Function at 0x42ca00
Capabilities:
Capture screenshot
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x44d1d0
push 0x4371c0
mov eax, dword fs:[0]
push eax
sub esp, 0x360
mov eax, dword [0x451050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0xf4], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd4], eax
call fcn.0041c110
mov dword [0x45a370], eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42ca64
xor edi, edi
mov dword [ebp + 8], edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x124], 0x14
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.USER32.dll_GetCursorInfo]
mov dword [ebp - 0x370], esi
push 0x20c
push esi
lea edx, [ebp - 0x36c]
push edx
call fcn.00437610
add esp, 0xc
mov dword [ebp - 0xec], esi
xor eax, eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xb0], esi
push 0x4c
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call esi
mov dword [ebp - 0xc4], eax
push 0x4e
call esi
add eax, dword [ebp - 0xc4]
mov dword [ebp - 0xbc], eax
push 0x4d
call esi
mov dword [ebp - 0xc0], eax
push 0x4f
call esi
add eax, dword [ebp - 0xc0]
mov dword [ebp - 0xb8], eax
cmp edi, 1
jne 0x42cd96
mov eax, ebx
mov esi, dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x36c], eax
push 4
push eax
call esi
test eax, eax
jne 0x42cb35
lea eax, [ebp - 0x370]
push eax
mov ecx, dword [ebp - 0x36c]
push ecx
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
push 0
push str.Progman
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x42cb8d
lea edx, [ebp - 0xcc]
push edx
push eax
call esi
mov eax, dword [ebp - 0x370]
cmp eax, dword [ebp - 0xcc]
jne 0x42cb8d
mov dword [ebp - 0x164], 1
lea ecx, [ebp - 0x370]
push ecx
push 0x42c860
push 0
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
xor eax, eax
mov ecx, dword [ebp - 0x168]
test ecx, ecx
jle 0x42cbbe
lea ecx, [ecx]
cmp dword [ebp + eax*4 - 0x368], ebx
je 0x42cbe9
inc eax
cmp eax, ecx
jl 0x42cbb0
cmp ecx, 0x80
jge 0x42cbdc
mov dword [ebp + ecx*4 - 0x368], ebx
mov ecx, dword [ebp - 0x168]
inc ecx
mov dword [ebp - 0x168], ecx
jmp 0x42cbe9
mov dword [ebp + ecx*4 - 0x36c], ebx
mov ecx, dword [ebp - 0x168]
test ecx, ecx
jle 0x42d55d
xor edi, edi
mov ebx, dword [ebp - 0xbc]
test ecx, ecx
jle 0x42cc5f
lea ecx, [ecx]
mov eax, dword [ebp + edi*4 - 0x368]
push eax
lea esi, [ebp - 0xec]
call fcn.0042c100
add esp, 4
test eax, eax
je 0x42cc4c
mov edx, dword [ebp - 0xc4]
cmp edx, dword [ebp - 0xe4]
jg 0x42cc4c
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0xe0]
jg 0x42cc4c
mov ecx, dword [ebp - 0xb8]
cmp ecx, dword [ebp - 0xe8]
jl 0x42cc4c
cmp ebx, dword [ebp - 0xec]
jge 0x42cc59
inc edi
mov ecx, dword [ebp - 0x168]
cmp edi, ecx
jl 0x42cc00
jmp 0x42cc5f
mov ecx, dword [ebp - 0x168]
cmp edi, ecx
jg 0x42cd45
inc edi
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0xb0], edx
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xac], eax
mov edx, dword [ebp - 0xe4]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xa4], eax
cmp edi, ecx
jge 0x42cd4b
mov eax, dword [ebp + edi*4 - 0x368]
push eax
lea esi, [ebp - 0xec]
call fcn.0042c100
add esp, 4
test eax, eax
je 0x42cd30
mov edx, dword [ebp - 0xe4]
cmp dword [ebp - 0xc4], edx
jg 0x42cd30
mov esi, dword [ebp - 0xe0]
cmp dword [ebp - 0xc0], esi
jg 0x42cd30
mov ecx, dword [ebp - 0xe8]
cmp dword [ebp - 0xb8], ecx
jl 0x42cd30
mov eax, dword [ebp - 0xec]
cmp ebx, eax
jl 0x42cd30
cmp dword [ebp - 0xb0], eax
jle 0x42cd00
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xac], ecx
jle 0x42cd0e
mov dword [ebp - 0xac], ecx
cmp dword [ebp - 0xa8], edx
jge 0x42cd1c
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0xa4]
cmp eax, esi
jge 0x42cd36
mov eax, esi
mov dword [ebp - 0xa4], eax
jmp 0x42cd36
mov eax, dword [ebp - 0xa4]
inc edi
cmp edi, dword [ebp - 0x168]
jl 0x42cca0
jmp 0x42cd4b
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xc4]
cmp dword [ebp - 0xb0], ecx
jg 0x42cd5f
mov dword [ebp - 0xb0], ecx
mov ecx, dword [ebp - 0xc0]
cmp dword [ebp - 0xac], ecx
jg 0x42cd73
mov dword [ebp - 0xac], ecx
cmp dword [ebp - 0xa8], ebx
jl 0x42cd81
mov dword [ebp - 0xa8], ebx
mov ecx, dword [ebp - 0xb8]
cmp eax, ecx
jl 0x42cee6
mov eax, ecx
jmp 0x42cee0
cmp edi, 2
jne 0x42ce03
