Function at 0x43dcac
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, 0x4de1bc
cmp dword [0x4cd18c], 0
je 0x43dccd
xor eax, eax
jmp 0x43e3d2
mov eax, dword [0x4cb350]
cmp ebx, eax
jne 0x43dcdc
push eax
call fcn.004182bc
push ebx
call fcn.004b7934
mov dword [0x4de1b4], eax
cmp dword [0x4de1b4], 0
jne 0x43dcfe
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
jmp 0x43e3d2
mov edx, dword [0x4de1b4]
cmp byte [edx + 0x4e3], 0
je 0x43de42
push 0
push 0
push 0xb0
mov ecx, dword [0x4de1b4]
mov eax, dword [ecx + 0x518]
push eax
call sub.USER32.dll_SendMessageA
mov dword [0x4de1cc], eax
push 0
push 0
push 0xe
mov edx, dword [0x4de1b4]
mov ecx, dword [edx + 0x518]
push ecx
call sub.USER32.dll_SendMessageA
mov edx, dword [0x4de1cc]
shr edx, 0x10
and dx, 0xffff
movzx ecx, dx
cmp eax, ecx
jle 0x43dd65
xor eax, eax
jmp 0x43e3d2
cmp edi, 3
jne 0x43de42
push 0x4de5bf
push 0x3b5
push 0xd
mov eax, dword [0x4de1b4]
mov edx, dword [eax + 0x518]
push edx
call sub.USER32.dll_SendMessageA
mov dword [0x4de1cc], eax
cmp dword [0x4de1cc], 0
jle 0x43de3b
mov ecx, dword [0x4de1cc]
mov byte [ecx + 0x4de5bf], 0
push 0x4cd1c4
push 0x4de5bf
call fcn.004bcdd0
add esp, 8
push 0x4de5bf
push 0
push 0xc
mov eax, dword [0x4de1b4]
mov edx, dword [eax + 0x518]
push edx
call sub.USER32.dll_SendMessageA
mov ecx, dword [0x4de1b4]
mov eax, dword [ecx + 0x518]
push eax
call sub.USER32.dll_UpdateWindow
push 0x4de5bf
call fcn.004bceac
pop ecx
push eax
push 0x4de5bf
call fcn.004bceac
pop ecx
push eax
push 0xb1
mov edx, dword [0x4de1b4]
mov ecx, dword [edx + 0x518]
push ecx
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov eax, dword [0x4de1b4]
mov edx, dword [eax + 0x518]
push edx
call sub.USER32.dll_SendMessageA
mov eax, 2
jmp 0x43e3d2
xor eax, eax
jmp 0x43e3d2
cmp edi, 2
jl 0x43de51
mov eax, 1
jmp 0x43e3d2
push 0x4de5bf
push 0x3b5
push 0xd
mov edx, dword [0x4de1b4]
mov ecx, dword [edx + 0x518]
push ecx
call sub.USER32.dll_SendMessageA
mov dword [0x4de1cc], eax
cmp dword [0x4de1cc], 0
jg 0x43deac
push 0x4cd1c8
push 0
push 0xc
mov eax, dword [0x4de1b4]
mov edx, dword [eax + 0x518]
push edx
call sub.USER32.dll_SendMessageA
test edi, edi
je 0x43dea2
push 0
call sub.USER32.dll_MessageBeep
mov eax, 1
jmp 0x43e3d2
mov edx, dword [0x4de1cc]
mov byte [edx + 0x4de5bf], 0
push 0x4cd1cc
push 0
push 0xc
mov ecx, dword [0x4de1b4]
mov eax, dword [ecx + 0x518]
push eax
call sub.USER32.dll_SendMessageA
mov edx, dword [0x4de1b4]
mov ecx, dword [edx + 0x518]
push ecx
call sub.USER32.dll_UpdateWindow
mov eax, dword [0x4de1b4]
cmp byte [eax + 0x4e3], 0
jne 0x43df5f
cmp dword [0x4cd188], 0
je 0x43df5f
jmp 0x43df3f
push 0x4cd1d0
push 0x4de5bf
call fcn.004bd134
add esp, 8
mov edi, eax
mov dword [esi], edi
test edi, edi
je 0x43df48
mov byte [edi], 0
cmp byte [edi + 2], 0
je 0x43df3f
