Function at 0x42632c
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x426334
push ebx
push esi
push edi
mov eax, 0x42629c
call fcn.004065c0
xor eax, eax
push ebp
push 0x426941
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4268c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004029e4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00407f6c
mov eax, dword [ebp - 0x1c]
call fcn.00421b54
test al, al
jne 0x4263a5
push 0x10
push 0x426950
push 0x426958
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x426926
mov eax, 0x428aac
call fcn.0040427c
mov dword [0x428b08], 1
xor eax, eax
mov dword [0x428ab8], eax
xor eax, eax
mov dword [0x428abc], eax
xor eax, eax
mov dword [0x428ac0], eax
xor eax, eax
mov dword [0x428ac8], eax
mov byte [0x428b11], 0
mov byte [0x428b10], 0
xor eax, eax
mov dword [0x428ae8], eax
xor eax, eax
mov dword [0x428ac4], eax
xor eax, eax
mov dword [0x428aa4], eax
push 0
mov eax, 0x428b14
mov ecx, 1
mov edx, dword [0x42182c]
call fcn.00405770
add esp, 4
call fcn.00422358
mov dword [0x428b04], eax
push 0x42697c
push 0
push 0x1f0001
call sub.kernel32.dll_OpenMutexA
mov dword [0x428ac4], eax
cmp dword [0x428ac4], 0
je 0x4264a7
lea edx, [ebp - 0x28]
mov eax, 1
call fcn.004029e4
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00407808
mov eax, dword [ebp - 0x24]
push eax
lea edx, [ebp - 0x2c]
mov eax, 0x4269c4
call fcn.00407808
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00404678
jne 0x426479
call fcn.00426164
jmp 0x4268bd
push 0x24
push 0x426950
mov eax, dword [0x4277a8]
mov eax, dword [eax]
call fcn.0040472c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x4268bd
call fcn.00426164
jmp 0x4268bd
lea edx, [ebp - 0x34]
mov eax, 1
call fcn.004029e4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00407808
mov eax, dword [ebp - 0x30]
push eax
mov eax, 0x4269c4
lea edx, [ebp - 0x38]
call fcn.00407808
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00404678
jne 0x4264e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x426926
push 0x42697c
push 0
push 0
call fcn.0040669c
mov dword [0x428ac4], eax
lea eax, [ebp - 0x3c]
call fcn.00422560
mov edx, dword [ebp - 0x3c]
mov eax, 0x428af4
call fcn.004042d0
mov eax, dword [0x428af4]
call fcn.00407ef4
test al, al
jne 0x426544
push 0xffff
mov ecx, dword [0x428af4]
mov dl, 1
mov eax, dword [0x418218]
call fcn.0041b29c
mov dword [0x428aec], eax
mov eax, dword [0x428aec]
call fcn.00403544
xor eax, eax
push ebp
push 0x4268b3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41
mov ecx, dword [0x428af4]
mov dl, 1
mov eax, dword [0x418218]
call fcn.0041b29c
mov dword [0x428aec], eax
push 0
push 0
mov eax, dword [0x428aec]
call fcn.0041ae0c
xor eax, eax
mov dword [0x428b0c], eax
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [0x428b0c], eax
mov edx, 0x428b0c
mov ecx, 4
mov eax, dword [0x428aec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, 0x428af8
call fcn.0040427c
mov edx, 0x428af8
xor eax, eax
call fcn.004029e4
mov eax, dword [0x428af8]
call fcn.00404534
mov dword [0x428b08], eax
mov edx, 0x428b08
mov ecx, 2
mov eax, dword [0x428aec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, 0x428af8
call fcn.00404784
mov edx, eax
mov ecx, dword [0x428b08]
mov eax, dword [0x428aec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, 0x428af8
call fcn.0040427c
mov dword [0x428b08], 1
push 0
mov eax, 0x428aa8
mov ecx, 1
mov edx, dword [0x4218a0]
call fcn.00405770
add esp, 4
xor eax, eax
mov dword [0x428afc], eax
xor eax, eax
mov dword [0x428b00], eax
mov eax, 0x428af0
call fcn.0040427c
lea edx, [ebp - 0x44]
xor eax, eax
call fcn.004029e4
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.004222e8
mov edx, dword [ebp - 0x40]
mov eax, 0x428af0
call fcn.004042d0
call fcn.004261e0
push 0
mov eax, dword [0x428710]
push eax
push 0x425c84
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x428aa0], eax
xor eax, eax
push ebp
push 0x4267aa
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x42675b
cmp dword [0x428ad0], 0x10
jne 0x4266a7
cmp byte [0x428b10], 0
je 0x426773
jmp 0x42675b
cmp dword [0x428ad0], 0xf
jne 0x4266ba
call fcn.00424a74
jmp 0x42675b
mov eax, dword [0x428ad0]
xor edx, edx
push edx
push eax
mov eax, dword [0x428b04]
cdq
cmp edx, dword [esp + 4]
jne 0x4266d2
cmp eax, dword [esp]
pop edx
pop eax
jne 0x42675b
mov eax, dword [0x428ad4]
sub eax, 0x14
je 0x4266f5
sub eax, 0xa
je 0x426711
sub eax, 0xa
je 0x426742
sub eax, 0xa
je 0x426754
jmp 0x42675b
mov eax, dword [0x428ad8]
mov dword [0x428ae8], eax
cmp dword [0x428ae8], 0
jne 0x42675b
mov byte [0x428b11], 0
jmp 0x42675b
mov eax, 0x428af8
call fcn.0040427c
mov eax, 0x428af8
mov edx, dword [0x428aac]
call fcn.004042d0
call fcn.004261e0
mov eax, 0x428aac
mov edx, dword [0x428af8]
call fcn.004042d0
jmp 0x42675b
cmp dword [0x428ae8], 0
je 0x42675b
mov byte [0x428b11], 1
jmp 0x42675b
mov byte [0x428b11], 0
push 0
push 0
push 0
push 0x428acc
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x42668c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4267b1
mov eax, dword [0x428aa0]
push eax
call sub.user32.dll_UnhookWindowsHookEx
call fcn.00424bec
cmp dword [0x428aa4], 0
je 0x4267a4
mov eax, dword [0x428aa4]
push eax
call sub.user32.dll_UnhookWindowsHookEx
call fcn.00424a84
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x426926
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426948
lea eax, [ebp - 0x48]
mov edx, 0xc
call fcn.004042a0
ret