Function at 0x426385
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x4320ef
call fcn.00430fb0
sub esp, 0xe0
push ebx
push esi
push edi
call fcn.00425d1d
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4263fe
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebx
call edi
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push ebx
call edi
xor eax, eax
jmp 0x426585
xor ebx, ebx
mov dword [ebp - 0x50], 0x43a908
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], ebx
mov edi, dword [0x45795c]
lea eax, [ebp - 0x50]
add edi, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x58], edi
mov byte [ebp - 0x54], bl
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x54], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x457950]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00408b8d
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp + 8]
lea eax, [ebp - 0xec]
push eax
mov byte [ebp - 4], bl
call fcn.00425061
lea eax, [ebp - 0xec]
lea esi, [ebp - 0xe4]
mov byte [ebp - 4], 2
call fcn.004033be
mov byte [ebp - 0xcc], bl
mov dword [ebp - 0xc8], ebx
mov ebx, dword [0x445478]
call fcn.00409902
xor ebx, ebx
cmp dword [ebp - 0xc8], ebx
jge 0x4264c9
cmp eax, ebx
je 0x4264cd
push dword [ebp - 0xe8]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp eax, ebx
jne 0x426515
lea eax, [ebp - 0xec]
push eax
mov byte [ebp - 4], bl
call fcn.00424fde
mov dword [ebp - 4], 3
cmp dword [ebp - 0x40], ebx
je 0x4264f4
push dword [ebp - 0x40]
call fcn.0040be45
pop ecx
mov dword [ebp - 0x40], ebx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x4c], ebx
je 0x4263f7
push dword [ebp - 0x4c]
call fcn.0040be45
pop ecx
jmp 0x4263f7
push dword [ebp + 0xc]
push dword [ebp - 0xe8]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0042c3cd
lea esi, [ebp - 0x50]
mov dword [0x443134], ebx
mov dword [0x457770], ebx
call fcn.004050d9
mov esi, eax
call fcn.0040532a
lea eax, [ebp - 0xec]
push eax
mov byte [ebp - 4], bl
call fcn.00424fde
mov dword [ebp - 4], 4
cmp dword [ebp - 0x40], ebx
je 0x42656b
push dword [ebp - 0x40]
call fcn.0040be45
pop ecx
mov dword [ebp - 0x40], ebx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x4c], ebx
je 0x426583
push dword [ebp - 0x4c]
call fcn.0040be45
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret