Function at 0x406420
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x2004
call fcn.00424bd0
mov eax, dword [0x45cefc]
xor eax, esp
mov dword [esp + 0x2000], eax
cmp dword [0x471aa0], 0
push edi
mov edi, ecx
jne 0x40675e
lea eax, [edi - 1]
cmp eax, 0x63
push esi
ja case.0x40645c.4
movzx eax, byte [eax + 0x4067d8]
jmp dword [eax*4 + 0x406774]
push ebx
call fcn.00405da0
add esp, 4
pop esi
pop edi
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.00423893
add esp, 0x2004
ret
mov ecx, dword [0x471a9c]
push 0x10
push ecx
mov eax, str.OUTOFMEMORY
call fcn.00407540
push eax
jmp 0x406756
cmp dword [0x471ac0], 0
mov eax, str.PASSWORD_OR_KEYFILE_WRONG
jne 0x4064af
mov eax, str.PASSWORD_WRONG
call fcn.00407540
push eax
lea edx, [esp + 0xc]
push edx
call fcn.00425d07
add esp, 8
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x406510
mov eax, str.PASSWORD_WRONG_CAPSLOCK_ON
call fcn.00407540
mov edx, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4064e0
lea edi, [esp + 8]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4064f4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x30
jmp 0x40674b
mov edx, dword [0x471a9c]
push 0x10
push edx
mov eax, str.NOT_FOUND
call fcn.00407540
push eax
jmp 0x406756
mov eax, dword [0x471a9c]
push 0x10
push eax
mov eax, str.OPENFILES_DRIVER
call fcn.00407540
push eax
jmp 0x406756
mov ecx, dword [0x471a9c]
push 0x10
push ecx
mov eax, str.OPENFILES_LOCK
call fcn.00407540
push eax
jmp 0x406756
mov edx, dword [0x471a9c]
push 0x10
push edx
mov eax, str.VOL_SIZE_WRONG
call fcn.00407540
push eax
jmp 0x406756
mov eax, dword [0x471a9c]
push 0x10
push eax
mov eax, str.COMPRESSION_NOT_SUPPORTED
call fcn.00407540
push eax
jmp 0x406756
mov ecx, dword [0x471a9c]
push 0x10
push ecx
mov eax, str.WRONG_VOL_TYPE
call fcn.00407540
push eax
jmp 0x406756
mov edx, dword [0x471a9c]
push 0x10
push edx
mov eax, str.VOL_SEEKING
call fcn.00407540
push eax
jmp 0x406756
mov eax, dword [0x471a9c]
push 0x10
push eax
mov eax, str.VOL_WRITING
call fcn.00407540
push eax
jmp 0x406756
mov ecx, dword [0x471a9c]
push 0x10
push ecx
mov eax, str.VOL_READING
call fcn.00407540
push eax
jmp 0x406756
mov edx, dword [0x471a9c]
push 0x10
push edx
mov eax, str.ERR_CIPHER_INIT_FAILURE
call fcn.00407540
push eax
jmp 0x406756
mov eax, dword [0x471a9c]
push 0x10
push eax
mov eax, str.ERR_CIPHER_INIT_WEAK_KEY
call fcn.00407540
push eax
jmp 0x406756
mov ecx, dword [0x471a9c]
push 0x10
push ecx
mov eax, str.VOL_ALREADY_MOUNTED
call fcn.00407540
push eax
jmp 0x406756
mov edx, dword [0x471a9c]
push 0x10
push edx
mov eax, str.FILE_OPEN_FAILED
call fcn.00407540
push eax
jmp 0x406756
mov eax, dword [0x471a9c]
push 0x10
push eax
mov eax, str.VOL_MOUNT_FAILED
call fcn.00407540
push eax
jmp 0x406756
mov ecx, dword [0x471a9c]
push 0x10
push ecx
mov eax, str.NO_FREE_DRIVES
call fcn.00407540
push eax
jmp 0x406756
mov edx, dword [0x471a9c]
push 0x10
push edx
mov eax, str.INVALID_DEVICE
call fcn.00407540
push eax
jmp 0x406756
mov eax, dword [0x471a9c]
push 0x10
push eax
mov eax, str.ACCESS_DENIED
call fcn.00407540
push eax
jmp 0x406756
push str.4.3a
mov eax, str.DRIVER_VERSION
call fcn.00407540
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [0x471a9c]
add esp, 0xc
push 0x10
push edx
lea eax, [esp + 0x10]
push eax
jmp 0x406756
mov ecx, dword [0x471a9c]
push 0x10
push ecx
mov eax, str.NEW_VERSION_REQUIRED
call fcn.00407540
push eax
jmp 0x406756
push str.ERR_SELF_TESTS_FAILED
call fcn.00407460
add esp, 4
pop esi
pop edi
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.00423893
add esp, 0x2004
ret
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push str.ERR_UNKNOWN
push str.____hs___
push 0x474260
call esi
push edi
lea edx, [esp + 0x18]
push 0x474260
push edx
call esi
add esp, 0x18
push 0x10
mov eax, dword [0x471a9c]
push eax
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
mov ecx, dword [esp + 0x2004]
pop edi
xor ecx, esp
call fcn.00423893
add esp, 0x2004
ret