Function at 0x4212f2
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
push 1
push 0
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x464c98]
push 0x458f24
call fcn.0040152b
push dword [ebp + 0x24]
mov ecx, edi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.0043a0d7
test eax, eax
mov dword [ebp + 0x18], eax
jne 0x421331
inc eax
jmp 0x421769
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
push ebx
mov ebx, 0x80000000
push esi
mov dword [ebp - 4], 2
mov byte [ebp + 0x27], 0
mov byte [ebp + 0x23], 1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov edi, eax
je 0x4213ee
lea esi, [eax + 1]
movsx eax, byte [edi]
push eax
call fcn.004418c7
sub eax, 0x44
pop ecx
je 0x4213d9
sub eax, 0xa
je 0x4213c2
dec eax
dec eax
je 0x4213a4
sub eax, 5
je 0x42139b
sub eax, 3
je 0x42138f
dec eax
jne 0x4213dd
push esi
call fcn.0040198e
pop ecx
mov dword [ebp - 8], eax
jmp 0x4213dd
push esi
call fcn.0040198e
pop ecx
mov dword [ebp - 0xc], eax
jmp 0x4213dd
mov dword [ebp - 4], 1
jmp 0x4213dd
push 3
push 0x45c324
push edi
call fcn.0044147c
add esp, 0xc
test eax, eax
jne 0x4213dd
inc edi
inc edi
inc esi
inc esi
mov byte [ebp + 0x27], 1
jmp 0x4213dd
movsx eax, byte [esi]
push eax
call fcn.004418c7
cmp eax, 0x41
pop ecx
jne 0x4213dd
inc edi
inc esi
mov byte [ebp + 0x23], 0
jmp 0x4213dd
and dword [ebp - 4], 0
inc edi
inc esi
cmp byte [edi], 0
jne 0x42135e
cmp byte [ebp + 0x27], 0
jne 0x421406
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.0043a1b8
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x1c], eax
jne 0x4214e7
and dword [ebp - 0x54], 0
push 9
pop ecx
push dword [ebp + 0x14]
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
call fcn.00401aa2
mov edi, eax
movsx eax, byte [edi]
push eax
call fcn.004418c7
cmp eax, 0x58
pop ecx
pop ecx
jne 0x421578
inc edi
cmp byte [edi], 0
je 0x421578
push edi
call fcn.00401993
mov dword [esp], 0x458bf0
push edi
mov dword [ebp - 0x54], eax
call fcn.00438acb
test eax, eax
pop ecx
pop ecx
je 0x421578
inc eax
push eax
call fcn.00401aa2
mov esi, eax
mov al, byte [esi]
test al, al
pop ecx
je 0x421578
movsx eax, al
push eax
call fcn.004418c7
cmp eax, 0x59
pop ecx
jne 0x421578
inc esi
cmp byte [esi], 0
je 0x421578
push esi
call fcn.00401993
mov esi, dword [ebp + 0x18]
pop ecx
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x50], eax
lea eax, [ebp - 0x54]
push eax
push 0x43a302
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [ebp - 0x3c]
test eax, eax
mov dword [ebp + 0x1c], eax
jne 0x4214ce
mov dword [ebp + 0x1c], esi
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [ebp + 0xc]
xor edi, edi
inc edi
cmp esi, edi
jl 0x421752
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
je 0x421503
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x421540
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x421571
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
jne 0x42152b
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x421540
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
movzx ebx, ax
movzx eax, cx
shl ebx, 0x10
or ebx, eax
mov al, byte [ebp + 8]
cmp al, 0x9f
je 0x421580
cmp al, 0x9e
je 0x421580
movzx eax, al
dec eax
mov byte [ebp + 0xb], 0
je 0x4215fc
dec eax
je 0x4215e5
dec eax
dec eax
je 0x4215ce
dec eax
je 0x4215b7
dec eax
je 0x4215a0
mov eax, edi
jmp 0x421767
xor eax, eax
inc eax
jmp 0x421767
xor ecx, ecx
cmp al, 0x9f
setne cl
mov byte [ebp + 0xb], 1
dec ecx
and ecx, 0xf0
add ecx, 0xffffff88
imul ecx, esi
shl ecx, 0x10
mov dword [ebp + 0x24], ecx
jmp 0x42160d
mov dword [ebp + 0x10], 0x20b
mov dword [ebp + 0xc], 0x20c
mov dword [ebp + 0x24], 0x40
jmp 0x42160d
mov dword [ebp + 0x10], 0x20b
mov dword [ebp + 0xc], 0x20c
mov dword [ebp + 0x24], 0x20
jmp 0x42160d
mov dword [ebp + 0x10], 0x207
mov dword [ebp + 0xc], 0x208
mov dword [ebp + 0x24], 0x10
jmp 0x42160d
mov dword [ebp + 0x10], 0x204
mov dword [ebp + 0xc], 0x205
mov dword [ebp + 0x24], 2
jmp 0x42160d
mov dword [ebp + 0x10], 0x201
mov dword [ebp + 0xc], 0x202
mov dword [ebp + 0x24], edi
cmp byte [ebp + 0x23], 0
mov byte [ebp + 0x17], 0
je 0x42165d
push 0
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
mov dword [ebp + 0x20], eax
je 0x421654
cmp eax, dword [0x464dbc]
je 0x421654
push dword [ebp + 0x18]
call fcn.0043b0bc
test al, al
pop ecx
jne 0x421654
push edi
push dword [ebp + 0x20]
push dword [0x464dbc]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [ebp + 0x17]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
cmp byte [ebp + 0xb], 0
je 0x4216ab
push ebx
push dword [ebp + 0x24]
push 0x20a
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x464290]
cmp eax, 0xffffffff
jle 0x42173b
cmp eax, 0x19
jge 0x42169d
cmp byte [0x4654b9], 0
je 0x42169d
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x42173b
push edi
push eax
call fcn.0040be3b
pop ecx
pop ecx
jmp 0x42173b
test esi, esi
jle 0x42173b
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp + 8], esi
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [ebp - 4], 1
je 0x4216fb
push ebx
push dword [ebp + 0x24]
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
call esi
mov eax, dword [0x464290]
cmp eax, 0xffffffff
jle 0x4216fb
cmp eax, 0x19
jge 0x4216f1
cmp byte [0x4654b9], 0
je 0x4216f1
push eax
call edi
jmp 0x4216fb
push 1
push eax
call fcn.0040be3b
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x421733
push ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
call esi
mov eax, dword [0x464290]
cmp eax, 0xffffffff
jle 0x421733
cmp eax, 0x19
jge 0x421729
cmp byte [0x4654b9], 0
je 0x421729
push eax
call edi
jmp 0x421733
push 1
push eax
call fcn.0040be3b
pop ecx
pop ecx
dec dword [ebp + 8]
jne 0x4216c2
xor edi, edi
inc edi
cmp byte [ebp + 0x17], 0
je 0x421752
push 0
push dword [ebp + 0x20]
push dword [0x464dbc]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [0x464c98]
push edi
push 0
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
pop esi
pop ebx
pop edi
leave
ret 0x20