Function at 0x42a8c4
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x2c
mov eax, 0x4755ed
call fcn.00461bf0
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp + 8]
cmp word [edi + 0xc], 9
jne 0x42a8f8
mov eax, dword [ecx + 0xa4]
cmp dword [edi], eax
jne 0x42a8f8
mov ecx, dword [ecx + 0x74]
mov eax, dword [ecx]
call dword [eax]
xor al, al
call fcn.00461cc8
ret 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
push 0x11
shr eax, 0xf
and al, 1
mov byte [ebp - 0xd], al
call esi
push 0xa3
shr eax, 0xf
and al, 1
mov byte [ebp - 0xe], al
call esi
push 0x10
shr eax, 0xf
and al, 1
mov bl, al
call esi
push 0x90
shr eax, 0xf
and al, 1
mov byte [ebp + 0xb], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebp - 0xf], al
mov eax, dword [ebp + 0xc]
and dword [eax], 0
movzx eax, word [edi + 0xc]
cmp eax, 0x30
jb 0x42a97e
cmp eax, 0x39
ja 0x42a97e
test bl, bl
jne 0x42a95e
mov cl, byte [ebp - 0xd]
test cl, cl
je 0x42a981
mov ecx, dword [ebp - 0x14]
add eax, 0xffffffd0
cmp byte [ebp + 0xb], 0
push eax
je 0x42a977
call fcn.00422d2f
mov al, 1
jmp 0x42a8f0
call fcn.004257d6
jmp 0x42a970
mov cl, byte [ebp - 0xd]
cmp eax, 0x71
je 0x42a98b
cmp eax, 0x70
jne 0x42a9b1
test cl, cl
je 0x42a9b1
mov dl, byte [ebp - 0xe]
test dl, dl
jne 0x42a9b4
cmp byte [ebp + 0xb], dl
jne 0x42a9b4
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x74]
mov edx, dword [ecx]
xor ebx, ebx
cmp eax, 0x70
setne bl
push ebx
call dword [edx + 4]
jmp 0x42a970
mov dl, byte [ebp - 0xe]
cmp eax, 0x78
jne 0x42a9d6
test cl, cl
jne 0x42a9d6
test dl, dl
jne 0x42a9d6
cmp byte [ebp + 0xb], dl
jne 0x42a9d6
mov ecx, 0x4a13d0
call fcn.00417257
mov dl, byte [ebp - 0xe]
mov cl, byte [ebp - 0xd]
movzx eax, word [edi + 0xc]
cmp eax, 0x72
jb 0x42aa0d
cmp eax, 0x7b
ja 0x42aa0d
test dl, dl
je 0x42aa0d
push eax
call fcn.0042a8a4
mov esi, dword [ebp - 0x14]
xor ebx, ebx
cmp eax, ebx
jl 0x42aa08
push dword [eax*8 + 0x49bd84]
mov ecx, esi
call fcn.0042f629
mov dl, byte [ebp - 0xe]
mov cl, byte [ebp - 0xd]
jmp 0x42aa12
mov esi, dword [ebp - 0x14]
xor ebx, ebx
movzx eax, word [edi + 0xc]
cmp eax, 0x4d
jg 0x42ac91
je 0x42ac7d
cmp eax, 0x2d
jg 0x42ab6f
je 0x42ab26
cmp eax, 0x26
jg 0x42aade
je 0x42aacd
cmp eax, 8
je 0x42aac1
cmp eax, 0x10
je 0x42aa9a
cmp eax, 0x22
je 0x42aa82
cmp eax, 0x25
jne case.0x42acac.85
test cl, cl
je 0x42aa6c
mov ecx, dword [esi + 0x74]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp case.0x42acac.85
cmp byte [ebp + 0xb], 0
je case.0x42acac.85
