Function at 0x421428
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
push 1
push 0
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x465b20]
push 0x459f14
call fcn.00401592
push dword [ebp + 0x24]
mov ecx, edi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.0043a541
test eax, eax
mov dword [ebp + 0x18], eax
jne 0x421467
inc eax
jmp 0x42189f
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
push ebx
mov ebx, 0x80000000
push esi
mov dword [ebp - 4], 2
mov byte [ebp + 0x27], 0
mov byte [ebp + 0x23], 1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov edi, eax
je 0x421524
lea esi, [eax + 1]
movsx eax, byte [edi]
push eax
call fcn.00441c9f
sub eax, 0x44
pop ecx
je 0x42150f
sub eax, 0xa
je 0x4214f8
dec eax
dec eax
je 0x4214da
sub eax, 5
je 0x4214d1
sub eax, 3
je 0x4214c5
dec eax
jne 0x421513
push esi
call fcn.004019f5
pop ecx
mov dword [ebp - 8], eax
jmp 0x421513
push esi
call fcn.004019f5
pop ecx
mov dword [ebp - 0xc], eax
jmp 0x421513
mov dword [ebp - 4], 1
jmp 0x421513
push 3
push 0x45d2ec
push edi
call fcn.00441854
add esp, 0xc
test eax, eax
jne 0x421513
inc edi
inc edi
inc esi
inc esi
mov byte [ebp + 0x27], 1
jmp 0x421513
movsx eax, byte [esi]
push eax
call fcn.00441c9f
cmp eax, 0x41
pop ecx
jne 0x421513
inc edi
inc esi
mov byte [ebp + 0x23], 0
jmp 0x421513
and dword [ebp - 4], 0
inc edi
inc esi
cmp byte [edi], 0
jne 0x421494
cmp byte [ebp + 0x27], 0
jne 0x42153c
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.0043a622
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x1c], eax
jne 0x42161d
and dword [ebp - 0x54], 0
push 9
pop ecx
push dword [ebp + 0x14]
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
call fcn.00401a22
mov edi, eax
movsx eax, byte [edi]
push eax
call fcn.00441c9f
cmp eax, 0x58
pop ecx
pop ecx
jne 0x4216ae
inc edi
cmp byte [edi], 0
je 0x4216ae
push edi
call fcn.004019fa
mov dword [esp], 0x459be0
push edi
mov dword [ebp - 0x54], eax
call fcn.00438f35
test eax, eax
pop ecx
pop ecx
je 0x4216ae
inc eax
push eax
call fcn.00401a22
mov esi, eax
mov al, byte [esi]
test al, al
pop ecx
je 0x4216ae
movsx eax, al
push eax
call fcn.00441c9f
cmp eax, 0x59
pop ecx
jne 0x4216ae
inc esi
cmp byte [esi], 0
je 0x4216ae
push esi
call fcn.004019fa
mov esi, dword [ebp + 0x18]
pop ecx
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x50], eax
lea eax, [ebp - 0x54]
push eax
push 0x43a76c
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [ebp - 0x3c]
test eax, eax
mov dword [ebp + 0x1c], eax
jne 0x421604
mov dword [ebp + 0x1c], esi
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [ebp + 0xc]
xor edi, edi
inc edi
cmp esi, edi
jl 0x421888
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
je 0x421639
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x421676
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4216a7
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
jne 0x421661
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x421676
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
movzx ebx, ax
movzx eax, cx
shl ebx, 0x10
or ebx, eax
mov al, byte [ebp + 8]
cmp al, 0x9f
je 0x4216b6
cmp al, 0x9e
je 0x4216b6
movzx eax, al
dec eax
mov byte [ebp + 0xb], 0
je 0x421732
dec eax
je 0x42171b
dec eax
dec eax
je 0x421704
dec eax
je 0x4216ed
dec eax
je 0x4216d6
mov eax, edi
jmp 0x42189d
xor eax, eax
inc eax
jmp 0x42189d
xor ecx, ecx
cmp al, 0x9f
setne cl
mov byte [ebp + 0xb], 1
dec ecx
and ecx, 0xf0
add ecx, 0xffffff88
imul ecx, esi
shl ecx, 0x10
mov dword [ebp + 0x24], ecx
jmp 0x421743
mov dword [ebp + 0x10], 0x20b
mov dword [ebp + 0xc], 0x20c
mov dword [ebp + 0x24], pe_nt_image_headers32
jmp 0x421743
mov dword [ebp + 0x10], 0x20b
mov dword [ebp + 0xc], 0x20c
mov dword [ebp + 0x24], 0x20
jmp 0x421743
mov dword [ebp + 0x10], 0x207
mov dword [ebp + 0xc], 0x208
mov dword [ebp + 0x24], 0x10
jmp 0x421743
mov dword [ebp + 0x10], 0x204
mov dword [ebp + 0xc], 0x205
mov dword [ebp + 0x24], 2
jmp 0x421743
mov dword [ebp + 0x10], 0x201
mov dword [ebp + 0xc], 0x202
mov dword [ebp + 0x24], edi
cmp byte [ebp + 0x23], 0
mov byte [ebp + 0x17], 0
je 0x421793
push 0
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
mov dword [ebp + 0x20], eax
je 0x42178a
cmp eax, dword [0x465c44]
je 0x42178a
push dword [ebp + 0x18]
call fcn.0043b520
test al, al
pop ecx
jne 0x42178a
push edi
push dword [ebp + 0x20]
push dword [0x465c44]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [ebp + 0x17]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
cmp byte [ebp + 0xb], 0
je 0x4217e1
push ebx
push dword [ebp + 0x24]
push 0x20a
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x465190]
cmp eax, 0xffffffff
jle 0x421871
cmp eax, 0x19
jge 0x4217d3
cmp byte [0x466341], 0
je 0x4217d3
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x421871
push edi
push eax
call fcn.0040b5c4
pop ecx
pop ecx
jmp 0x421871
test esi, esi
jle 0x421871
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp + 8], esi
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [ebp - 4], 1
je 0x421831
push ebx
push dword [ebp + 0x24]
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
call esi
mov eax, dword [0x465190]
cmp eax, 0xffffffff
jle 0x421831
cmp eax, 0x19
jge 0x421827
cmp byte [0x466341], 0
je 0x421827
push eax
call edi
jmp 0x421831
push 1
push eax
call fcn.0040b5c4
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x421869
push ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
call esi
mov eax, dword [0x465190]
cmp eax, 0xffffffff
jle 0x421869
cmp eax, 0x19
jge 0x42185f
cmp byte [0x466341], 0
je 0x42185f
push eax
call edi
jmp 0x421869
push 1
push eax
call fcn.0040b5c4
pop ecx
pop ecx
dec dword [ebp + 8]
jne 0x4217f8
xor edi, edi
inc edi
cmp byte [ebp + 0x17], 0
je 0x421888
push 0
push dword [ebp + 0x20]
push dword [0x465c44]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [0x465b20]
push edi
push 0
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
pop esi
pop ebx
pop edi
leave
ret 0x20