Function at 0x414bca
Capabilities:
Check for foreground window switch
Log keystrokes via polling
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
mov ebx, 0x42e290
push edi
mov esi, ebx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.00422bb6
test eax, eax
pop ecx
jne 0x414c14
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 1
push dword [ebp + 8]
call esi
push 3
push dword [ebp + 8]
call esi
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x414e10
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x414c51
mov esi, dword [sym.imp.USER32.dll_SetTimer]
xor ebx, ebx
push ebx
push 0x3e8
push 1
push edi
call esi
cmp dword [0x42e290], 1
jne 0x414c4a
push ebx
push dword [0x42f2c4]
push 3
push edi
call esi
xor eax, eax
jmp 0x414e13
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 1
push edi
call esi
push 3
push edi
call esi
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
mov word [ebp - 0x20c], bx
call fcn.004034ed
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x414cbc
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp word [ebp - 0x20c], bx
je 0x414e10
push dword [ebp + 8]
call fcn.00412d5a
pop ecx
lea eax, [ebp - 0x20c]
push 0x10
push str.CLCL___Error
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x414e10
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
cmp dword [ebp - 0xc], 1
mov edi, 0x42f11c
setne al
push eax
push esi
push edi
call fcn.0040e618
add esp, 0xc
test eax, eax
push esi
jne 0x414ceb
call fcn.0040438f
pop ecx
jmp 0x414e10
push 0x10
push dword [ebp + 8]
call fcn.0041a713
add esp, 0xc
cmp dword [ebp - 0xc], 1
jne 0x414dd5
push ebx
push esi
push 1
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0041a3a8
add esp, 0x14
test al, 2
je 0x414d2e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.00422cc4
cmp eax, 1
pop ecx
jne 0x414dd5
push esi
push 0x42f0c0
call fcn.00404435
pop ecx
test eax, eax
pop ecx
je 0x414dd5
push ebx
push esi
push edi
call fcn.00404259
add esp, 0xc
push esi
push ebx
push 0x8190
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call fcn.0040438f
cmp dword [ebp - 4], ebx
pop ecx
je 0x414dd5
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x414dd5
cmp dword [eax + 0x14], 1
jne 0x414dd5
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call esi
test ax, ax
jl 0x414daa
push 0x11
call esi
test ax, ax
jl 0x414daa
push 0x10
call esi
test ax, ax
jl 0x414daa
push 0x5b
call esi
test ax, ax
jl 0x414daa
push 0x5c
call esi
test ax, ax
jge 0x414db4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x414d7d
push dword [ebp + 8]
call fcn.0041541d
pop ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.00419a74
push ebx
push dword [ebp + 8]
call fcn.00415320
add esp, 0xc
push dword [ebp + 8]
call fcn.004143cf
cmp dword [0x42f1dc], 1
pop ecx
jne 0x414e00
cmp dword [0x42f1e0], 1
jne 0x414e00
push ebx
push ebx
push 0x812f
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x812c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret