Function at 0x4203e0
Capabilities:
Check if file exists
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
movzx ecx, word [ebp + 8]
cmp ecx, 0x800
ja case.default.0x42041d
je 0x42065a
lea eax, [ecx - 0x400]
cmp eax, 0xa
ja case.default.0x42041d
jmp dword [eax*4 + 0x42068c]
mov ecx, edi
call fcn.004220f0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00422ae0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push 0
push 0x51c748
push 0x51c748
push dword [edi]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push 3
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x380]
mov esi, eax
sub ecx, dword [edi + 0x37c]
mov eax, 0x2aaaaaab
mov ebx, dword [edi + 0x1c]
imul ecx
mov dword [ebp - 0x41c], ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x4204df
test esi, esi
js 0x4204df
cmp esi, eax
jge 0x4204df
mov ebx, dword [edi + 0x37c]
lea eax, [esi + esi*2]
mov ebx, dword [ebx + eax*4]
mov dword [ebp - 0x41c], ebx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x420516
push ebx
push 0x51c36c
push eax
push 0x51c380
push dword [edi]
call fcn.00425190
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
push 0x10
movzx ebx, ax
call esi
shr eax, 0xf
shr ebx, 0xf
and al, 1
test bl, 1
je 0x42053f
test al, al
jne 0x42053f
mov ebx, 1
jmp 0x420541
xor ebx, ebx
mov esi, dword [ebp - 0x41c]
push esi
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x42057e
push ebx
push 0
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHOpenFolderAndSelectItems]
push dword [ebp - 0x41c]
mov ebx, eax
call dword [sym.imp.SHELL32.dll_SHFree]
shr ebx, 0x1f
xor bl, 1
jne 0x420661
push esi
push 0x51c38c
lea eax, [ebp - 0x418]
push 0x208
push eax
call fcn.00407ae0
add esp, 0x10
lea eax, [ebp - 0x418]
push 0
push 0x51c3bc
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00421ca0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
cmp ecx, 0x404
sete al
cmp ecx, 0x405
movzx eax, al
mov ecx, edi
push eax
sete dl
call fcn.00421d40
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00422a30
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
cmp ecx, 0x407
mov ecx, edi
sete dl
call fcn.00420210
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00422470
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dadd7
mov esp, ebp
pop ebp
ret