mov eax, dword [esi]
add eax, 2
push eax
call fcn.004bceac
pop ecx
inc eax
push eax
mov edx, edi
add edx, 2
push edx
push edi
call fcn.004bcce0
add esp, 0xc
cmp byte [0x4de5bf], 0
jne 0x43deff
cmp byte [0x4de5bf], 0
jne 0x43df5f
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
jmp 0x43e3d2
mov eax, 0x4de5bf
mov edx, 0x4cd1d4
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x43df85
test cl, cl
je 0x43dfaf
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x43df85
add eax, 2
add edx, 2
test cl, cl
jne 0x43df69
je 0x43dfaf
mov eax, 0x4de5bf
mov edx, 0x4cd1d7
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x43dfbf
test cl, cl
je 0x43dfad
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x43dfbf
add eax, 2
add edx, 2
test cl, cl
jne 0x43df91
jne 0x43dfbf
push ebx
call fcn.0040c72c
mov eax, 1
jmp 0x43e3d2
mov eax, 0x4de5bf
mov edx, 0x4cd1dc
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x43dfe5
test cl, cl
je 0x43e01b
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x43dfe5
add eax, 2
add edx, 2
test cl, cl
jne 0x43dfc9
je 0x43e01b
mov eax, 0x4de5bf
mov edx, str.___r_n
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x43e0c8
test cl, cl
je 0x43e015
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x43e0c8
add eax, 2
add edx, 2
test cl, cl
jne 0x43dff1
jne 0x43e0c8
cmp dword [0x4cd17c], 0
jne 0x43e032
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
jmp 0x43e3d2
push 0x4cd1e6
mov edx, dword [0x4cd17c]
push edx
call fcn.004bd134
add esp, 8
mov ebx, eax
mov dword [0x4de1c0], ebx
test ebx, ebx
je 0x43e055
mov byte [ebx], 0
mov eax, dword [0x4cd17c]
push eax
push 0
push 0xc
mov edx, dword [0x4de1b4]
mov ecx, dword [edx + 0x518]
push ecx
call sub.USER32.dll_SendMessageA
mov eax, dword [0x4cd17c]
push eax
call fcn.004bceac
pop ecx
push eax
mov edx, dword [0x4cd17c]
push edx
call fcn.004bceac
pop ecx
push eax
push 0xb1
mov ecx, dword [0x4de1b4]
mov eax, dword [ecx + 0x518]
push eax
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov edx, dword [0x4de1b4]
mov ecx, dword [edx + 0x518]
push ecx
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x43e3d2
cmp dword [0x4d3818], 0
je 0x43e0f5
mov edx, dword [0x4d3818]
mov dword [0x4de1c4], edx
jmp 0x43e0ec
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov eax, dword [eax + 0x2c]
mov dword [0x4de1c4], eax
mov eax, dword [0x4de1c4]
test eax, eax
jne 0x43e0df
push 0
call fcn.004c92e8
pop ecx
mov dword [0x4cd184], eax
mov al, byte [0x4de5bf]
cmp al, 0x2f
je 0x43e144
cmp al, byte [0x4d1c54]
je 0x43e144
push ebx
call fcn.004111dc
mov dword [0x4de1b8], eax
cmp dword [0x4de1b8], 0
je 0x43e144
mov edx, dword [0x4de1b8]
cmp dword [edx + 0x51c], 3
je 0x43e144
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
jmp 0x43e3d2
mov dword [0x4cd18c], 1
mov dword [esi], 0x4de5bf
