Function at 0x4082b0
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
sub esp, 0x25c
mov ecx, dword [eax + 4]
push ebx
push ebp
xor ebp, ebp
push esi
push edi
test ecx, 0x10000000
je 0x408353
push 1
push ebp
push ebp
call dword [sym.imp.USER32.dll_OpenInputDesktop]
cmp eax, ebp
je 0x40858f
mov esi, dword [sym.imp.USER32.dll_GetUserObjectInformationA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x170]
push 0x100
push edx
push 2
push eax
call esi
test eax, eax
je 0x40858f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
cmp eax, ebp
je 0x40858f
lea ecx, [esp + 0x10]
lea edx, [esp + 0x6c]
push ecx
push 0x100
push edx
push 2
push eax
call esi
test eax, eax
je 0x40858f
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x16c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40858f
mov eax, dword [esp + 0x270]
mov dword [esp + 0x10], ebp
cmp dword [eax + 0xc], ebp
jle 0x408710
mov ebx, dword [sym.imp.USER32.dll_mouse_event]
lea ecx, [eax + 0x10]
mov dword [esp + 0x20], ecx
mov eax, dword [ecx]
cmp eax, 0x201
je 0x408402
cmp eax, 0x207
je 0x408402
cmp eax, 0x204
je 0x408402
cmp eax, 0x203
je 0x408402
cmp eax, 0x209
je 0x408402
cmp eax, 0x206
je 0x408402
cmp eax, 0x200
je 0x408402
cmp eax, 0x202
je 0x408402
cmp eax, 0x208
je 0x408402
cmp eax, 0x20a
je 0x408402
cmp eax, 0x8801
jne case.0x408494.517
mov eax, dword [ecx + 4]
mov dl, byte [ecx + 4]
test ah, 1
mov byte [esp + 0x1c], dl
je 0x4083ee
mov eax, dword [esp + 0x1c]
push 0x10
push eax
call fcn.00404580
add esp, 8
jmp case.0x408494.517
mov ecx, dword [esp + 0x1c]
push 1
push ecx
call fcn.00404580
add esp, 8
jmp case.0x408494.517
mov edi, dword [ecx + 8]
xor esi, esi
mov si, word [ecx + 8]
shr edi, 0x10
cmp eax, 0x200
je 0x40841d
push edi
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebp
fild qword [esp + 0x24]
push ebp
fstp dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetSystemMetrics]
dec eax
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fdivr dword [esp + 0x18]
fmul dword [0x417540]
call fcn.0040f2a0
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebp
fild qword [esp + 0x2c]
push 1
mov esi, eax
fstp dword [esp + 0x18]
call dword [sym.imp.USER32.dll_GetSystemMetrics]
dec eax
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fdivr dword [esp + 0x14]
fmul dword [0x417540]
call fcn.0040f2a0
mov edx, dword [esp + 0x20]
mov edi, eax
mov eax, dword [edx]
add eax, 0xfffffe00
cmp eax, 0xa
ja case.0x408494.517
jmp dword [eax*4 + 0x40871c]
push ebp
push ebp
push edi
push esi
push 0x8002
jmp 0x40855c
push ebp
push ebp
push edi
push esi
push 0x8020
jmp 0x40855c
push ebp
push ebp
push edi
push esi
push 0x8002
call ebx
push ebp
push ebp
push edi
push esi
push 0x8004
call ebx
push ebp
push ebp
push edi
push esi
push 0x8002
call ebx
push ebp
push ebp
push edi
push esi
push 0x8004
jmp 0x40855c
push ebp
push ebp
push edi
push esi
push 0x8020
call ebx
push ebp
push ebp
push edi
push esi
push 0x8040
call ebx
push ebp
push ebp
push edi
push esi
push 0x8020
call ebx
push ebp
push ebp
push edi
push esi
push 0x8040
jmp 0x40855c
push ebp
push ebp
push edi
push esi
push 0x8008
call ebx
push ebp
push ebp
push edi
push esi
push 0x8010
call ebx
push ebp
push ebp
push edi
push esi
push 0x8008
call ebx
push ebp
push ebp
push edi
push esi
push 0x8010
jmp 0x40855c
push ebp
push ebp
push edi
push esi
push 0x8001
jmp 0x40855c
mov eax, dword [esp + 0x20]
push ebp
mov ecx, dword [eax + 4]
shr ecx, 0x10
movsx edx, cx
push edx
push edi
push esi
push 0x8800
call ebx
mov edx, dword [esp + 0x270]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
inc eax
mov esi, dword [edx + 0xc]
add ecx, 0xc
cmp eax, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ecx
jl 0x408374
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x25c
ret
mov ebx, dword [esp + 0x270]
mov dword [esp + 0x1c], ebp
cmp dword [ebx + 0xc], ebp
jle 0x408710
add ebx, 0x10
mov eax, dword [ebx]
cmp eax, 0x201
je 0x408629
cmp eax, 0x200
je 0x408629
cmp eax, 0x202
je 0x408629
cmp eax, 0x8801
jne 0x4086f2
mov al, byte [ebx + 4]
push ebp
mov byte [esp + 0x14], al
mov ecx, dword [esp + 0x14]
and ecx, 0xff
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x50], 1
movzx dx, byte [esp + 0x10]
and ecx, 0x100
mov word [esp + 0x54], dx
or cl, 0x80
mov dword [esp + 0x5c], ebp
movzx ax, al
shr ecx, 7
mov dword [esp + 0x58], ecx
mov word [esp + 0x56], ax
mov dword [esp + 0x60], ebp
sub esp, 0x1c
mov ecx, 7
lea esi, [esp + 0x6c]
jmp 0x4086e9
mov edi, dword [ebx + 8]
xor esi, esi
mov si, word [ebx + 8]
shr edi, 0x10
push edi
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esp + 0x2c], esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esp + 0x30], ebp
push ebp
fild qword [esp + 0x30]
fstp dword [esp + 0x18]
call esi
dec eax
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fdivr dword [esp + 0x14]
fmul dword [0x417540]
call fcn.0040f2a0
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebp
fild qword [esp + 0x24]
push 1
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], eax
fstp dword [esp + 0x18]
call esi
dec eax
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fdivr dword [esp + 0x14]
fmul dword [0x417540]
call fcn.0040f2a0
mov dword [esp + 0x3c], eax
mov eax, dword [ebx]
sub eax, 0x200
mov dword [esp + 0x40], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
je 0x4086d5
dec eax
je 0x4086cb
dec eax
jne 0x4086f2
mov dword [esp + 0x44], 0x8004
jmp 0x4086dd
mov dword [esp + 0x44], 0x8002
jmp 0x4086dd
mov dword [esp + 0x44], 0x8001
sub esp, 0x1c
mov ecx, 7
lea esi, [esp + 0x50]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call sub.REDCOMM.dll_Ordinal_146
mov edx, dword [esp + 0x270]
mov eax, dword [esp + 0x1c]
inc eax
add ebx, 0xc
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x1c], eax
cmp eax, ecx
jl 0x4085a6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x25c
ret