Function at 0x426400
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x230
mov eax, dword [0x4cbbe8]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebp
mov ebp, dword [esp + 0x238]
push edi
mov edi, dword [esp + 0x240]
cmp di, 0xe5
mov dword [esp + 0x10], ebp
jne 0x42644b
pop edi
mov eax, 2
pop ebp
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0046fa34
add esp, 0x230
ret
cmp di, 0x10
je 0x42642f
cmp di, 0x11
je 0x42642f
cmp di, 0x12
je 0x42642f
cmp word [0x4d82bc], 0
push esi
je 0x4264f1
cmp di, 0x1b
jne 0x4264f1
call fcn.004262f0
test eax, eax
je 0x4264f1
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
mov esi, dword [0x4d9d04]
mov al, byte [0x4d202c]
movzx eax, al
add eax, 1
and eax, reloc.WS2_32.dll_closesocket
jns 0x4264a4
dec eax
or eax, 0xfffffffc
inc eax
test al, al
je 0x4264b7
mov cl, al
sub cl, 1
mov edx, esi
shr dx, cl
test dl, 1
je 0x426492
push 1
push 0x102
push 0x102
mov byte [0x4d202c], al
push ebp
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
pop esi
pop edi
mov eax, 2
pop ebp
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0046fa34
add esp, 0x230
ret
cmp dword [0x4e2678], 0
jne 0x42653a
movzx ecx, di
cmp dword [0x4d1e0c], ecx
jne 0x42653a
push 1
push 0x102
push 0x102
push ebp
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
pop esi
pop edi
mov eax, 2
pop ebp
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0046fa34
add esp, 0x230
ret
mov esi, dword [esp + 0x24c]
test si, si
movzx eax, di
mov dword [0x4d1e0c], eax
jne 0x42655a
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx esi, ax
xor ebp, ebp
call fcn.004262f0
test eax, eax
je 0x426570
or esi, 0x200
mov ebp, 2
call fcn.00426310
test eax, eax
je 0x426582
or esi, 0x400
or ebp, 4
call fcn.00426330
test eax, eax
je 0x4265a8
movzx eax, word [0x4d867e]
push eax
or esi, 0x800
call fcn.00426350
add esp, 4
test eax, eax
jne 0x4265a8
or ebp, 0x10
xor ecx, ecx
cmp dword [0x4e25a8], ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
setne cl
cmp di, 0x2e
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], ecx
jne 0x4265dc
cmp word [0x4d8678], 0
je 0x4265dc
cmp si, 0x53
jne 0x4265fc
mov edx, dword [0x4d2030]
push esi
push edx
call sub.ttpcmn.dll_Ordinal_4
movzx edi, ax
test di, di
jne 0x426693
mov edi, dword [esp + 0x248]
mov esi, dword [esp + 0x18]
push ebp
lea eax, [esp + 0x18]
push eax
push 0x100
lea ecx, [esp + 0x48]
push ecx
push esi
push edi
call fcn.00424b00
movzx edx, word [0x4d867e]
push edx
mov dword [esp + 0x2c], eax
call fcn.00426350
add esp, 0x1c
test eax, eax
je 0x42676f
mov ecx, 1
cmp dword [esp + 0x10], ecx
jne 0x42676f
movzx eax, word [0x4d969a]
sub eax, ecx
je 0x42666e
sub eax, ecx
je 0x426668
mov al, byte [esp + 0x3c]
mov byte [esp + 0x3d], al
mov byte [esp + 0x3c], 0x1b
mov dword [esp + 0x10], 2
jmp 0x42667b
mov dword [esp + 0x14], ecx
jmp 0x426676
mov dword [esp + 0x14], 0
or byte [esp + 0x3c], 0x80
push ecx
push 0x106
push 0x106
push esi
lea ecx, [esp + 0x30]
push ecx
call ebx
jmp 0x42676f
movzx edx, word [0x4d867e]
push edx
call fcn.00426350
add esp, 4
test eax, eax
je 0x4266bf
mov eax, dword [esp + 0x18]
push 1
push 0x106
push 0x106
push eax
lea ecx, [esp + 0x30]
push ecx
call ebx
lea edx, [edi - 0x34]
cmp dx, 0xe
ja 0x4266fe
movzx eax, di
mov esi, dword [eax*4 + 0x4d1f20]
add eax, 0xffffffcc
test esi, esi
jle 0x4266fe
shl eax, 5
add eax, 0x4d1e10
push esi
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00472850
add esp, 0xc
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0
jmp 0x426764
cmp dword [0x4e2670], 0
je 0x426718
cmp word [0x4d922c], 0
jne 0x426718
mov ecx, 1
jmp 0x42671a
xor ecx, ecx
cmp dword [0x4e2674], 0
je 0x426734
cmp word [0x4d922a], 0
jne 0x426734
mov eax, 1
jmp 0x426736
xor eax, eax
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
push edx
push 0x100
lea edx, [esp + 0x48]
push edx
mov edx, dword [0x4e267c]
push edx
push ecx
mov ecx, dword [esp + 0x30]
push eax
mov eax, dword [0x4d2030]
push edi
push eax
push ecx
call sub.ttpcmn.dll_Ordinal_5
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x248]
cmp dword [esp + 0x10], 0
jne 0x42677d
xor eax, eax
jmp 0x426905
cmp di, 0x90
jne 0x4267a8
lea edx, [esp + 0x13c]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor byte [esp + 0x1cc], 1
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
push 1
push 0x102
push 0x102
push esi
lea ecx, [esp + 0x30]
push ecx
call ebx
cmp dword [0x4c1c34], 0
je case.default.0x4267d7
movzx eax, word [esp + 0x14]
cmp eax, 3
ja case.default.0x4267d7
jmp dword [eax*4 + 0x426920]
cmp dword [0x4d299c], 0
jne case.default.0x4267d7
movzx esi, word [esp + 0x24c]
cmp esi, 1
jl case.default.0x4267d7
lea esp, [esp]
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x40]
push eax
push 0x4da080
call sub.ttpcmn.dll_Ordinal_52
cmp word [0x4d84e4], 0
jbe 0x426832
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x40]
push edx
push 0x4da080
call sub.ttpcmn.dll_Ordinal_26
sub esi, 1
jne 0x426800
jmp case.default.0x4267d7
cmp dword [0x4d299c], 0
jne case.default.0x4267d7
movzx esi, word [esp + 0x24c]
cmp esi, 1
jl case.default.0x4267d7
lea ebx, [ebx]
cmp word [0x4d84e4], 0
jbe 0x42687e
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x40]
push ecx
push 0x4da080
call sub.ttpcmn.dll_Ordinal_27
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x40]
push eax
push 0x4da080
call sub.ttpcmn.dll_Ordinal_25
sub esi, 1
jne 0x426860
jmp case.default.0x4267d7
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x3c]
push 0
push edx
mov byte [esp + ecx + 0x44], 0
call fcn.0042a4f0
add esp, 8
jmp case.default.0x4267d7
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x40]
push 0x4a87dc
push edx
mov byte [esp + eax + 0x48], 0
call fcn.00475d6f
add esp, 0xc
cmp eax, 1
jne case.default.0x4267d7
movzx eax, word [esp + 0x1c]
push 0
push eax
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x14]
test ax, ax
je 0x426900
cmp ax, 1
mov eax, 2
jne 0x426905
mov eax, 1
mov ecx, dword [esp + 0x23c]
pop ebx
pop esi
pop edi
pop ebp
xor ecx, esp
call fcn.0046fa34
add esp, 0x230
ret