Function at 0x427d30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcc
mov eax, dword [0x577830]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0x8000
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov dword [esp + 0x10], edi
jb 0x427d8c
mov eax, dword [esi + 0x74]
test eax, eax
je 0x427d8c
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
cmp edi, dword [esi + 0x6c]
jne 0x427dae
cmp ebx, 6
jne 0x427dae
cmp byte [esi + 0x3e], 0
je 0x427dae
cmp dword [ebp + 0xc], 0
jne 0x427da6
push 0
jmp 0x427da8
push 1
push esi
call fcn.00427340
mov eax, dword [esi + 0x80]
test eax, eax
je case.0x427f53.515
mov eax, dword [eax + 0x6c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je case.0x427f53.515
cmp ebx, 0x200
ja 0x427f41
je case.0x427f53.513
lea eax, [ebx - 6]
cmp eax, 0x9a
ja case.0x427f53.515
movzx edx, byte [eax + 0x428610]
jmp dword [edx*4 + 0x4285f8]
mov ecx, esi
call fcn.004268a0
cmp dword [0x59b4dc], 0
mov esi, eax
jne 0x427e3b
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp esi, eax
je 0x427e3b
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x14
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 3
mov dword [esp + 0x20], 1
mov dword [esp + 0x28], 0x64
call dword [sym.imp.USER32.dll_FlashWindowEx]
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
cmp ax, 1
je 0x427eb3
cmp ax, 2
jne case.0x427f53.515
mov ecx, esi
call fcn.004268a0
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
call fcn.00429b00
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
movzx ecx, byte [0x59b4dc]
push ecx
push esi
call fcn.00426d20
cmp ebx, 0x104
ja 0x4283e7
je case.0x4281e4.256
cmp ebx, 0x14
ja 0x4281cf
je 0x4281a9
lea eax, [ebx - 2]
cmp eax, 0x10
ja case.0x42849f.521
movzx eax, byte [eax + 0x4286c4]
jmp dword [eax*4 + 0x4286ac]
lea eax, [ebx - 0x201]
cmp eax, 7
ja case.0x427f53.515
movzx edx, byte [eax + 0x4286e0]
jmp dword [edx*4 + 0x4286d8]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
cmp byte [esi + 0x39], 0
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
je 0x427fa4
push 0x59b498
call ebx
cmp byte [esi + 0x39], 0
je 0x427fa4
cmp dword [0x59b498], 0
jne 0x427fa4
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov byte [0x59b496], 1
mov ecx, dword [esi + 0x6c]
xor edi, edi
push edi
push 0xffffffffffffffeb
push ecx
call dword [0x59e068]
cmp byte [esi + 0x3a], 0
je 0x427fd9
mov eax, dword [esi + 4]
cmp eax, edi
je 0x427fd6
push eax
call ebx
cmp eax, edi
jne 0x427fd9
mov edx, dword [esi + 4]
push edx
call fcn.0044d390
add esp, 4
mov dword [esi + 4], edi
mov dword [esi + 0x6c], edi
mov eax, dword [esi + 0x64]
cmp eax, edi
je 0x427ff0
lea ecx, [eax + 0x48]
mov dword [esi + 0x6c], edi
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov dword [esi + 0x64], edi
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esi + 0x64], 0
je case.0x42849f.521
mov ecx, dword [esi + 0x6c]
lea eax, [esp + 0x90]
push eax
push ecx
call dword [sym.imp.USER32.dll_BeginPaint]
test eax, eax
mov dword [esp + 0x10], eax
je 0x4280c2
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0xa0]
cmp eax, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0xa4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
jge 0x42808b
cmp dword [esp + 0x9c], edx
jge 0x42808b
mov ecx, dword [esi + 0x64]
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push edx
call eax
cmp byte [esi + 0x3a], 0
je 0x4280b0
mov eax, dword [esi + 0x34]
test eax, eax
je 0x4280b0
cmp byte [esi + 0x3d], 0
je 0x4280b0
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x6c]
push edi
push ecx
push ebx
push edx
push eax
call dword [0x59e070]
mov ecx, dword [esi + 0x6c]
lea eax, [esp + 0x90]
push eax
push ecx
call dword [sym.imp.USER32.dll_EndPaint]
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
xor eax, eax
cmp dword [esi + 0x64], eax
je 0x4285ba
cmp ebx, 0x201
mov ecx, dword [esi + 0x6c]
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], edx
mov dword [esp + 0x9c], edi
mov byte [esp + 0xa0], al
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
jne 0x42855f
cmp byte [0x59b495], al
jne 0x4284fa
xor cl, cl
mov byte [esp + 0xf], cl
xor al, al
jmp 0x42854c
mov eax, dword [esi + 0x70]
test eax, eax
je 0x428178
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
je 0x42818d
mov edx, edi
shr edx, 0x10
movzx eax, di
push edx
push eax
mov eax, esi
call fcn.004273f0
mov eax, 0xf4241
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
cmp byte [esi + 0x3b], 0
jne case.0x42849f.521
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebx - 0x19]
cmp eax, 0xe9
ja case.0x42849f.521
movzx ecx, byte [eax + 0x428700]
jmp dword [ecx*4 + 0x4286e8]
cmp dword [esi + 0x64], 0
je case.0x42849f.521
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ebx
push ecx
call dword [0x59e098]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x64]
mov edi, dword [edx]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x10]
push eax
push ecx
mov ecx, dword [esi + 0x6c]
push ebx
lea eax, [esp + 0x74]
call fcn.00426860
mov ecx, dword [esi + 0x64]
mov edx, dword [edi + 0x2c]
push eax
call edx
lea edi, [esp + 0x7c]
call fcn.00401070
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [esi + 0x74]
test esi, esi
je case.0x427f53.513
mov eax, dword [ebp + 0xc]
push edi
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
cmp byte [esi + 0x38], 2
jne case.0x42849f.521
cmp dword [ebp + 0xc], 1
jne case.0x42849f.521
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov eax, dword [edi + 8]
mov dword [edi + 0x10], ecx
mov ecx, dword [edi + 0xc]
mov dword [edi + 0x14], edx
mov edx, dword [edi]
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
mov dword [edi + 0x20], edx
mov edx, dword [edi + 0xc]
mov dword [edi + 0x1c], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
mov eax, 0x700
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x6c]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
xor eax, eax
cmp byte [0x59b495], al
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
mov byte [esp + 0x24], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
jne 0x42832a
xor bl, bl
mov byte [esp + 0xe], bl
xor al, al
jmp 0x428378
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
shr ebx, 0xf
and bl, 1
cmp byte [0x59b495], 0
jne 0x42834d
mov byte [esp + 0xe], 0
xor al, al
jmp 0x428378
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
cmp byte [0x59b495], 0
mov byte [esp + 0xe], al
jne 0x42836b
xor al, al
jmp 0x428378
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add bl, bl
or bl, byte [esp + 0xe]
lea ecx, [esp + 0x14]
add bl, bl
or bl, al
mov eax, dword [esi]
add bl, bl
cmp dword [ebp + 8], 0x102
push ecx
sete dl
or bl, dl
mov edx, dword [eax + 0x20]
mov ecx, esi
mov byte [esp + 0x28], bl
call edx
cmp eax, 0xf4240
lea edi, [esp + 0x28]
jne 0x4283ce
call fcn.00401070
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
call fcn.00401070
mov ebx, dword [ebp + 8]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x28], 0
jmp case.0x42849f.521
cmp ebx, 0x205
ja 0x428489
cmp ebx, 0x204
jae case.0x42849f.519
lea eax, [ebx - 0x110]
cmp eax, 0xf2
ja case.0x42849f.521
movzx eax, byte [eax + 0x4287f8]
jmp dword [eax*4 + 0x4287ec]
mov eax, dword [esi + 0x64]
test eax, eax
je case.0x42849f.521
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0xc]
mov edi, dword [eax]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push ebx
lea eax, [esp + 0x4c]
call fcn.00426860
mov ecx, dword [esi + 0x64]
push eax
mov eax, dword [edi + 0x2c]
call eax
lea edi, [esp + 0x54]
mov ebx, eax
call fcn.00401070
cmp ebx, 0xf4240
mov dword [esp + 0x54], 0
jne 0x42858d
mov esi, dword [esi + 0x64]
mov eax, dword [esi + 0x54]
mov dword [esi + 0x54], ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebx - 0x207]
cmp eax, 0xf
ja case.0x42849f.521
movzx ecx, byte [eax + 0x4288f8]
jmp dword [ecx*4 + 0x4288ec]
mov eax, dword [esi + 0x74]
test eax, eax
je case.0x42849f.521
mov edx, dword [ebp + 0xc]
push edi
push edx
push ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 0xf4240
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
push edi
call fcn.00427a20
movsx eax, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005120db
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
shr eax, 0xf
and al, 1
cmp byte [0x59b495], 0
mov byte [esp + 0xe], al
jne 0x428521
mov cl, al
mov byte [esp + 0xf], 0
xor al, al
jmp 0x42854c
push 0x11
call edi
shr eax, 0xf
and al, 1
cmp byte [0x59b495], 0
mov byte [esp + 0xf], al
jne 0x42853f
mov cl, byte [esp + 0xe]
xor al, al
jmp 0x42854c
push 0x10
call edi
mov cl, byte [esp + 0xe]
shr eax, 0xf
and al, 1
add cl, cl
or cl, byte [esp + 0xf]
add cl, cl
or cl, al
add cl, cl
mov byte [esp + 0xa0], cl
mov ecx, dword [esi + 0x64]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
lea edx, [esp + 0x90]
push edx
call eax
cmp eax, 0xf4240
lea edi, [esp + 0xa4]
jne 0x4285a6
mov esi, dword [esi + 0x64]
mov ebx, dword [esi + 0x54]
mov dword [esi + 0x54], eax
call fcn.00401070
invalid