Function at 0x42ebc0
Capabilities:
Log keystrokes
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov ecx, dword [0x4a13a4]
push ebx
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
push 0x4916f4
mov edi, eax
call fcn.004668b0
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x1c]
call fcn.0043b7d0
mov dword [esp + 0x10], eax
test eax, eax
je case.0x42ef5e.3
cmp byte [edi], 0
mov eax, SysReAllocString
mov dword [esp + 0x1c], 2
mov byte [esp + 0xc], 0
mov byte [esp + 0xd], 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov esi, edi
je 0x42ecf8
lea ebx, [edi + 1]
nop
movzx edi, byte [esi]
test edi, 0xffffff80
jne 0x42ec4d
push 2
push edi
call fcn.0047814e
add esp, 8
test eax, eax
je 0x42ec4d
and edi, 0xffffffdf
mov eax, edi
movsx eax, al
add eax, 0xffffffbc
cmp eax, 0x15
ja case.0x42ec65.69
movzx ecx, byte [eax + 0x42f138]
jmp dword [ecx*4 + 0x42f11c]
mov dword [esp + 0x1c], 0
jmp case.0x42ec65.69
mov dword [esp + 0x1c], 1
jmp case.0x42ec65.69
movzx edi, byte [ebx]
test edi, 0xffffff80
jne 0x42ec9d
push 2
push edi
call fcn.0047814e
add esp, 8
test eax, eax
je 0x42ec9d
and edi, 0xffffffdf
mov eax, edi
cmp al, 0x41
jne case.0x42ec65.69
inc esi
inc ebx
mov byte [esp + 0xd], 0
jmp case.0x42ec65.69
push 3
push 0x4945ac
push esi
call fcn.00477695
add esp, 0xc
test eax, eax
jne case.0x42ec65.69
add esi, 2
add ebx, 2
mov byte [esp + 0xc], 1
jmp case.0x42ec65.69
push ebx
call fcn.00478196
mov dword [esp + 0x2c], eax
jmp 0x42ece3
push ebx
call fcn.00478196
mov dword [esp + 0x30], eax
add esp, 4
inc esi
inc ebx
cmp byte [esi], 0
jne 0x42ec30
cmp byte [esp + 0xc], 0
jne 0x42ed16
mov edx, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
push edx
call fcn.00468140
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
test esi, esi
jne 0x42ee62
mov edi, dword [ebp + 0x10]
xor eax, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov al, byte [edi]
cmp al, 0x20
je 0x42ed4d
cmp al, 9
jne 0x42ed50
inc edi
jmp 0x42ed43
movzx esi, byte [edi]
test esi, 0xffffff80
jne 0x42ed6d
push 2
push esi
call fcn.0047814e
add esp, 8
test eax, eax
je 0x42ed6d
and esi, 0xffffffdf
mov eax, esi
cmp al, 0x58
jne case.0x42ef5e.3
cmp byte [edi + 1], 0
lea esi, [edi + 1]
je case.0x42ef5e.3
mov eax, esi
call fcn.0040c270
test al, al
je 0x42ed9e
push 0x10
push 0
push esi
call fcn.00478594
add esp, 0xc
jmp 0x42eda7
push esi
call fcn.00478196
add esp, 4
mov dword [esp + 0x50], eax
mov edi, 0x4918e4
mov eax, esi
call fcn.00408bf0
test eax, eax
je case.0x42ef5e.3
lea esi, [eax + 1]
mov al, byte [esi]
cmp al, 0x20
je 0x42edcc
cmp al, 9
jne 0x42edcf
inc esi
jmp 0x42edc2
mov al, byte [esi]
test al, al
je case.0x42ef5e.3
movsx eax, al
push eax
call fcn.00479f90
add esp, 4
cmp eax, 0x59
jne case.0x42ef5e.3
inc esi
cmp byte [esi], 0
je case.0x42ef5e.3
call fcn.0040c2c0
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x5c], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
add dword [esp + 0x50], edx
add dword [esp + 0x54], eax
lea ecx, [esp + 0x50]
push ecx
push 0x4353a0
push edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov esi, dword [esp + 0x68]
test esi, esi
je 0x42ee40
mov dword [esp + 0x18], esi
jmp 0x42ee46
mov esi, edi
mov dword [esp + 0x18], edi
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x28]
push ecx
push esi
