Function at 0x438ba4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, 0x4e752a
xor eax, eax
mov dword [0x4ddd28], eax
push 0
push 0x4ddd2c
push esi
call fcn.004b7b68
mov edi, eax
mov dword [0x4ddd18], edi
test edi, edi
jne 0x438bde
push 0
call sub.USER32.dll_MessageBeep
jmp 0x438f9f
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x438bf6
mov dword [0x4ddd24], 1
jmp 0x438bfd
xor eax, eax
mov dword [0x4ddd24], eax
mov byte [0x4dc17c], 0
mov edx, dword [0x4ddd18]
cmp byte [edx + 0x4cc], 1
jne 0x438d6f
push 0x4ddd4c
call sub.USER32.dll_GetCursorPos
push 0x4ddd4c
push esi
call sub.USER32.dll_ScreenToClient
push 0x4ddd3c
mov ecx, dword [0x4ddd18]
mov eax, dword [ecx + 0x520]
push eax
call sub.USER32.dll_GetClientRect
mov edx, dword [0x4ddd34]
add edx, dword [0x4ddd44]
cmp edx, dword [0x4ddd4c]
jge 0x438d05
push 0x4ddd4c
mov ecx, dword [ebp + 0xc]
push ecx
call sub.SHELL32.dll_DragQueryPoint
cmp dword [0x4ddd24], 0
je 0x438c7b
push 0
push 0x10
call fcn.00438b68
push 0xffffffffffffffff
push 0
push 0x185
push 0x425
push esi
call sub.USER32.dll_SendDlgItemMessageA
movzx eax, word [0x4ddd4c]
movzx edx, word [0x4ddd50]
shl edx, 0x10
or eax, edx
push eax
push 0
push 0x201
push 0x425
push esi
call sub.USER32.dll_SendDlgItemMessageA
movzx ecx, word [0x4ddd4c]
movzx eax, word [0x4ddd50]
shl eax, 0x10
or ecx, eax
push ecx
push 0
push 0x202
push 0x425
push esi
call sub.USER32.dll_SendDlgItemMessageA
cmp dword [0x4ddd24], 0
je 0x438cf0
push 0x80
push 0x10
call fcn.00438b68
push 0x4e4b90
push 0x4dc17c
push esi
call fcn.00489b64
jmp 0x438e08
push 0x4ddd4c
mov edx, dword [ebp + 0xc]
push edx
call sub.SHELL32.dll_DragQueryPoint
push 0xffffffffffffffff
push 0
push 0x201
push 0x425
push esi
call sub.USER32.dll_SendDlgItemMessageA
push 0xffffffffffffffff
push 0
push 0x202
push 0x425
push esi
call sub.USER32.dll_SendDlgItemMessageA
mov ecx, dword [0x4ddd18]
add ecx, 4
push esi
mov edi, ecx
mov esi, 0x4dc17c
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x438e08
mov eax, dword [0x4ddd18]
cmp byte [eax + 0x4cc], 2
jne 0x438d8f
push 0x4e4b90
push 0x4dc17c
push esi
call fcn.00489b64
jmp 0x438e08
mov edx, dword [0x4ddd18]
cmp byte [edx + 0x4cc], 7
jne 0x438e08
push 0x4ddd4c
mov ecx, dword [ebp + 0xc]
push ecx
call sub.SHELL32.dll_DragQueryPoint
movzx eax, word [0x4ddd4c]
movzx edx, word [0x4ddd50]
shl edx, 0x10
or eax, edx
push eax
push 0
push 0x201
push 0x425
push esi
call sub.USER32.dll_SendDlgItemMessageA
movzx ecx, word [0x4ddd4c]
movzx eax, word [0x4ddd50]
shl eax, 0x10
or ecx, eax
push ecx
push 0
push 0x202
push 0x425
push esi
call sub.USER32.dll_SendDlgItemMessageA
push 0x4e4b90
push 0x4dc17c
push esi
call fcn.00489b64
cmp byte [0x4dc17c], 0
jne 0x438e1d
push 0
call sub.USER32.dll_MessageBeep
jmp 0x438f9f
push 0x4dc17c
call fcn.004bceac
pop ecx
add eax, 2
push eax
call fcn.004c75a4
pop ecx
mov edi, eax
mov dword [0x4ddd28], edi
test edi, edi
jne 0x438e4a
push 0
call sub.USER32.dll_MessageBeep
jmp 0x438f9f
mov eax, dword [0x4ddd28]
push esi
mov esi, eax
mov edi, 0x4dc17c
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
call sub.SHELL32.dll_DragQueryFileA
mov edi, eax
mov dword [0x4ddd1c], edi
test edi, edi
jg 0x438e9c
push 0
call sub.USER32.dll_MessageBeep
jmp 0x438f9f
xor eax, eax
mov dword [0x4ddd20], eax
jmp 0x438f8d
push 0x3e7
push ebx
push edi
mov edx, dword [ebp + 0xc]
push edx
call sub.SHELL32.dll_DragQueryFileA
test eax, eax
jbe 0x438f87
push 0x4ece7b
push 0x4ecd7b
push 0x4ecc7b
push 0x4ecc78
push ebx
call fcn.004c11fc
add esp, 0x14
push 0x4ece7b
push 0x4ecd7b
push 0x4cd033
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov ecx, dword [0x4ddd24]
push ecx
push 0x4e4b90
push ebx
call fcn.00438a7c
test eax, eax
je 0x438f87
push 0x4ece7b
push 0x4ecd7b
push 0x4ecc7b
push 0x4ecc78
push 0x4cd039
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x18
push 0x20
push ebx
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x438f57
push ebx
mov eax, dword [0x4ddd28]
push eax
push 0x4cd043
push 0x4e4f77
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x438f71
push ebx
mov edx, dword [0x4ddd28]
push edx
push 0x4cd04c
push 0x4e4f77
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 1
push 0x4e4f77
push 0x4e4b90
push esi
call fcn.00460104
test eax, eax
je 0x438f9f
inc dword [0x4ddd20]
mov edi, dword [0x4ddd20]
cmp edi, dword [0x4ddd1c]
jl 0x438ea8
mov eax, dword [0x4ddd28]
test eax, eax
je 0x438faf
push eax
call fcn.004c749c
pop ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.SHELL32.dll_DragFinish
push esi
call sub.USER32.dll_SetFocus
pop edi
pop esi
pop ebx
pop ebp
ret 8