Function at 0x42de94
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x5c], 0x28
mov ebx, ecx
mov dword [ebp - 0x74], esi
push 9
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x34]
xor edx, edx
stosd dword es:[edi], eax
mov ecx, edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x94], edx
stosd dword es:[edi], eax
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x64], ecx
stosd dword es:[edi], eax
mov byte [ebp - 0x5d], dl
stosd dword es:[edi], eax
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10fa7], cl
jne 0x42df0b
cmp dword [ebx + 0x154], edx
je 0x42e35a
push edx
mov ecx, ebx
call fcn.00432292
test al, al
jne 0x42e357
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10f91], 0
je 0x42df31
mov ecx, dword [eax + 0x11174]
jmp 0x42df37
mov ecx, dword [ebx + 0x194]
cmp ecx, 0x520
jne 0x42df55
push 0
mov ecx, ebx
call fcn.00432292
test al, al
je 0x42e357
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10f91], 0
je 0x42df66
mov eax, dword [eax + 0x11174]
jmp 0x42df6c
mov eax, dword [ebx + 0x194]
cmp eax, 0x521
jne 0x42df84
push 0
mov ecx, ebx
call fcn.00432292
test al, al
je 0x42e357
cmp byte [ebp + 0xc], 0
je 0x42dfc3
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x42dfc3
lea eax, [ebp - 0x9c]
mov byte [ebp - 0x5d], 1
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 2
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
call dword [sym.imp.USER32.dll_MonitorFromPoint]
jmp 0x42dfde
push 2
test esi, esi
je 0x42dfd2
push esi
call dword [sym.imp.USER32.dll_MonitorFromRect]
jmp 0x42dfde
push dword [0x5a22a4]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
lea ecx, [ebp - 0x5c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0
test eax, eax
jne 0x42e00b
push 0xd6d
push 0x52c800
push str.GetMonitorInfo_failed
call fcn.0041f6df
add esp, 0x10
jmp 0x42e357
push 0x11
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, eax
push 3
pop ecx
cdq
idiv ecx
mov ecx, dword [0x5a23f0]
push eax
call fcn.0046a75f
cmp byte [ebp - 0x5d], 0
mov dword [ebp - 0x6c], eax
je 0x42e0cc
test esi, esi
je 0x42e0cc
call fcn.004e3af4
test al, al
je 0x42e0cc
lea esi, [ebp - 0x48]
xor ecx, ecx
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x74]
mov eax, dword [esi + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x42e070
inc ecx
cmp ecx, 4
jne 0x42e05d
jmp 0x42e386
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x40]
mov edi, dword [ebp - 0x44]
cmp ecx, edx
jge 0x42e0a3
mov eax, edx
sub eax, dword [ebp - 0x6c]
cmp ecx, eax
jl 0x42e0a3
cmp dword [esi + 8], edx
jne 0x42e0a3
cmp dword [esi + 4], edi
je 0x42e386
mov eax, dword [ebp - 0x3c]
cmp dword [esi + 0xc], eax
je 0x42e386
mov edx, dword [ebp - 0x48]
cmp ecx, edx
jl 0x42e0cc
mov eax, dword [ebp - 0x6c]
add eax, edx
cmp ecx, eax
jge 0x42e0cc
cmp dword [esi], edx
jne 0x42e0cc
cmp dword [esi + 4], edi
je 0x42e386
mov eax, dword [ebp - 0x3c]
cmp dword [esi + 0xc], eax
je 0x42e386
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.00428151
mov esi, eax
lea edi, [ebp - 0x14]
push 1
lea eax, [ebp - 0x14]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x24]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x48]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00427ac1
mov edi, dword [ebp - 0x74]
add esp, 0xc
test edi, edi
je 0x42e10e
mov esi, edi
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x42e11e
lea eax, [ebp - 0x34]
push eax
push dword [0x5a22a4]
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebx + 0x16c], 0
lea esi, [ebp - 0x34]
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x34]
je 0x42e157
mov eax, dword [ebx + 0x170]
add dword [ebp - 0x7c], eax
lea ecx, [eax + edi]
mov eax, dword [ebx + 0x174]
add dword [ebp - 0x80], eax
add dword [ebp - 0x78], eax
mov dword [ebp - 0x84], ecx
jmp 0x42e15d
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x6c]