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [ebp + 0xc], 1
jl 0x42f0ee
mov ecx, dword [esp + 0x28]
cmp ecx, 0x80000000
je 0x42ee83
mov eax, dword [esp + 0x2c]
cmp eax, 0x80000000
jne 0x42eed2
lea edx, [esp + 0x30]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je case.0x42ef5e.3
mov ecx, dword [esp + 0x28]
cmp ecx, 0x80000000
jne 0x42eeb6
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x30]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x2c]
cmp eax, 0x80000000
jne 0x42eed2
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x34]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x2c], eax
movzx eax, ax
shl eax, 0x10
movzx ecx, cx
or eax, ecx
mov dword [esp + 0x20], eax
mov al, byte [ebp + 8]
cmp al, 0x9f
je 0x42eef0
cmp al, 0x9e
je 0x42eef0
xor dl, dl
jmp 0x42eef2
mov dl, 1
mov byte [esp + 0xc], dl
cmp al, 0x9c
je 0x42ef02
cmp al, 0x9d
je 0x42ef02
xor cl, cl
jmp 0x42ef04
mov cl, 1
mov byte [esp + 0xe], cl
test dl, dl
je 0x42ef2e
xor ebx, ebx
cmp al, 0x9f
setne bl
mov edi, 0x20a
dec ebx
and ebx, 0xf0
add ebx, 0xffffff88
imul ebx, dword [ebp + 0xc]
shl ebx, 0x10
jmp 0x42efba
test cl, cl
je 0x42ef51
xor ebx, ebx
cmp al, 0x9c
setne bl
mov edi, 0x20e
dec ebx
and ebx, 0xffffff10
add ebx, 0x78
imul ebx, dword [ebp + 0xc]
shl ebx, 0x10
jmp 0x42efba
movzx eax, al
dec eax
cmp eax, 5
ja case.0x42ef5e.3
jmp dword [eax*4 + 0x42f150]
mov edi, 0x201
mov dword [esp + 0x14], 0x202
mov ebx, 1
jmp 0x42efba
mov edi, 0x204
mov dword [esp + 0x14], 0x205
mov ebx, 2
jmp 0x42efba
mov edi, 0x207
mov dword [esp + 0x14], 0x208
mov ebx, 0x10
jmp 0x42efba
mov ebx, 0x20
jmp 0x42efad
mov ebx, 0x40
mov dword [esp + 0x14], 0x20c
mov edi, 0x20b
cmp byte [esp + 0xd], 0
mov byte [esp + 0xf], 0
je 0x42f016
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x24], eax
test eax, eax
je 0x42f00b
cmp eax, dword [0x4a2bbc]
je 0x42f00b
mov esi, dword [esp + 0x10]
call fcn.00468640
test al, al
jne 0x42f00b
mov ecx, dword [esp + 0x24]
mov edx, dword [0x4a2bbc]
push 1
push ecx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0xf]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
cmp byte [esp + 0xc], 0
jne 0x42f0a9
cmp byte [esp + 0xe], 0
jne 0x42f0a9
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x42f0d4
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x1c], 1
je 0x42f06e
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ecx
push ebx
push edi
push edx
call esi
mov eax, dword [0x49d3c8]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x42f06e
push 1
push eax
call fcn.00401340
add esp, 8
cmp dword [esp + 0x1c], 0
je 0x42f0a1
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
call esi
mov ecx, dword [0x49d3c8]
mov eax, dword [ecx + 0x58]
cmp eax, 0xffffffff
jle 0x42f0a1
push 1
push eax
call fcn.00401340
add esp, 8
dec dword [esp + 0x10]
jne 0x42f041
jmp 0x42f0d4
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
push edx
push ebx
push edi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [0x49d3c8]
mov eax, dword [ecx + 0x58]
cmp eax, 0xffffffff
jle 0x42f0d4
push 1
push eax
call fcn.00401340
add esp, 8
cmp byte [esp + 0xf], 0
je 0x42f0ee
mov edx, dword [esp + 0x24]
mov eax, dword [0x4a2bbc]
push 0
push edx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
push 0x4900b0
call fcn.004668b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x1c