Function at 0x442840
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x598f01
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x170], ebx
cmp esi, 0x200
ja 0x442d26
je 0x442cfc
lea eax, [esi - 5]
cmp eax, 0x82
ja case.0x4428b4.6
movzx eax, byte [eax + 0x442f24]
jmp dword [eax*4 + 0x442f0c]
mov dword [ecx], 1
mov al, 1
jmp 0x442e52
push 1
push 0
mov ecx, edx
call fcn.00476f90
jmp case.0x4428b4.6
lea eax, [ebp - 0x17c]
mov ecx, edi
push eax
call fcn.00441e60
push eax
mov ecx, edi
call fcn.004416b0
test eax, eax
je case.0x4428b4.6
mov eax, dword fs:[0x2c]
mov ecx, dword [0x61a9fc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6174b8]
cmp eax, dword [ecx + 4]
jg 0x442e70
push dword [0x6174b4]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x164]
mov dword [eax], 1
mov al, 1
jmp 0x442e52
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je case.0x4428b4.6
cmp dword [ecx + 4], 0x100
jne case.0x4428b4.6
mov esi, dword [edi + 0x1c]
mov eax, dword [edi + 0x20]
cmp esi, eax
je 0x44296b
cmp byte [esi + 0x28], bl
jne 0x442963
add esi, 0x3c
cmp esi, eax
jne 0x442957
cmp esi, eax
jne 0x442b3e
cmp byte [edi + 0x10], bl
je case.0x4428b4.6
cmp byte [edi + 0x54], bl
je case.0x4428b4.6
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns case.0x4428b4.6
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 8]
cmp eax, 0x41
je 0x442e3c
cmp eax, 0x43
jne case.0x4428b4.6
cmp byte [edi + 0x3d], bl
je case.0x4428b4.6
xor eax, eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov esi, dword [edi + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x164], eax
cmp esi, dword [edi + 0x20]
je 0x442b30
xor eax, eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
mov edx, dword [esi + 0x30]
mov byte [ebp - 4], 1
cmp edx, 0xffffffff
je 0x442ad7
mov ecx, dword [esi + 0x34]
cmp ecx, 0xffffffff
je 0x442ad7
cmp edx, ecx
jg 0x442eae
test bl, 1
je 0x442a16
and ebx, 0xfffffffe
mov dword [ebp - method.plat::Exception.virtual_0], vtable.plat::Exception.0
mov eax, dword [esi + 4]
sub ecx, edx
push 1
inc ecx
push ecx
lea eax, [eax + edx*2]
push 0xfde9
push eax
lea ecx, [ebp - 0x188]
call fcn.0046c430
push 0xffffffffffffffff
push dword [ebp - 0x184]
lea ecx, [ebp - 0x17c]
call fcn.004491e0
cmp byte [ebp - 0x180], 0
mov eax, dword [ebp - 0x184]
mov byte [ebp - 4], 2
je 0x442a72
test eax, eax
je 0x442a72
push dword [ebp - 0x188]
push eax
call fcn.0045fa10
mov eax, dword [ebp - 0x184]
add esp, 8
push eax
call fcn.0054454b
add esp, 4
mov dword [ebp - 0x188], 0
cmp dword [ebp - 0x174], 0
mov dword [ebp - 0x184], 0
je 0x442ab5
mov eax, dword [ebp - 0x164]
cmp dword [esi + 0x2c], eax
je 0x442ab5
push 0xffffffffffffffff
push 0x5b5cb0
lea ecx, [ebp - 0x174]
call fcn.004491e0
mov eax, dword [esi + 0x2c]
lea ecx, [ebp - 0x174]
push 0xffffffffffffffff
push dword [ebp - 0x17c]
mov dword [ebp - 0x164], eax
call fcn.004491e0
mov eax, dword [ebp - 0x17c]
push eax
mov byte [ebp - 4], 0
call fcn.0054454b
add esi, 0x3c
add esp, 4
cmp esi, dword [edi + 0x20]
jne 0x4429d2
mov eax, dword [ebp - 0x174]
test eax, eax
je 0x442b30
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x165]
push dword [eax + 4]
call fcn.0043c110
push dword [ebp - 0x174]
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0043c510
lea ecx, [ebp - 0x165]
call fcn.0043c2b0
mov eax, dword [ebp - 0x174]
push eax
call fcn.0054454b
add esp, 4
jmp case.0x4428b4.6
mov ecx, dword [ecx + 8]
xor bl, bl
lea eax, [ecx - 9]
cmp eax, 0xec
ja case.0x4428b4.6
movzx eax, byte [eax + 0x442fb8]
jmp dword [eax*4 + 0x442fa8]
mov ecx, dword [edi + 8]
test ecx, ecx
je case.0x4428b4.6
mov eax, dword [ecx]
push dword [esi + 0xc]
call dword [eax + 4]
mov eax, dword [ebp - 0x164]
mov dword [eax], 4
mov al, 1
jmp 0x442e52
mov bl, 1
cmp byte [edi + 0x10], 0
je 0x442ba4
cmp byte [edi + 0x54], 0
je 0x442ba4
mov ecx, edi
mov byte [edi + 0x54], 0
call fcn.00442570
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 8]
cmp ecx, 9
jne 0x442bba
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
shr ebx, 0xf
and bl, 1
mov ecx, dword [edi + 0x20]
cmp esi, ecx
je 0x442bd8
mov eax, dword [ebp - 0x16c]
mov ecx, esi
mov byte [esi + 0x28], 0