sub eax, ecx
cdq
mov ecx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, edx
sub ecx, edx
cmp ecx, esi
setle byte [ebp - 0x6d]
sub eax, dword [ebp - 0x7c]
cdq
xor eax, edx
sub eax, edx
cmp eax, esi
mov eax, dword [ebp - 0x20]
setle byte [ebp - 0x5d]
sub eax, dword [ebp - 0x80]
cdq
xor eax, edx
sub eax, edx
cmp eax, esi
mov eax, dword [ebp - 0x18]
setle byte [ebp - 0x66]
sub eax, dword [ebp - 0x78]
cdq
xor eax, edx
sub eax, edx
mov dl, byte [ebp - 0x5d]
cmp eax, esi
setle dh
mov byte [ebp - 0x65], dh
cmp ecx, esi
jle 0x42e20e
test dl, dl
jne 0x42e20e
cmp byte [ebp - 0x66], dl
jne 0x42e20e
test dh, dh
jne 0x42e20e
cmp dword [ebx + 0x16c], 0
je 0x42e354
lea esi, [ebp - 0x84]
xor ecx, ecx
lea edi, [ebp - 0x14]
mov dword [ebp - 0x64], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x74]
mov dword [ebp - 0x94], 1
test esi, esi
jne 0x42e348
push 4
push edi
push dword [ebp - 0x90]
mov ecx, ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
call fcn.004324ee
jmp 0x42e357
mov ecx, dword [ebp - 0x2c]
lea esi, [ebp - 0x34]
mov eax, dword [ebp - 0x28]
sub ecx, edi
sub eax, dword [ebp - 0x30]
lea edi, [ebp - 0x14]
cmp byte [ebp - 0x6d], 0
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x6c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x42e256
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x84]
lea eax, [ecx + edx]
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
cmovl ecx, eax
sub esi, edx
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov dword [ebp - 0x88], esi
inc ecx
jmp 0x42e27e
test dl, dl
je 0x42e289
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
sub eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x24]
cmp edx, eax
push 2
cmovl edx, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x7c]
sub eax, ecx
mov dword [ebp - 0x88], eax
pop ecx
mov dword [ebp - 0x14], edx
mov dh, byte [ebp - 0x65]
mov dword [ebp - 0x64], ecx
jmp 0x42e2a4
test byte [ebx + 0x16c], 3
mov ecx, dword [ebp - 0x64]
je 0x42e2a7
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x6c]
cmp byte [ebp - 0x66], 0
je 0x42e2d5
mov edx, dword [ebp - 0x20]
add eax, edx
mov esi, dword [ebp - 0x18]
cmp eax, esi
mov dword [ebp - 0x10], edx
cmovl esi, eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 8], esi
mov esi, eax
sub esi, edx
or ecx, 4
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x64], ecx
jmp 0x42e30c
test dh, dh
je 0x42e309
mov esi, dword [ebp - 0x18]
mov eax, esi
mov edi, dword [ebp - 0x6c]
sub eax, edi
mov edx, dword [ebp - 0x20]
cmp edx, eax
mov dword [ebp - 8], esi
cmovl edx, eax
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x78]
mov eax, edx
sub eax, esi
or ecx, 8
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x64], ecx
jmp 0x42e312
mov eax, dword [ebp - 0x80]
mov edi, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x78]
test cl, 0xc
jne 0x42e326
test byte [ebx + 0x16c], 0xc
je 0x42e326
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edx
lea esi, [ebp - 0x14]
xor edx, edx
mov eax, dword [esi + edx*4]
lea esi, [ebp - 0x34]
cmp eax, dword [esi + edx*4]
lea esi, [ebp - 0x14]
jne 0x42e1dd
inc edx
cmp edx, 4
jne 0x42e32b
mov esi, dword [ebp - 0x74]
jmp 0x42e35a
mov edi, dword [ebp - 0x74]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x42e343
mov esi, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x64]
push 0
test cl, 3
mov dword [ebx + 0x16c], ecx
pop eax
cmovne eax, dword [ebp - 0x88]
test cl, 0xc
mov dword [ebx + 0x170], eax
push 0
pop eax
cmovne eax, dword [ebp - 0x8c]
mov dword [ebx + 0x174], eax
mov ecx, dword [0x5a23ec]
push 1
call fcn.004673c5
test eax, eax
je 0x42e3a8
mov ecx, dword [ebx + 0xcc]
push esi
push str.OnMoving.end
call fcn.00411016
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x94]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004f4166
leave
ret 8