push ebx
lea esi, [ebp - 0xb0]
call fcn.0042c100
add esp, 4
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xb0], eax
jg 0x42cdbe
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xac], eax
jg 0x42cdd2
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0xa8], eax
jl 0x42cde6
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xb8]
jl 0x42cee6
mov eax, dword [ebp - 0xb8]
jmp 0x42cee0
xor edi, edi
mov dword [ebp - 0xf4], edi
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x42ce4c
mov edx, dword [ebp - 0xc4]
mov dword [ebp - 0xb0], edx
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0xa8], ecx
mov eax, dword [ebp - 0xb8]
jmp 0x42cee0
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0xb8], edi
lea edx, [ebp - 0xbc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
push 1
mov eax, dword [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.USER32.dll_MonitorFromPoint]
mov dword [ebp - 0x15c], 0x28
cmp eax, edi
je 0x42cec7
lea edx, [ebp - 0x15c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x42cec7
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0x154]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x14c]
jmp 0x42cee0
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xb0], edi
push edi
call esi
mov dword [ebp - 0xa8], eax
push 1
call esi
mov dword [ebp - 0xa4], eax
xor esi, esi
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], esi
mov ecx, dword [ebp - 0xa8]
sub ecx, dword [ebp - 0xb0]
mov dword [ebp - 0x108], ecx
sub eax, dword [ebp - 0xac]
mov dword [ebp - 0x104], eax
cmp ecx, esi
jle 0x42d55d
cmp eax, esi
jle 0x42d55d
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 4], esi
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [ebp - 0xf8], ebx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
mov dword [ebp - 0xdc], edi
mov eax, dword [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0xc8], eax
test edi, edi
je 0x42d352
test eax, eax
je 0x42d352
mov edx, eax
push edx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
mov dword [ebp - 0x100], esi
test esi, esi
je 0x42d352
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, eax
push esi
lea edx, [ebp - 0x110]
push edx
push edi
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [ebp + 8]
test dword [0x452498], 0x400000
je 0x42d009
cmp esi, 1
je 0x42cff9
cmp esi, 2
jne 0x42d009
call fcn.0041c110
test eax, eax
je 0x42d009
mov eax, 1
jmp 0x42d00b
xor eax, eax
mov dword [ebp - 0xd8], eax
cmp esi, 1
jne 0x42d1bb
push 0
push 0
push 0
push 0
mov ebx, dword [sym.imp.GDI32.dll_CreateRectRgn]
call ebx
mov dword [ebp - 0xb4], eax
call dword [sym.imp.USER32.dll_GetShellWindow]
mov dword [ebp - 0xcc], eax
mov edi, dword [ebp - 0x168]
dec edi
mov dword [ebp - 0xf0], edi
test edi, edi
jl 0x42d09c
mov eax, dword [ebp + edi*4 - 0x368]
push eax
lea eax, [ebp - 0xb0]
call fcn.0042c710
add esp, 4
mov esi, eax
test esi, esi
je 0x42d081
push 2
push esi
mov eax, dword [ebp - 0xb4]
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0xcc]
cmp dword [ebp + edi*4 - 0x368], ecx
jne 0x42d042
mov dword [ebp - 0xd8], 0
jmp 0x42d042
cmp dword [ebp - 0xd8], 0
je 0x42d2a7
push 0
push 0
push 0
push 0
call ebx
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0xf0], eax
test eax, eax
jl 0x42d1f4
mov edx, dword [ebp + eax*4 - 0x368]
push edx
lea esi, [ebp - 0xec]
call fcn.0042c100
add esp, 4
test eax, eax
je 0x42d1b0
mov ecx, dword [ebp - 0xe4]
cmp dword [ebp - 0xb0], ecx
jg 0x42d1b0
mov ebx, dword [ebp - 0xe0]
cmp dword [ebp - 0xac], ebx
jg 0x42d1b0
mov esi, dword [ebp - 0xe8]
cmp dword [ebp - 0xa4], esi
jl 0x42d1b0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xa8], eax
jl 0x42d1b0
sub eax, dword [ebp - 0xb0]
xor edx, edx
test eax, eax
setle dl
dec edx
and edx, eax
mov edi, edx
mov eax, esi
sub eax, dword [ebp - 0xac]
xor edx, edx
test eax, eax
setle dl
dec edx
and edx, eax
sub ecx, dword [ebp - 0xb0]
lea eax, [ecx + 0xa]
mov ecx, dword [ebp - 0x108]
add ecx, 0xa
cmp eax, ecx
jge 0x42d170
mov ecx, eax
sub ebx, dword [ebp - 0xac]
lea esi, [ebx + 0xa]
mov eax, dword [ebp - 0x104]
add eax, 0xa
cmp esi, eax
jge 0x42d188
mov eax, esi
push eax
push ecx
push edx
push edi