push dword [eax + 4]
call fcn.00440e80
mov ecx, dword [edi + 0x20]
test bl, bl
je 0x442c00
mov eax, dword [edi + 0x1c]
mov edx, esi
mov esi, ecx
cmp eax, edx
je 0x442c0d
cmp dword [eax + 0xc], 0
mov esi, eax
cmove esi, ecx
add eax, 0x3c
mov ecx, esi
cmp eax, edx
jne 0x442be7
jmp 0x442c0d
add esi, 0x3c
cmp esi, ecx
je 0x442c0d
cmp dword [esi + 0xc], 0
je 0x442c00
cmp esi, dword [edi + 0x20]
je case.0x4428b4.6
push esi
mov ecx, edi
call fcn.00441140
mov eax, dword [ebp - 0x164]
mov dword [eax], 4
mov al, 1
jmp 0x442e52
mov ecx, edi
call fcn.00441d40
cmp esi, 7
jne 0x4428c1
mov esi, dword [ebp - 0x16c]
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetAncestor]
push dword [esi + 4]
mov ebx, eax
mov dword [ebp - 0x164], ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4428c1
push 1
push dword [esi + 4]
mov esi, dword [sym.imp.USER32.dll_GetNextDlgTabItem]
push ebx
call esi
mov ebx, dword [ebp + 0x14]
cmp ebx, eax
jne 0x442c9f
mov eax, dword [edi + 0x1c]
mov edx, dword [edi + 0x20]
cmp eax, edx
je 0x4428c1
nop
cmp dword [eax + 0xc], 0
jne 0x442ce5
add eax, 0x3c
cmp eax, edx
jne 0x442c90
jmp 0x442ce5
mov eax, dword [ebp - 0x16c]
push 0
push dword [eax + 4]
push dword [ebp - 0x164]
call esi
cmp ebx, eax
jne case.0x4428b4.6
mov eax, dword [edi + 0x20]
mov edx, eax
mov ecx, dword [edi + 0x1c]
cmp ecx, eax
je 0x442ce5
mov esi, eax
nop dword [eax + eax]
cmp dword [ecx + 0xc], 0
mov eax, ecx
cmove eax, edx
add ecx, 0x3c
mov edx, eax
cmp ecx, esi
jne 0x442cd0
mov edx, dword [edi + 0x20]
cmp eax, edx
je 0x4428c1
push eax
mov ecx, edi
call fcn.00441140
mov al, 1
jmp 0x442e52
cmp byte [edi + 0x10], bl
je case.0x4428b4.6
cmp byte [edi + 0x3c], bl
je case.0x4428b4.6
mov eax, dword [ebp + 0x18]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
push ecx
mov ecx, edi
call fcn.004426d0
jmp case.0x4428b4.6
cmp esi, 0x203
ja 0x442e45
je 0x442e37
sub esi, 0x201
je 0x442d9d
sub esi, 1
jne case.0x4428b4.6
cmp byte [edi + 0x10], bl
je 0x442d60
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [edi + 0x50]
mov byte [edi + 0x3c], bl
call dword [sym.imp.USER32.dll_SetCursor]
cmp byte [edi + 0x3d], bl
jne case.0x4428b4.6
lea eax, [ebp - 0x17c]
mov ecx, edi
push eax
call fcn.00441e60
push eax
mov ecx, edi
call fcn.004416b0
mov ecx, dword [edi + 8]
test ecx, ecx
je case.0x4428b4.6
test eax, eax
je case.0x4428b4.6
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp case.0x4428b4.6
cmp byte [edi + 0x10], bl
je case.0x4428b4.6
mov ecx, edi
call fcn.00441d40
cmp byte [edi + 0x54], bl
jne 0x442dce
mov ebx, dword [ebp - 0x16c]
mov esi, dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
je 0x442dce
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x54], 1
mov eax, 0x88888889
mov ecx, dword [edi + 0x20]
sub ecx, dword [edi + 0x1c]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je case.0x4428b4.6
mov eax, dword [ebp + 0x18]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
push ecx
mov ecx, edi
call fcn.004426d0
cmp byte [edi + 0x3c], 0
je case.0x4428b4.6
mov eax, dword fs:[0x2c]
mov ecx, dword [0x61a9fc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6174c0]
cmp eax, dword [ecx + 4]
jg 0x442ecb
push dword [0x6174bc]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [edi + 0x50], eax
jmp case.0x4428b4.6
cmp byte [edi + 0x10], bl
je case.0x4428b4.6
mov ecx, edi
call fcn.004425c0
jmp case.0x4428b4.6
cmp esi, 0x31a
jne case.0x4428b4.6
mov byte [edi + 0x11], bl
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 0x18
push 0x6174b8
call fcn.00544b4e
add esp, 4
cmp dword [0x6174b8], 0xffffffff
jne 0x442916
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6174b8
mov dword [0x6174b4], eax
call fcn.00544b04
add esp, 4
jmp 0x442916
push 0x7b
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.6.xlabelcon_windows_64_rvcoreuilibsuiwinmarkuptextwin.cxx
push str.selStartIdx___selEndIdx
lea ecx, [ebp - 0x160]
call fcn.00465850
push eax
call fcn.004658d0
push 0x6174c0
call fcn.00544b4e
add esp, 4
cmp dword [0x6174c0], 0xffffffff
jne 0x442e26
push 0x7f01
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6174c0
mov dword [0x6174bc], eax
call fcn.00544b04
add esp, 4
jmp 0x442e26