Function at 0x435560
Capabilities:
Create process on windows
Create thread
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x54]
push edi
push str._keysym_0x_x
mov ecx, 8
mov eax, 0x48c4e8
call fcn.00401000
lea eax, [edi - 0xfe50]
add esp, 8
cmp eax, 0x10
ja 0x4355b5
push str.__DEAD_KEY
mov ecx, 8
mov eax, 0x48c4e8
mov dword [0x4a77f4], edi
call fcn.00401000
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
cmp edi, 0x20
jb 0x4355bf
cmp edi, 0x7e
jbe 0x4355ce
lea ecx, [edi - 0xa0]
cmp ecx, 0x5f
ja 0x435b31
mov eax, dword [0x4a77f4]
test eax, eax
je 0x435807
cmp byte [esp + 0x58], 0
je 0x435807
push edi
push eax
push str._Compose_dead_0x_x_0x_x
mov ecx, 8
mov eax, 0x48c4e8
call fcn.00401000
mov eax, dword [0x4a77f4]
add eax, 0xffff01b0
add esp, 0xc
cmp eax, 0xb
ja case.0x435612.65108
jmp dword [eax*4 + 0x435cf8]
lea eax, [edi - 0x41]
cmp eax, 0x34
ja case.0x435628.66
movzx edx, byte [eax + 0x435d54]
jmp dword [edx*4 + 0x435d28]
mov edi, 0xc0
jmp case.0x435628.66
mov edi, 0xc8
jmp case.0x435628.66
mov edi, 0xcc
jmp case.0x435628.66
mov edi, 0xd2
jmp case.0x435628.66
mov edi, 0xd9
jmp case.0x435628.66
mov edi, 0xe0
jmp case.0x435628.66
mov edi, 0xe8
jmp case.0x435628.66
mov edi, 0xec
jmp case.0x435628.66
mov edi, 0xf2
jmp case.0x435628.66
mov edi, 0xf9
lea eax, [edi - 0x41]
cmp eax, 0x38
ja case.0x435682.66
movzx eax, byte [eax + 0x435dc0]
jmp dword [eax*4 + 0x435d8c]
mov edi, 0xc1
jmp case.0x435682.66
mov edi, 0xc9
jmp case.0x435682.66
mov edi, 0xcd
jmp case.0x435682.66
mov edi, 0xd3
jmp case.0x435682.66
mov edi, 0xda
jmp case.0x435682.66
mov edi, 0xe1
jmp case.0x435682.66
mov edi, 0xe9
jmp case.0x435682.66
mov edi, 0xed
jmp case.0x435682.66
mov edi, 0xf3
jmp case.0x435682.66
mov edi, 0xfa
jmp case.0x435682.66
mov edi, 0xfd
jmp case.0x435682.66
mov edi, 0xdd
lea eax, [edi - 0x41]
cmp eax, 0x34
ja case.0x4356ea.66
movzx ecx, byte [eax + 0x435e28]
jmp dword [ecx*4 + 0x435dfc]
mov edi, 0xc2
jmp case.0x4356ea.66
mov edi, 0xca
jmp case.0x4356ea.66
mov edi, 0xce
jmp case.0x4356ea.66
mov edi, 0xd4
jmp case.0x4356ea.66
mov edi, 0xdb
jmp case.0x4356ea.66
mov edi, 0xe2
jmp case.0x4356ea.66
mov edi, 0xea
jmp case.0x4356ea.66
mov edi, 0xee
jmp case.0x4356ea.66
mov edi, 0xf4
jmp case.0x4356ea.66
mov edi, 0xfb
lea eax, [edi - 0x41]
cmp eax, 0x2e
ja case.0x435744.66
movzx edx, byte [eax + 0x435e78]
jmp dword [edx*4 + 0x435e60]
mov edi, 0xd1
jmp case.0x435744.66
mov edi, 0xd5
jmp case.0x435744.66
mov edi, 0xe3
jmp case.0x435744.66
mov edi, 0xf1
jmp case.0x435744.66
mov edi, 0xf5
lea eax, [edi - 0x41]
cmp eax, 0x38
ja case.0x43577b.66
movzx eax, byte [eax + 0x435ed8]
jmp dword [eax*4 + 0x435ea8]
mov edi, 0xc4
jmp case.0x435612.65108
mov edi, 0xcb
jmp case.0x435612.65108
mov edi, 0xcf
jmp case.0x435612.65108
mov edi, 0xd6
jmp case.0x435612.65108
mov edi, 0xdc
jmp case.0x435612.65108
mov edi, 0xe4
jmp case.0x435612.65108
mov edi, 0xeb
jmp case.0x435612.65108
mov edi, 0xef
jmp case.0x435612.65108
mov edi, 0xf6
jmp case.0x435612.65108
mov edi, 0xfc
