Function at 0x438abe
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x11c
mov eax, dword [0x4705d0]
xor eax, esp
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x12c]
push ebp
push esi
mov esi, dword [esp + 0x128]
push 0xff
mov dword [esp + 0x1c], eax
xor ebp, ebp
lea eax, [esp + 0x25]
push ebp
push eax
mov byte [esp + 0x2c], 0
call fcn.004464f0
add esp, 0xc
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], esi
cmp esi, ebp
je 0x438d48
push edi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push ebx
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0
je 0x438d46
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.00437877
mov ebx, eax
cmp dword [0x4775e0], ebp
je 0x438b50
mov dword [esp + 0x14], ebp
cmp ebx, ebp
je 0x438d13
cmp dword [esp + 0x134], 1
jne 0x438b9f
mov esi, dword [esp + 0x14]
and esi, 1
je 0x438b7b
push ebp
push ebp
push ebp
push 0x10
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x10
call edi
push ebx
call fcn.004389f6
cmp esi, ebp
je 0x438d13
push ebp
push 2
push ebp
push 0x10
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x10
call edi
jmp 0x438d13
test byte [esp + 0x14], 4
mov eax, dword [esp + 0x20]
je 0x438c0c
cmp eax, ebp
je 0x438bb1
add dword [eax], 4
push ebx
lea eax, [esp + 0x2c]
push str._04d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebp
push ebp
push ebp
push 0x12
call edi
movsx esi, byte [esp + ebp + 0x28]
xor eax, eax
push eax
push eax
push eax
add esi, 0x30
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call edi
push 0
push 2
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call edi
inc ebp
cmp ebp, 4
jl 0x438bcc
push 0
push 2
push 0
push 0x12
call edi
xor ebp, ebp
jmp 0x438cbd
cmp eax, ebp
je 0x438c12
inc dword [eax]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
and eax, 1
mov dword [esp + 0x24], eax
je 0x438c31
push ebp
push ebp
push ebp
push 0x10
call esi
push eax
push 0x10
call edi
cmp dword [esp + 0x10], ebp
je 0x438c3e
cmp dword [esp + 0x10], 2
jne 0x438c6d
cmp ebx, 0x21
jl 0x438c48
cmp ebx, 0x2e
jle 0x438c60
cmp ebx, 0x11
je 0x438c60
cmp ebx, 0x5b
je 0x438c60
cmp ebx, 0x5c
je 0x438c60
cmp ebx, 0x5d
je 0x438c60
xor eax, eax
jmp 0x438c63
xor eax, eax
inc eax
push ebp
push eax
push ebp
push ebx
call esi
push eax
push ebx
call edi
xor eax, eax
inc eax
cmp dword [esp + 0x10], eax
je 0x438c7d
cmp dword [esp + 0x10], 2
jne 0x438caa
cmp ebx, 0x21
jl 0x438c87
cmp ebx, 0x2e
jle 0x438c9d
cmp ebx, 0x11
je 0x438c9d
cmp ebx, 0x5b
je 0x438c9d
cmp ebx, 0x5c
je 0x438c9d
cmp ebx, 0x5d
je 0x438c9d
xor eax, eax
push ebp
or eax, 2
push eax
push ebp
push ebx
call esi
push eax
push ebx
call edi
cmp dword [esp + 0x24], ebp
je 0x438cbd
push ebp
push 2
push ebp
push 0x10
call esi
push eax
push 0x10
call edi
cmp dword [esp + 0x10], ebp
jne 0x438ce8
cmp ebx, 0x11
jne 0x438ccd
xor eax, eax
inc eax
jmp 0x438ce2
cmp ebx, 0x10
jne 0x438cd6
push 2
jmp 0x438cdd
cmp ebx, 0x12
jne 0x438ce0
push 4
pop eax
jmp 0x438ce2
xor eax, eax
or dword [0x4775e0], eax
xor eax, eax
inc eax
cmp dword [esp + 0x10], eax
jne 0x438d13
cmp ebx, 0x11
je 0x438d0b
cmp ebx, 0x10
jne 0x438cff
push 2
jmp 0x438d06
cmp ebx, 0x12
jne 0x438d09
push 4
pop eax
jmp 0x438d0b
xor eax, eax
not eax
and dword [0x4775e0], eax
mov esi, dword [esp + 0x1c]
add esi, dword [esp + 0x18]
mov eax, dword [esp + 0x138]
mov dword [esp + 0x1c], esi
cmp eax, ebp
jne 0x438d2f
cmp ebx, 0x11
jne 0x438d3e
cmp ebx, 0x11
jne 0x438d37
push 0xa
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, ebp
jne 0x438b20
pop ebx
pop edi
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
xor ecx, esp
call fcn.004464bf
add esp, 0x11c
ret 0x10