Function at 0x543957
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push edi
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0
jne 0x54398e
cmp dword [ebp + 8], 0x14
je 0x54398e
cmp dword [ebp + 8], 0x91
je 0x54398e
cmp dword [ebp + 8], 0x90
jne 0x543993
jmp 0x543b42
push 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp eax, 0x7fff
jbe 0x5439b0
mov eax, 0xff20
jmp 0x543be8
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x114]
rep stosd dword es:[edi], eax
mov edx, dword [ebp + 0xc]
and edx, 1
test edx, edx
je 0x5439d0
mov byte [ebp - 0x104], 0x80
mov eax, dword [ebp + 0xc]
and eax, 4
test eax, eax
je 0x5439e1
mov byte [ebp - 0x103], 0x80
mov ecx, dword [ebp + 0xc]
and ecx, 0x10
test ecx, ecx
je 0x5439f2
mov byte [ebp - 0x102], 0x80
mov edx, dword [ebp + 0xc]
and edx, 2
test edx, edx
je 0x543a03
mov byte [ebp - 0x100], 1
mov eax, dword [ebp + 0xc]
and eax, 0x20
test eax, eax
je 0x543a14
mov byte [ebp - 0x83], 1
mov ecx, dword [ebp + 0xc]
and ecx, 8
test ecx, ecx
je 0x543a25
mov byte [ebp - 0x84], 1
push 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ToAscii]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x543a6e
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ToAscii]
mov eax, 0xff20
jmp 0x543be8
cmp dword [ebp - 4], 2
jne 0x543b13
mov cl, byte [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx edx, ax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sar eax, 8
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
mov dword [ebp - 0xc], ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x14], eax
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x114]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
and eax, 1
test eax, eax
je 0x543acc
mov byte [ebp - 0x104], 0x80
mov ecx, dword [ebp - 0x10]
and ecx, 2
test ecx, ecx
je 0x543add
mov byte [ebp - 0x103], 0x80
mov edx, dword [ebp - 0x10]
and edx, 4
test edx, edx
je 0x543aee
mov byte [ebp - 0x102], 0x80
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ToAscii]
mov eax, 0xff20
jmp 0x543be8
cmp dword [ebp - 4], 1
jne 0x543b42
mov ecx, dword [ebp - 8]
and ecx, 0xff
cmp ecx, 0x20
jl 0x543b42
mov edx, dword [ebp - 8]
and edx, 0xff
cmp edx, 0x7f
je 0x543b42
mov eax, dword [ebp - 8]
and eax, 0xff
jmp 0x543be8
cmp dword [ebp + 8], 0
jb 0x543b51
cmp dword [ebp + 8], 0x91
jbe 0x543b58
xor eax, eax
jmp 0x543be8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x10
je 0x543b9f
cmp dword [ebp - 0x118], 0x11
je 0x543b7e
cmp dword [ebp - 0x118], 0x12
je 0x543bc0
jmp 0x543bde
push 0xa3
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x80
test ecx, ecx
je 0x543b9d
mov eax, 0xffe4
jmp 0x543be8
jmp 0x543bde
push 0xa1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x80
test edx, edx
je 0x543bbe
mov eax, 0xffe2
jmp 0x543be8
jmp 0x543bde
push 0xa5
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
and eax, 0x80
test eax, eax
je 0x543bde
mov eax, 0xffea
jmp 0x543be8
mov ecx, dword [ebp + 8]
mov eax, dword [ecx*4 + 0x59ae94]
pop edi
mov esp, ebp
pop ebp
ret