jmp case.0x435612.65108
mov edi, 0xff
jmp case.0x435612.65108
cmp edi, 0x43
je 0x4357e0
cmp edi, 0x63
jne case.0x435612.65108
mov edi, 0xe7
jmp case.0x435612.65108
mov edi, 0xc7
push edi
push str._Composed_0x_x
mov ecx, 8
mov eax, 0x48c4e8
mov dword [0x4a77f4], 0
call fcn.00401000
add esp, 8
push edi
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp byte [esp + 0x5c], 0
movzx ebx, ax
je 0x435840
cmp edi, 0x4a6
jne 0x435827
mov ebx, 0x130
jmp 0x435840
cmp edi, 0x5c
jne 0x435833
mov ebx, 0xe2
jmp 0x435840
cmp edi, 0xa5
jne 0x435840
mov ebx, 0xdc
movsx esi, bx
push esi
push str._SHORT_s__i
mov ecx, 8
mov eax, 0x48c4e8
call fcn.00401000
add esp, 8
cmp bx, 0xffff
jne 0x4359cf
cmp byte [esp + 0x58], 0
je 0x435ceb
push str.down
mov ecx, 8
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
push str._Found_key
mov ecx, 8
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
xor ecx, ecx
movzx edx, word [ecx*2 + 0x48b7b8]
cmp edi, edx
je 0x4358b5
inc ecx
cmp ecx, 0x100
jl 0x4358a0
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x58], eax
imul eax, eax, 0xffffff9c
add ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, ebx
neg eax
add eax, eax
add eax, eax
sub eax, ebx
lea ecx, [ecx + eax*2]
mov dword [esp + 0x5c], ecx
cmp ecx, 0xff
je 0x4359ad
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x12
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call edi
mov al, byte [esp + 0x58]
push 0
movzx ebp, al
push 0
push 0
add ebp, 0x60
add al, 0x60
push ebp
mov byte [esp + 0x68], al
call esi
mov ecx, dword [esp + 0x60]
push eax
push ecx
call edi
push 0
push 2
push 0
push ebp
call esi
mov edx, dword [esp + 0x60]
push eax
push edx
call edi
push 0
movzx ebp, bl
push 0
push 0
add ebp, 0x60
push ebp
add bl, 0x60
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push ebp
call esi
push eax
push ebx
call edi
mov bl, byte [esp + 0x5c]
push 0
movzx ebp, bl
push 0
push 0
add ebp, 0x60
push ebp
add bl, 0x60
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push ebp
call esi
push eax
push ebx
call edi
push 0
push 2
push 0
push 0x12
call esi
push eax
push 0x12
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push edi
push str.ignoring_unrecognised_Latin_1_keysym_0x_x
mov ecx, 8
mov eax, 0x48c4e8
call fcn.00401000
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
mov eax, esi
and ebp, 1
xor ecx, ecx
shr eax, 8
cmp ebp, ecx
je 0x4359f0
xor al, 1
mov byte [esp + 0x5c], al
jmp 0x4359f4
mov byte [esp + 0x5c], al
mov dword [esp + 0x44], 0x11
mov dword [esp + 0x48], ecx
mov byte [esp + 0x4c], cl
mov byte [esp + 0x4d], cl
mov dword [esp + 0x38], 0x12
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x40], cl
mov byte [esp + 0x41], cl
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], cl
mov dword [esp + 0x2c], 0xa0
mov dword [esp + 0x30], ecx
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], cl
mov dword [esp + 0x14], 0xa1
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], cl
cmp byte [esp + 0x58], cl
je 0x435ab5
test al, 2
je 0x435a6f
