eax
add eax, eax
sub eax, ebx
lea ecx, [ecx + eax*2]
cmp ecx, 0xff
mov dword [esp + 0x68], ecx
je 0x436d0e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x12
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call edi
mov al, byte [esp + 0x64]
push 0
movzx ebp, al
push 0
push 0
add ebp, 0x60
add al, 0x60
push ebp
mov byte [esp + 0x74], al
call esi
mov ecx, dword [esp + 0x6c]
push eax
push ecx
call edi
push 0
push 2
push 0
push ebp
call esi
mov edx, dword [esp + 0x6c]
push eax
push edx
call edi
push 0
movzx ebp, bl
push 0
push 0
add ebp, 0x60
push ebp
add bl, 0x60
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push ebp
call esi
push eax
push ebx
call edi
mov bl, byte [esp + 0x68]
push 0
movzx ebp, bl
push 0
push 0
add ebp, 0x60
push ebp
add bl, 0x60
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push ebp
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push 0x12
call esi
push eax
push 0x12
call edi
jmp 0x43706f
push esi
push str.ignoring_unrecognised_Latin_1_keysym_0x_x
push 8
push 0x490660
call fcn.00401810
add esp, 0x10
jmp 0x43706f
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
mov eax, edi
and ebp, 1
xor ecx, ecx
shr eax, 8
cmp ebp, ecx
je 0x436d43
xor al, 1
mov byte [esp + 0x64], al
mov dword [esp + 0x44], 0x11
mov dword [esp + 0x48], ecx
mov byte [esp + 0x4c], 0
mov byte [esp + 0x4d], 0
mov dword [esp + 0x58], ecx
mov dword [esp + 0x38], 0x12
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x40], 0
mov byte [esp + 0x41], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
mov dword [esp + 0x2c], 0xa0
mov dword [esp + 0x30], ecx
mov byte [esp + 0x34], 0
mov byte [esp + 0x35], 0
mov dword [esp + 0x20], 0xa1
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], 0
mov byte [esp + 0x29], 0
test bl, bl
mov byte [esp + 0x58], 4
je 0x436e1b
test al, 2
je 0x436dd3
lea ecx, [esp + 0x44]
call fcn.00434b20
mov al, byte [esp + 0x64]
test al, 4
je 0x436de4
lea ecx, [esp + 0x38]
call fcn.00434b20
mov al, byte [esp + 0x64]
test al, 1
je 0x436df3
lea ecx, [esp + 0x14]
call fcn.00434b20
jmp 0x436e1b
cmp byte [esp + 0x60], 0x20
je 0x436e1b
call fcn.00447b10
test eax, eax
je 0x436e09
lea ecx, [esp + 0x14]
jmp 0x436e16
lea ecx, [esp + 0x2c]
call fcn.00434b80
lea ecx, [esp + 0x20]
call fcn.00434b80
movzx edi, byte [esp + 0x60]
push ebp
movzx eax, bl
push eax
push edi
push esi
push esi
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_capslockOn__d_n
push 9
push 0x490660
call fcn.00401810
add esp, 0x20
neg bl
push 0
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 2
push ebx
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, dword [esp + 0x68]
push eax
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
lea ecx, [esp + 0x20]
mov byte [esp + 0x58], 3
call fcn.00434be0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x58], 2
call fcn.00434be0
lea ecx, [esp + 0x14]
mov byte [esp + 0x58], 1
call fcn.00434be0
lea ecx, [esp + 0x38]
mov byte [esp + 0x58], 0
call fcn.00434be0
lea ecx, [esp + 0x44]
mov dword [esp + 0x58], 0xffffffff
call fcn.00434be0
jmp 0x43706f
mov ebp, dword [edi + 4]
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.004350d0
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x436ecc
cmp eax, edi
je 0x436ed1
call fcn.0045cf74
cmp dword [ebx + 4], ebp
jne 0x436ef0
push esi
push str.ignoring_unknown_keysym__d_n
push 8
push 0x490660
call fcn.00401810
add esp, 0x10
jmp 0x43706f
lea ecx, [esp + 0x60]
push ecx
mov ecx, edi
call fcn.004365b0
mov bl, byte [eax]
lea edx, [esp + 0x60]
push edx
lea ecx, [edi + 0xc]
mov byte [esp + 0x6c], bl
xor ebp, ebp
call fcn.00436630
cmp byte [eax], 0
je 0x436f1b
mov ebp, 1
cmp byte [esp + 0x64], 0
jne 0x436f59
or ebp, 2
call fcn.00447b10
test eax, eax
je 0x437054
movzx eax, bl
sub eax, 0xa1
je 0x43704e
sub eax, 2
je 0x43704a
sub eax, 2
jne 0x437054
mov bl, 0x12
jmp 0x437050
cmp bl, 0x2e
jne 0x436f25
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
test ax, ax
jns 0x436f25
push 0x12
call esi
test ax, ax
jns 0x436f25
call fcn.00447b20
test eax, eax
je 0x436f25
push str.CAD_n
push 9
push 0x490660
call fcn.00401810
add esp, 0xc
call fcn.00447b30
cmp eax, 6
jb 0x436fde
call fcn.00448180
test eax, eax
je 0x436fde
push str.Vista_and_runnning_as_system____CAD_n
push 9
push 0x490660
call fcn.00401810
add esp, 0xc
lea eax, [esp + 0x64]
push eax
push 0
push 0
push 0x40e2f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43706f
call fcn.00447b30
cmp eax, 6
jb 0x436fef
push str.Vista_and_runnning_as_user____Taskmgr_n
jmp 0x43702c
call fcn.00447b30
cmp eax, 6
jae 0x43701d
call fcn.00448180
test eax, eax
je 0x43701d
push str.Not_Vista_and_runnning_as_system__use_old_method_n
push 9
push 0x490660
call fcn.00401810
add esp, 0xc
call fcn.00447f90
jmp 0x43706f
call fcn.00447b30
cmp eax, 6
jae 0x43706f
push str.Not_Vista_and_runnning_as_user____Taskmgr_n
push 9
push 0x490660
call fcn.00401810
add esp, 0xc
push 1
push str.taskmgr.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x43706f
mov bl, 0x11
jmp 0x437050
mov bl, 0x10
mov byte [esp + 0x68], bl
push 0
push ebp
movzx ecx, bl
push 0
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, dword [esp + 0x70]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0xc