Function at 0x420b70
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x447ccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc24
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
push ebp
push 9
mov eax, dword [edi + 0x2d0]
push 0x110a
push eax
call dword [sym.imp.user32.dll_SendMessageA]
call fcn.004191e0
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x20], esi
je 0x420ed3
jmp 0x420bc3
mov esi, dword [esp + 0x20]
xor ebp, ebp
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
cmp dword [0x467f1c], eax
je 0x420e4c
lea ecx, [esp + 0x10]
lea ebx, [edi + 0x2b4]
push esi
push ecx
mov ecx, ebx
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x24], ebp
call fcn.0043d948
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0xc40], ebp
call fcn.00442af3
mov ebp, eax
push str.rva:
push ebp
call fcn.00433f20
push str.ptr:
push ebp
mov esi, eax
call fcn.00433f20
add esp, 0x10
mov ebp, eax
test esi, esi
je 0x420e1a
mov al, byte [edi + 0x1176]
test al, al
je 0x420c40
mov al, byte [edi + 0x1177]
test al, al
jne 0x420c50
test ebp, ebp
jne 0x420c50
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x420d13
mov al, byte [esi + 0xc]
add esi, 4
cmp al, 0x20
je 0x420c66
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x420d13
lea edx, [esp + 0x14]
mov byte [esi + 8], 0
push edx
push 0x460f14
push esi
call fcn.00433af2
mov eax, dword [esp + 0x20]
add esp, 0xc
lea ecx, [edi + 0x3ac]
push eax
call fcn.00415350
test al, al
mov byte [esp + 0x30], al
jne 0x420d02
mov al, byte [edi + 0x1176]
test al, al
je 0x420d02
test ebp, ebp
jne 0x420d02
mov ecx, dword [0x467f1c]
push ecx
push ebp
push 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x420e66
mov ecx, dword [edi + 0x3e8]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push 4
add ecx, edx
push eax
push ecx
push esi
call fcn.00429130
add esp, 0x14
test eax, eax
je 0x420cf6
cmp dword [esp + 0x28], 4
jne 0x420cf6
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x420d40
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x420e1a
mov al, byte [ebp + 0xc]
add ebp, 4
test al, al
je 0x420d29
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x462c28
call fcn.004429fd
mov ecx, edi
call fcn.0041d3e0
jmp 0x420e1a
lea edx, [esp + 0x24]
mov byte [ebp + 8], 0
push edx
push 0x460f14
push ebp
call fcn.00433af2
add esp, 0xc
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x438]
push ecx
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x44]
push 0x400
push ecx
mov ecx, dword [esp + 0xc5c]
push edx
push eax
push ecx
mov ecx, edi
call fcn.004275b0
test eax, eax
je 0x420e02
mov eax, dword [esp + 0x1c]
push 1
lea edx, [esp + 0x38]
push 1
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x440]
push eax
push ecx
push edx
mov ecx, edi
call fcn.004250d0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x438]
push ecx
push edx
push eax
lea ecx, [esp + 0x844]
push str.rva:_08X_mod:_s_ord:_04X_name:_s
push ecx
call fcn.0043367e
mov edx, dword [esp + 0x2c]
add esp, 0x18
lea ecx, [edi + 0x3ac]
push edx
call fcn.00413990
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x844]
push 0
push ecx
push 1
push eax
mov ecx, ebx
call fcn.0043da20
mov esi, dword [sym.imp.user32.dll_GetAsyncKeyState]
push 0x11
call esi
test ax, ax
jge 0x420e1a
push 0x7b
call esi
test ax, ax
jl 0x420e94
lea ecx, [esp + 0x10]
mov dword [esp + 0xc3c], 0xffffffff
call fcn.004429d3
mov edx, dword [esp + 0x20]
push edx
call fcn.00419240
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x420bbd
jmp 0x420ed3
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x462c3c
call fcn.004429fd
mov ecx, edi
call fcn.0041d3e0
jmp 0x420eda
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x461740
call fcn.004429fd
mov ecx, edi
call fcn.0041d3e0
lea ecx, [esp + 0x10]
mov dword [esp + 0xc3c], 0xffffffff
call fcn.004429d3
jmp 0x420eda
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x462c0c
call fcn.004429fd
mov ecx, edi
call fcn.0041d3e0
push 0
push str._CONTROLF12_
push 0x462bd4
mov ecx, edi
call fcn.00440edf
lea ecx, [esp + 0x10]
mov dword [esp + 0xc3c], 0xffffffff
call fcn.004429d3
mov ecx, edi
call fcn.00425e20
mov ecx, dword [esp + 0xc34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc30
ret 4