jmp 0x43e3ba
push 0x4cd1ea
mov edx, dword [esi]
push edx
call fcn.004bd134
add esp, 8
mov edi, eax
mov dword [0x4de1c0], edi
test edi, edi
je 0x43e17f
mov byte [edi], 0
add dword [0x4de1c0], 2
mov eax, dword [esi]
push eax
call fcn.004bceac
pop ecx
mov edi, eax
mov dword [0x4de1d4], edi
test edi, edi
jle 0x43e307
cmp edi, 0x3b5
jle 0x43e1aa
mov dword [0x4de1d4], 0x3b5
mov eax, dword [esi]
mov edx, dword [0x4de1d4]
mov cl, byte [eax + edx]
mov byte [0x4de1d0], cl
mov edx, dword [0x4de1d4]
mov byte [eax + edx], 0
mov eax, dword [esi]
push esi
mov esi, 0x4de1d8
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [esi]
mov edx, dword [0x4de1d4]
mov cl, byte [0x4de1d0]
mov byte [eax + edx], cl
mov eax, dword [0x4cd17c]
test eax, eax
je 0x43e20e
push eax
call fcn.004c749c
pop ecx
push 0x4de1d8
call fcn.004bceac
pop ecx
add eax, 5
push eax
call fcn.004c75a4
pop ecx
mov edi, eax
mov dword [0x4cd17c], edi
test edi, edi
je 0x43e257
push esi
push edi
mov esi, edi
mov edi, 0x4de1d8
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x4de1d8
push ebx
call fcn.0040c60c
mov dword [0x4de1c8], 1
cmp dword [0x4d2374], 0
je 0x43e2a4
mov dword [0x4cd180], ebx
xor eax, eax
mov dword [0x4d2630], eax
push 0
push 0x17
push 0x4cd1ee
call fcn.0049a318
test eax, eax
jne 0x43e29c
xor edx, edx
mov dword [0x4de1c8], edx
xor ecx, ecx
mov dword [0x4cd180], ecx
push ebx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x43e2bd
mov eax, dword [0x4de1b4]
push eax
call fcn.004b5f30
test eax, eax
jne 0x43e2c6
xor ebx, ebx
xor eax, eax
mov dword [0x4de1b4], eax
cmp dword [0x4de1c8], 0
je 0x43e2ff
test ebx, ebx
je 0x43e2ff
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x43e2f0
push 3
push 0
push 0x4de1d8
push ebx
call fcn.00460104
jmp 0x43e2ff
push 0
push 0
push 0x4de1d8
push ebx
call fcn.00460104
test ebx, ebx
je 0x43e3c5
mov edx, dword [0x4de1b4]
push edx
call fcn.004b5f30
test eax, eax
je 0x43e3af
mov ecx, dword [0x4de1b4]
cmp dword [ecx + 0x518], 0
je 0x43e3af
mov eax, dword [0x4de1b4]
cmp byte [eax + 0x6e0], 0
je 0x43e3af
mov eax, dword [0x4de1b4]
mov edx, eax
add edx, 0x6e0
push edx
push 0
push 0xc
mov ecx, dword [eax + 0x518]
push ecx
call sub.USER32.dll_SendMessageA
mov eax, dword [0x4de1b4]
add eax, 0x6e0
push eax
call fcn.004bceac
pop ecx
push eax
mov ebx, dword [0x4de1b4]
mov eax, ebx
add eax, 0x6e0
push eax
call fcn.004bceac
pop ecx
push eax
push 0xb1
mov edx, dword [ebx + 0x518]
push edx
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov ecx, dword [0x4de1b4]
mov eax, dword [ecx + 0x518]
push eax
call sub.USER32.dll_SendMessageA
jmp 0x43e3c5
mov eax, dword [0x4de1c0]
test eax, eax
je 0x43e3c5
mov dword [esi], eax
mov edx, dword [esi]
cmp byte [edx], 0
jne 0x43e159
xor ecx, ecx
mov dword [0x4cd18c], ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8