mov ecx, esi
call fcn.0042ecdc
jmp case.0x42acac.85
test dl, dl
je case.0x42acac.85
test cl, cl
jne case.0x42acac.85
cmp byte [ebp + 0xb], cl
jmp 0x42ab4b
push 1
push 0xffffffffffffffff
push 0x100c
push dword [esi + 0xa4]
mov byte [esi + 0x214], 0
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x218], eax
jmp case.0x42acac.85
mov ecx, esi
call fcn.00424916
jmp 0x42a970
test cl, cl
je 0x42aa6c
mov ecx, dword [esi + 0x74]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp case.0x42acac.85
sub eax, 0x27
je 0x42aa5b
dec eax
je 0x42aa6c
dec eax
dec eax
je 0x42ab13
dec eax
jne case.0x42acac.85
cmp byte [ebp - 0xf], al
je case.0x42acac.85
push 1
mov ecx, esi
call fcn.0042f07f
mov ecx, esi
call fcn.0041b75a
jmp 0x42a970
cmp byte [ebp - 0xf], 0
je case.0x42acac.85
mov ecx, esi
call fcn.0042eee1
jmp 0x42ab07
test cl, cl
jne case.0x42acac.85
test dl, dl
je 0x42ab43
cmp byte [ebp + 0xb], cl
jne 0x42ab49
mov ecx, esi
call fcn.0042c57d
jmp 0x42a970
cmp byte [ebp + 0xb], 0
je 0x42ab56
test dl, dl
jne case.0x42acac.85
jmp 0x42a970
cmp byte [esi + 0x11f], 0
je case.0x42acac.85
mov ecx, esi
call fcn.0042ed84
jmp 0x42a970
cmp eax, 0x43
jg 0x42ac05
je 0x42abf1
cmp eax, 0x2e
je 0x42abcd
cmp eax, 0x30
jle case.0x42acac.85
cmp eax, 0x34
jle 0x42ac5f
cmp eax, 0x41
je 0x42abb1
cmp eax, 0x42
jne case.0x42acac.85
test cl, cl
je case.0x42acac.85
call fcn.0044f0ce
jmp 0x42a970
test dl, dl
jne 0x42ae20
test cl, cl
je case.0x42acac.85
mov ecx, esi
call fcn.0041e589
jmp 0x42a970
cmp byte [esi + 0x216], 0
je 0x42a970
cmp byte [ebp + 0xb], 0
mov ecx, esi
sete al
movzx eax, al
push eax
call fcn.0042e819
jmp 0x42a970
test dl, dl
je case.0x42acac.85
mov ecx, esi
call fcn.00426bb1
jmp 0x42a970
sub eax, 0x44
je 0x42ac51
dec eax
je 0x42ac69
dec eax
je 0x42ac3d
sub eax, 3
jne case.0x42acac.85
test cl, cl
je 0x42ac29
mov ecx, esi
call fcn.0042c979
jmp 0x42a970
test dl, dl
je case.0x42acac.85
mov ecx, esi
call fcn.00426916
jmp 0x42a970
test dl, dl
je 0x42ac51
mov ecx, 0x4a13d0
call fcn.00418a68
mov dl, byte [ebp - 0xe]
mov cl, byte [ebp - 0xd]
test cl, cl
je 0x42ac5f
mov ecx, esi
call fcn.00429026
mov dl, byte [ebp - 0xe]
test dl, dl
setne al
jmp 0x42a8f0
test cl, cl
je case.0x42acac.85
mov ecx, esi
call fcn.004201e5
jmp 0x42a970
test cl, cl
je case.0x42acac.85
mov ecx, esi
call fcn.0042e383
jmp 0x42a970
cmp eax, 0x58
jg 0x42adda
je 0x42adbe
sub eax, 0x4e
cmp eax, 9
ja case.0x42acac.85
jmp dword [eax*4 + 0x42af14]
test dl, dl
je 0x42acc3
mov ecx, esi
