Function at 0x42e55c
Capabilities:
Log keystrokes

Disassembly:
push 0x18c
mov eax, 0x50e01b
call fcn.004f41e2
mov edi, ecx
mov dword [ebp - 0x178], edi
mov eax, dword [edi + 0xcc]
mov ecx, 0x1800
xor esi, esi
xor ebx, ebx
mov ax, word [eax + 0x3ebc]
and ax, cx
movzx ecx, ax
mov dword [ebp - 0x188], ecx
lea ecx, [ebp - 0x198]
movzx eax, ax
mov dword [ebp - 0x180], eax
call fcn.004d840a
mov ecx, dword [edi + 0xcc]
lea eax, [ebp - 0x198]
and dword [ebp - 4], ebx
push ebx
push eax
call fcn.0040ef51
test eax, eax
js 0x42e5d0
mov ecx, dword [ebp - 0x194]
call fcn.004de78b
mov ebx, eax
test ebx, ebx
jne 0x42e5eb
mov eax, dword [edi + 0xcc]
mov ecx, 0xe3ff
and word [eax + 0x3ebc], cx
jmp 0x42e8f1
mov ecx, ebx
call fcn.0049635b
mov ecx, dword [edi + 0xcc]
mov dword [ebp - 0x17c], eax
xor eax, eax
inc eax
push 0
push eax
lea eax, [ebp - 0x174]
push eax
mov eax, 0x1400
test word [ecx + 0x3ebc], ax
setne cl
movzx eax, cl
mov ecx, ebx
push eax
call fcn.00487fb8
test al, al
je 0x42e8f1
mov edx, dword [edi + 0xcc]
xor eax, eax
inc eax
mov dword [ebp - 0x154], pe_nt_image_headers32
mov word [ebp - 0x164], ax
xor eax, eax
mov word [ebp - 0x15a], ax
mov eax, 0x400
mov dword [ebp - 0x184], edx
test word [edx + 0x3ebc], ax
je 0x42e79c
mov ecx, dword [ebp - 0x17c]
mov di, word [ebp + 8]
add ecx, 0xfffffff3
movsx eax, di
cmp eax, ecx
jl 0x42e6a1
movzx eax, word [edx + 0x3ec6]
mov edx, dword [ebp - 0x17c]
add edx, 0xfffffff4
movsx ecx, ax
cmp edx, ecx
movzx edi, dx
mov edx, dword [ebp - 0x184]
cmovl edi, eax
mov word [ebp + 8], di
mov ecx, dword [ebp - 0x178]
mov ax, word [ebp + 0xa]
mov word [edx + 0x3ec8], ax
mov ecx, dword [ecx + 0xcc]
movzx eax, word [ecx + 0x3ec6]
cmp di, ax
jge 0x42e778
push 0x25
pop eax
mov word [ebp - 0x15a], ax
movsx esi, word [ecx + 0x3ec6]
movsx eax, di
push str.CtrlLeft
sub esi, eax
mov word [ecx + 0x3ec6], di
push 0x20
lea eax, [ebp - 0x50]
push eax
call fcn.00401a0b
mov edi, dword [ebp - 0x178]
mov cx, word [ebp - 0x15a]
test cx, cx
je 0x42e8f1
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10fff], 2
jne 0x42e898
xor eax, eax
mov ecx, ebx
inc eax
push eax
call fcn.0049715d
test al, al
je 0x42e8f1
mov ecx, dword [edi + 0xcc]
mov eax, dword [ebp + 8]
push 0x40
mov dword [ecx + 0x3ec6], eax
mov ecx, ebx
pop eax
mov word [ebp - 0x150], ax
call fcn.00489780
test al, al
je 0x42e85a
xor eax, eax
inc eax
cmp esi, eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x14e]
jle 0x42e848
push esi
push str.for_RCounter__i_1__1_do_Keys___s___end
jmp 0x42e871
jle 0x42e6f5
push 0x27
pop eax
mov word [ebp - 0x15a], ax
movsx eax, word [ecx + 0x3ec6]
movsx esi, di
push str.CtrlRight
jmp 0x42e6e1
mov ax, word [ebp + 8]
mov cx, word [ebp + 0xa]
mov word [edx + 0x3ec6], ax
mov edx, dword [edi + 0xcc]
movzx eax, word [edx + 0x3ec8]
cmp cx, ax
jge 0x42e7e6
push 0x26
pop eax
mov word [ebp - 0x15a], ax
movsx esi, word [edx + 0x3ec8]
movsx eax, cx
sub esi, eax
mov word [edx + 0x3ec8], cx
mov eax, str.CtrlShiftUp
mov ecx, str.CtrlUp
jmp 0x42e80f
jle 0x42e82a
push 0x28
pop eax
mov word [ebp - 0x15a], ax
movsx eax, word [edx + 0x3ec8]
movsx esi, cx
sub esi, eax
mov word [edx + 0x3ec8], cx
mov eax, str.CtrlShiftDown
mov ecx, str.CtrlDown
mov edx, 0x1800
cmp word [ebp - 0x180], dx
cmove eax, ecx
push eax
push 0x20
lea eax, [ebp - 0x50]
push eax
call fcn.00401a0b
mov eax, 0x1800
cmp word [ebp - 0x188], ax
je 0x42e6fb
or dword [ebp - 0x154], 0x10
jmp 0x42e6fb
push str.Keys___s__
push 0x7f
push eax
call fcn.004e22e7
add esp, 0x10
jmp 0x42e886
xor eax, eax
inc eax
cmp esi, eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x14e]
jle 0x42e87e
push esi
push str._Rep___i___s__End
push 0x7f
push eax
call fcn.004e22e7
add esp, 0x14
jmp 0x42e886
push 0x7f
push eax
call fcn.00401a0b
push 0
lea eax, [ebp - 0x150]
mov ecx, ebx
push eax
call fcn.0048db88
jmp 0x42e8f1
xor edi, edi
movzx eax, cx
push edi
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [ebp - 0x15c], si
mov ecx, ebx
mov word [ebp - 0x158], ax
xor esi, esi
push edi
lea eax, [ebp - 0x164]
inc esi
push eax
mov dword [ebp - 0x160], esi
call fcn.0048d312
push edi
lea eax, [ebp - 0x164]
mov dword [ebp - 0x160], edi
push eax
mov ecx, ebx
mov word [ebp - 0x15c], si
mov dword [ebp - 0x154], 0x120
call fcn.0048d312
lea ecx, [ebp - 0x198]
call fcn.004d84a5
call fcn.004f418c
ret 4