Function at 0x421825
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
push 1
push 0
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x463c78]
push 0x457f24
call fcn.00401525
push dword [ebp + 0x24]
mov ecx, edi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.0043a4f2
test eax, eax
mov dword [ebp + 0x18], eax
jne 0x421864
inc eax
jmp 0x421c9c
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
push ebx
mov ebx, 0x80000000
push esi
mov dword [ebp - 4], 2
mov byte [ebp + 0x27], 0
mov byte [ebp + 0x23], 1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov edi, eax
je 0x421921
lea esi, [eax + 1]
movsx eax, byte [edi]
push eax
call fcn.00441cd7
sub eax, 0x44
pop ecx
je 0x42190c
sub eax, 0xa
je 0x4218f5
dec eax
dec eax
je 0x4218d7
sub eax, 5
je 0x4218ce
sub eax, 3
je 0x4218c2
dec eax
jne 0x421910
push esi
call fcn.00401988
pop ecx
mov dword [ebp - 8], eax
jmp 0x421910
push esi
call fcn.00401988
pop ecx
mov dword [ebp - 0xc], eax
jmp 0x421910
mov dword [ebp - 4], 1
jmp 0x421910
push 3
push 0x45b324
push edi
call fcn.0044188c
add esp, 0xc
test eax, eax
jne 0x421910
inc edi
inc edi
inc esi
inc esi
mov byte [ebp + 0x27], 1
jmp 0x421910
movsx eax, byte [esi]
push eax
call fcn.00441cd7
cmp eax, 0x41
pop ecx
jne 0x421910
inc edi
inc esi
mov byte [ebp + 0x23], 0
jmp 0x421910
and dword [ebp - 4], 0
inc edi
inc esi
cmp byte [edi], 0
jne 0x421891
cmp byte [ebp + 0x27], 0
jne 0x421939
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.0043a5d3
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x1c], eax
jne 0x421a1a
and dword [ebp - 0x54], 0
push 9
pop ecx
push dword [ebp + 0x14]
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
call fcn.00401a9c
mov edi, eax
movsx eax, byte [edi]
push eax
call fcn.00441cd7
cmp eax, 0x58
pop ecx
pop ecx
jne 0x421aab
inc edi
cmp byte [edi], 0
je 0x421aab
push edi
call fcn.0040198d
mov dword [esp], 0x457bf0
push edi
mov dword [ebp - 0x54], eax
call fcn.00438ef0
test eax, eax
pop ecx
pop ecx
je 0x421aab
inc eax
push eax
call fcn.00401a9c
mov esi, eax
mov al, byte [esi]
test al, al
pop ecx
je 0x421aab
movsx eax, al
push eax
call fcn.00441cd7
cmp eax, 0x59
pop ecx
jne 0x421aab
inc esi
cmp byte [esi], 0
je 0x421aab
push esi
call fcn.0040198d
mov esi, dword [ebp + 0x18]
pop ecx
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x50], eax
lea eax, [ebp - 0x54]
push eax
push 0x43a71d
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [ebp - 0x3c]
test eax, eax
mov dword [ebp + 0x1c], eax
jne 0x421a01
mov dword [ebp + 0x1c], esi
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [ebp + 0xc]
xor edi, edi
inc edi
cmp esi, edi
jl 0x421c85
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
je 0x421a36
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x421a73
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x421aa4
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
jne 0x421a5e
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x421a73
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
movzx ebx, ax
movzx eax, cx
shl ebx, 0x10
or ebx, eax
mov al, byte [ebp + 8]
cmp al, 0x9f
je 0x421ab3
cmp al, 0x9e
je 0x421ab3
movzx eax, al
dec eax
mov byte [ebp + 0xb], 0
je 0x421b2f
dec eax
je 0x421b18
dec eax
dec eax
je 0x421b01
dec eax
je 0x421aea
dec eax
je 0x421ad3
mov eax, edi
jmp 0x421c9a
xor eax, eax
inc eax
jmp 0x421c9a
xor ecx, ecx
cmp al, 0x9f
setne cl
mov byte [ebp + 0xb], 1
dec ecx
and ecx, 0xf0
add ecx, 0xffffff88
imul ecx, esi
shl ecx, 0x10
mov dword [ebp + 0x24], ecx
jmp 0x421b40
mov dword [ebp + 0x10], 0x20b
mov dword [ebp + 0xc], 0x20c
mov dword [ebp + 0x24], 0x40
jmp 0x421b40
mov dword [ebp + 0x10], 0x20b
mov dword [ebp + 0xc], 0x20c
mov dword [ebp + 0x24], 0x20
jmp 0x421b40
mov dword [ebp + 0x10], 0x207
mov dword [ebp + 0xc], 0x208
mov dword [ebp + 0x24], 0x10
jmp 0x421b40
mov dword [ebp + 0x10], 0x204
mov dword [ebp + 0xc], 0x205
mov dword [ebp + 0x24], 2
jmp 0x421b40
mov dword [ebp + 0x10], 0x201
mov dword [ebp + 0xc], 0x202
mov dword [ebp + 0x24], edi
cmp byte [ebp + 0x23], 0
mov byte [ebp + 0x17], 0
je 0x421b90
push 0
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
mov dword [ebp + 0x20], eax
je 0x421b87
cmp eax, dword [0x463d9c]
je 0x421b87
push dword [ebp + 0x18]
call fcn.0043b4d6
test al, al
pop ecx
jne 0x421b87
push edi
push dword [ebp + 0x20]
push dword [0x463d9c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [ebp + 0x17]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
cmp byte [ebp + 0xb], 0
je 0x421bde
push ebx
push dword [ebp + 0x24]
push 0x20a
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x463270]
cmp eax, 0xffffffff
jle 0x421c6e
cmp eax, 0x19
jge 0x421bd0
cmp byte [0x464499], 0
je 0x421bd0
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x421c6e
push edi
push eax
call fcn.0040bd90
pop ecx
pop ecx
jmp 0x421c6e
test esi, esi
jle 0x421c6e
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp + 8], esi
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [ebp - 4], 1
je 0x421c2e
push ebx
push dword [ebp + 0x24]
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
call esi
mov eax, dword [0x463270]
cmp eax, 0xffffffff
jle 0x421c2e
cmp eax, 0x19
jge 0x421c24
cmp byte [0x464499], 0
je 0x421c24
push eax
call edi
jmp 0x421c2e
push 1
push eax
call fcn.0040bd90
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x421c66
push ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
call esi
mov eax, dword [0x463270]
cmp eax, 0xffffffff
jle 0x421c66
cmp eax, 0x19
jge 0x421c5c
cmp byte [0x464499], 0
je 0x421c5c
push eax
call edi
jmp 0x421c66
push 1
push eax
call fcn.0040bd90
pop ecx
pop ecx
dec dword [ebp + 8]
jne 0x421bf5
xor edi, edi
inc edi
cmp byte [ebp + 0x17], 0
je 0x421c85
push 0
push dword [ebp + 0x20]
push dword [0x463d9c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [0x463c78]
push edi
push 0
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
pop esi
pop ebx
pop edi
leave
ret 0x20