lea esi, [esp + 0x44]
call fcn.00435290
mov al, byte [esp + 0x5c]
test al, 4
je 0x435a80
lea esi, [esp + 0x38]
call fcn.00435290
mov al, byte [esp + 0x5c]
test al, 1
je 0x435a8f
lea esi, [esp + 0x20]
call fcn.00435290
jmp 0x435ab5
cmp bl, 0x20
je 0x435ab5
cmp dword [0x4a2188], 1
jne 0x435aa3
lea esi, [esp + 0x20]
jmp 0x435ab0
lea esi, [esp + 0x2c]
call fcn.004352f0
lea esi, [esp + 0x14]
call fcn.004352f0
movzx eax, byte [esp + 0x58]
push ebp
push eax
movzx esi, bl
push esi
push edi
push edi
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_capslockOn__d_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
add esp, 0x18
xor ecx, ecx
cmp byte [esp + 0x58], cl
push 0
setne cl
dec ecx
and ecx, 2
push ecx
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
lea esi, [esp + 0x14]
call fcn.00435350
lea esi, [esp + 0x2c]
call fcn.00435350
lea esi, [esp + 0x20]
call fcn.00435350
lea esi, [esp + 0x38]
call fcn.00435350
lea esi, [esp + 0x44]
call fcn.00435350
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
mov edx, dword [0x4a7878]
mov ebp, dword [0x4a7860]
lea eax, [esp + 0x20]
push eax
lea ebx, [esp + 0x58]
mov dword [esp + 0x1c], edx
call fcn.00436210
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x435b5b
cmp eax, ebp
je 0x435b60
call fcn.0045e4f1
mov ecx, dword [esp + 0x18]
cmp dword [esi + 4], ecx
jne 0x435b74
push edi
push str.ignoring_unknown_keysym__d_n
jmp 0x4359b3
lea edx, [esp + 0x54]
push edx
call fcn.00436110
mov bl, byte [eax]
lea eax, [esp + 0x54]
push eax
push 0x4a7880
mov byte [esp + 0x64], bl
xor edi, edi
call fcn.004362a0
cmp byte [eax], 0
je 0x435b9f
mov edi, 1
cmp byte [esp + 0x58], 0
jne 0x435bdd
or edi, 2
cmp dword [0x4a2188], 1
jne 0x435cd0
movzx eax, bl
sub eax, 0xa1
je 0x435cca
sub eax, 2
je 0x435cc6
sub eax, 2
jne 0x435cd0
mov bl, 0x12
jmp 0x435ccc
cmp bl, 0x2e
jne 0x435ba9
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
je 0x435ba9
push 0x12
call esi
mov edx, 0x8000
test dx, ax
je 0x435ba9
cmp dword [0x4a2188], 2
jne 0x435ba9
push str.CAD_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
cmp dword [0x4a2180], 6
mov ecx, 9
mov eax, 0x48c4e8
jb 0x435c7d
cmp dword [0x4a7820], 0
je 0x435c76
push str.Vista_and_runnning_as_system____CAD_n
call fcn.00401000
add esp, 4
lea eax, [esp + 0x58]
push eax
push 0
push 0
push 0x40da30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push str.Vista_and_runnning_as_user____Taskmgr_n
jmp 0x435ca7
cmp dword [0x4a7820], 0
je 0x435ca2
push str.Not_Vista_and_runnning_as_system__use_old_method_n
call fcn.00401000
add esp, 4
call fcn.00449740
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
push str.Not_Vista_and_runnning_as_user____Taskmgr_n
call fcn.00401000
add esp, 4
push 1
push str.taskmgr.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
mov bl, 0x11
jmp 0x435ccc
mov bl, 0x10
mov byte [esp + 0x5c], bl
push 0
push edi
movzx ecx, bl
push 0
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, dword [esp + 0x64]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc