Function at 0x424a35
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x4328f8], eax
mov ecx, dword [0x4328f8]
cmp dword [ecx + 4], 0x200
jne 0x424a80
mov edx, dword [0x4328f8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
push eax
mov ecx, dword [0x4328f8]
xor edx, edx
mov dx, word [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
xor eax, eax
jmp 0x42515d
mov eax, dword [0x4328f8]
cmp dword [eax + 4], 0x100
jne 0x424b0d
push 0
mov ecx, dword [0x4328f8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [0x4328f4], ax
mov dword [0x4327f0], 0
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 0xc]
and ecx, 0x1000000
test ecx, ecx
je 0x424ad1
mov edx, dword [0x4327f0]
add edx, 1
mov dword [0x4327f0], edx
push 0
mov eax, dword [0x4327f0]
push eax
mov cl, byte [0x4328f4]
push ecx
mov edx, dword [0x4328f8]
mov al, byte [edx + 8]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [0x4328f8]
cmp dword [ecx + 8], 0xd
jne 0x424b06
mov eax, 1
jmp 0x42515d
xor eax, eax
jmp 0x42515d
mov edx, dword [0x4328f8]
cmp dword [edx + 4], 0x101
jne 0x424b84
push 0
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [0x4328f4], ax
mov dword [0x4327f0], 2
mov edx, dword [0x4328f8]
mov eax, dword [edx + 0xc]
and eax, 0x1000000
test eax, eax
je 0x424b5e
mov ecx, dword [0x4327f0]
add ecx, 1
mov dword [0x4327f0], ecx
push 0
mov edx, dword [0x4327f0]
push edx
mov al, byte [0x4328f4]
push eax
mov ecx, dword [0x4328f8]
mov dl, byte [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_keybd_event]
xor eax, eax
jmp 0x42515d
mov eax, dword [0x4328f8]
cmp dword [eax + 4], 0x104
jne 0x424be8
push 0
mov ecx, dword [0x4328f8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [0x4328f4], ax
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov dl, byte [0x4328f4]
push edx
mov eax, dword [0x4328f8]
mov cl, byte [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
mov edx, dword [0x4328f8]
cmp dword [edx + 8], 0xd
jne 0x424be1
mov eax, 1
jmp 0x42515d
xor eax, eax
jmp 0x42515d
mov eax, dword [0x4328f8]
cmp dword [eax + 4], 0x105
jne 0x424c36
push 0
mov ecx, dword [0x4328f8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [0x4328f4], ax
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 0xc]
push ecx
push 3
mov dl, byte [0x4328f4]
push edx
mov eax, dword [0x4328f8]
mov cl, byte [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
xor eax, eax
jmp 0x42515d
mov edx, dword [0x4328f8]
cmp dword [edx + 4], 0x201
jne 0x424cdb
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
push ecx
mov edx, dword [0x4328f8]
xor eax, eax
mov ax, word [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [0x4327f0], 0x8002
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x424c94
mov dword [0x4327f0], 0x8008
push 0
push 0
mov ecx, dword [0x4328f8]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
push edx
mov eax, dword [0x4328f8]
xor ecx, ecx
mov cx, word [eax + 0xc]
push ecx
mov edx, dword [0x4327f0]
push edx
call dword [sym.imp.USER32.dll_mouse_event]
mov dword [0x432918], 1
xor eax, eax
jmp 0x42515d
mov eax, dword [0x4328f8]
cmp dword [eax + 4], 0x202
jne 0x424d7d
mov ecx, dword [0x4328f8]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
push edx
mov eax, dword [0x4328f8]
xor ecx, ecx
mov cx, word [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [0x4327f0], 0x8004
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x424d38
mov dword [0x4327f0], 0x8010
push 0
push 0
mov edx, dword [0x4328f8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
push eax
mov ecx, dword [0x4328f8]
xor edx, edx
mov dx, word [ecx + 0xc]
push edx
mov eax, dword [0x4327f0]
push eax
call dword [sym.imp.USER32.dll_mouse_event]
mov dword [0x432918], 0
xor eax, eax
jmp 0x42515d
mov ecx, dword [0x4328f8]
cmp dword [ecx + 4], 0x204
jne 0x424e17
mov edx, dword [0x4328f8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
push eax
mov ecx, dword [0x4328f8]
xor edx, edx
mov dx, word [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [0x4327f0], 0x8008
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x424dda
mov dword [0x4327f0], 0x8002
push 0
push 0
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
push ecx
mov edx, dword [0x4328f8]
xor eax, eax
mov ax, word [edx + 0xc]
push eax
mov ecx, dword [0x4327f0]
push ecx
call dword [sym.imp.USER32.dll_mouse_event]
xor eax, eax
jmp 0x42515d
mov edx, dword [0x4328f8]
cmp dword [edx + 4], 0x205
jne 0x424eb2
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
push ecx
mov edx, dword [0x4328f8]
xor eax, eax
mov ax, word [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [0x4327f0], 0x8010
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x424e75
mov dword [0x4327f0], 0x8004
push 0
push 0
mov ecx, dword [0x4328f8]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
push edx
mov eax, dword [0x4328f8]
xor ecx, ecx
mov cx, word [eax + 0xc]
push ecx
mov edx, dword [0x4327f0]
push edx
call dword [sym.imp.USER32.dll_mouse_event]
xor eax, eax
jmp 0x42515d
mov eax, dword [0x4328f8]
cmp dword [eax + 4], 0x203
jne 0x424edb
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x424ed9
mov ecx, dword [0x4328f8]
mov dword [ecx + 4], 0x206
jmp 0x424f02
mov edx, dword [0x4328f8]
cmp dword [edx + 4], 0x206
jne 0x424f02
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x424f02
mov eax, dword [0x4328f8]
mov dword [eax + 4], 0x203
mov ecx, dword [0x4328f8]
cmp dword [ecx + 4], 0x203
jne 0x425030
mov edx, dword [0x4328f8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
push eax
mov ecx, dword [0x4328f8]
xor edx, edx
mov dx, word [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0
push 0
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
push ecx
mov edx, dword [0x4328f8]
xor eax, eax
mov ax, word [edx + 0xc]
push eax
push 0x8002
call dword [sym.imp.USER32.dll_mouse_event]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
mov ecx, dword [0x4328f8]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
push edx
mov eax, dword [0x4328f8]
xor ecx, ecx
mov cx, word [eax + 0xc]
push ecx
push 0x8004
call dword [sym.imp.USER32.dll_mouse_event]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
mov edx, dword [0x4328f8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
push eax
mov ecx, dword [0x4328f8]
xor edx, edx
mov dx, word [ecx + 0xc]
push edx
push 0x8002
call dword [sym.imp.USER32.dll_mouse_event]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
push ecx
mov edx, dword [0x4328f8]
xor eax, eax
mov ax, word [edx + 0xc]
push eax
push 0x8004
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, 1
jmp 0x42515d
mov ecx, dword [0x4328f8]
cmp dword [ecx + 4], 0x206
jne 0x42515b
mov edx, dword [0x4328f8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
push eax
mov ecx, dword [0x4328f8]
xor edx, edx
mov dx, word [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0
push 0
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
push ecx
mov edx, dword [0x4328f8]
xor eax, eax
mov ax, word [edx + 0xc]
push eax
push 0x8008
call dword [sym.imp.USER32.dll_mouse_event]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
mov ecx, dword [0x4328f8]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
push edx
mov eax, dword [0x4328f8]
xor ecx, ecx
mov cx, word [eax + 0xc]
push ecx
push 0x8010
call dword [sym.imp.USER32.dll_mouse_event]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
mov edx, dword [0x4328f8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
push eax
mov ecx, dword [0x4328f8]
xor edx, edx
mov dx, word [ecx + 0xc]
push edx
push 0x8008
call dword [sym.imp.USER32.dll_mouse_event]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
mov eax, dword [0x4328f8]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
push ecx
mov edx, dword [0x4328f8]
xor eax, eax
mov ax, word [edx + 0xc]
push eax
push 0x8010
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, 1
jmp 0x42515d
xor eax, eax
pop ebp
ret