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov esi, eax
test esi, esi
je 0x42d1b0
push 2
push esi
mov eax, dword [ebp - 0xd0]
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0xf0]
jmp 0x42d0bf
cmp esi, 2
jne 0x42d1f4
mov esi, dword [ebp - 0xf4]
push esi
lea eax, [ebp - 0xb0]
call fcn.0042c710
add esp, 4
mov dword [ebp - 0xb4], eax
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp esi, eax
jne 0x42d1f4
mov dword [ebp - 0xd8], 0
jmp 0x42d2a7
cmp dword [ebp - 0xd8], 0
je 0x42d2a7
mov ebx, dword [ebp - 0xb0]
add ebx, 0xfffffffb
mov dword [ebp - 0x134], ebx
mov eax, dword [ebp - 0xac]
add eax, 0xfffffffb
mov dword [ebp - 0x130], eax
mov esi, dword [ebp - 0xa8]
add esi, 5
mov dword [ebp - 0x12c], esi
mov edi, dword [ebp - 0xa4]
add edi, 5
mov dword [ebp - 0x128], edi
cmp dword [ebp + 8], 1
jne 0x42d258
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp + ecx*4 - 0x36c]
mov dword [ebp - 0xcc], edx
jmp 0x42d264
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xd0], 0
je 0x42d283
push 0
mov ecx, dword [ebp - 0xd0]
push ecx
mov edx, dword [0x45a374]
push edx
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 0x50
mov eax, dword [ebp - 0x130]
sub edi, eax
push edi
sub esi, ebx
push esi
push eax
push ebx
mov eax, dword [ebp - 0xcc]
push eax
mov ecx, dword [0x45a374]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 0xb4]
mov esi, dword [ebp - 0xdc]
test eax, eax
je 0x42d2c3
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
jmp 0x42d2c9
mov edi, dword [ebp - 0xb8]
push 0x40cc0020
mov edx, dword [ebp - 0xac]
push edx
mov eax, dword [ebp - 0xb0]
push eax
mov ecx, dword [ebp - 0xf8]
push ecx
mov edx, dword [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x108]
push eax
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [ebp - 0xb4], 0
je 0x42d30d
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebp - 0xd8], 0
je 0x42d336
push 0
mov ecx, dword [0x45a374]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
mov edx, dword [0x45a374]
push edx
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [ebp - 0xfc], 1
mov esi, dword [ebp - 0x100]
mov edi, dword [ebp - 0xdc]
mov ebx, dword [ebp - 0xf8]
mov dword [ebp - 4], 0xfffffffe
call fcn.0042d3b8
xor edx, edx
cmp dword [ebp - 0xfc], edx
jne 0x42d3f3
cmp dword [ebp - 0xc8], edx
je 0x42d381
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - 0xb4], 0
je 0x42d555
mov edx, dword [ebp - 0xb4]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0xfc]
jmp 0x42d55f
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx], eax
mov eax, dword [ebp - 0xb4]
mov dword [ecx + 4], eax
cmp dword [ebp - 0x120], 1
jne 0x42d44d
mov eax, dword [ebp - 0x11c]
cmp eax, edx
je 0x42d44d
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov ebx, dword [ebp - 0xd4]
mov dword [ebx + 0xc], eax
mov ecx, dword [ebp - 0x118]
sub ecx, dword [ebp - 0xb0]
mov dword [ebx + 0x10], ecx
mov edx, dword [ebp - 0x114]
sub edx, dword [ebp - 0xac]
mov dword [ebx + 0x14], edx
jmp 0x42d458
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
cmp eax, 2
je 0x42d4e0
cmp eax, 1
je 0x42d4e0
lea eax, [ebp - 0xa0]
push eax
push 0x4efd
mov ebx, 0x40
call fcn.0040af30
add esp, 8
lea eax, [ebp - 0xa0]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42d490
sub eax, edx
sar eax, 1
push eax
mov ebx, dword [ebp - 0xd4]
lea esi, [ebx + 0x18]
lea eax, [ebp - 0xa0]
call fcn.00403960
push 0x40
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0xa0]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42d4d3
jmp 0x42d542
push 0x40
lea edx, [ebp - 0xa0]
push edx
mov edi, dword [ebp - 0xf4]
push edi
call dword [sym.imp.USER32.dll_InternalGetWindowText]
lea eax, [ebp - 0xa0]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42d500
sub eax, edx
sar eax, 1
push eax
lea esi, [ebx + 0x18]
lea eax, [ebp - 0xa0]
call fcn.00403960
push 0x40
lea eax, [ebp - 0xa0]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0xa0]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42d537
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0xa0]
lea esi, [ebx + 0x34]
call fcn.00403960
mov eax, dword [ebp - 0xfc]
jmp 0x42d55f
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00433c32
mov esp, ebp
pop ebp
ret