call fcn.00426caa
jmp 0x42a970
test cl, cl
je case.0x42acac.85
push 1
mov ecx, esi
call fcn.00429209
jmp 0x42a970
test dl, dl
je case.0x42acac.85
mov ecx, esi
call fcn.0042e138
jmp 0x42a970
test dl, dl
je 0x42acfd
mov ecx, esi
call fcn.0042a829
jmp 0x42a970
test cl, cl
je case.0x42acac.85
mov ecx, 0x4a13d0
call fcn.004166da
jmp 0x42a970
test dl, dl
je case.0x42acac.85
mov ecx, esi
call fcn.00426473
jmp 0x42a970
test dl, dl
je case.0x42acac.85
lea ecx, [ebp - 0x38]
call fcn.004179ad
push ebx
push 0x7d2
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.00438355
push dword [ebp - 0x20]
call fcn.0044c2e3
pop ecx
jmp 0x42a970
test cl, cl
je 0x42ad67
mov ecx, esi
call fcn.0041e867
jmp 0x42a970
test dl, dl
je case.0x42acac.85
mov ecx, esi
call fcn.0041beb5
jmp 0x42a970
test cl, cl
je case.0x42acac.85
mov ecx, esi
call fcn.0041fb8e
jmp 0x42a970
test cl, cl
je case.0x42acac.85
mov ecx, esi
call fcn.004243e6
jmp 0x42a970
test dl, dl
je case.0x42acac.85
push dword [0x4a1398]
push dword [esi + 4]
call fcn.00442478
jmp 0x42a970
test dl, dl
jne 0x42a970
test cl, cl
je case.0x42acac.85
mov ecx, esi
call fcn.0042462d
jmp 0x42a970
cmp eax, 0x70
jg 0x42ae75
je 0x42ae64
sub eax, 0x5a
je 0x42ae50
sub eax, 0x10
je 0x42ae44
dec eax
je 0x42ae08
dec eax
dec eax
jne case.0x42acac.85
push ebx
test cl, cl
jne 0x42ae0e
mov ecx, esi
cmp byte [ebp + 0xb], al
je 0x42ae3a
jmp 0x42ae24
test cl, cl
je 0x42ae1a
push 1
mov ecx, esi
call fcn.0042f1e2
jmp 0x42a970
cmp byte [ebp + 0xb], 0
je 0x42ae2e
push 1
mov ecx, esi
call fcn.0042eeae
jmp 0x42a970
test dl, dl
jne 0x42a970
push 1
mov ecx, esi
call fcn.0042f07f
jmp 0x42a970
mov ecx, esi
call fcn.0042eee1
jmp 0x42a970
test dl, dl
je case.0x42acac.85
cmp byte [esi + 0x216], 0
jmp 0x42ac7f
push dword [0x49bd7c]
push ebx
call fcn.00449d73
jmp case.0x42acac.85
sub eax, 0x71
je 0x42aeed
dec eax
je 0x42aec8
dec eax
je 0x42aea3
dec eax
jne case.0x42acac.85
test cl, cl
jne case.0x42acac.85
test dl, dl
jne case.0x42acac.85
mov ecx, esi
call fcn.0042a73d
jmp 0x42ab07
test cl, cl
jne case.0x42acac.85
test dl, dl
jne case.0x42acac.85
mov ecx, esi
cmp byte [ebp + 0xb], dl
jne 0x42ace3
call fcn.00428f99
jmp 0x42a970
test cl, cl
jne case.0x42acac.85
test dl, dl
jne case.0x42acac.85
cmp byte [ebp + 0xb], dl
jne case.0x42acac.85
mov ecx, esi
call fcn.00429809
jmp 0x42a970
test cl, cl
jne case.0x42acac.85
test dl, dl
jne case.0x42acac.85
cmp byte [ebp + 0xb], dl
jne case.0x42acac.85
mov ecx, esi
call fcn.0042d243
jmp 0x42a970