Function at 0x42187f
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push edi
push 1
push 0
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x466b78]
push 0x45af3c
call fcn.0040187e
push dword [ebp + 0x24]
mov ecx, edi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.0043abd3
test eax, eax
mov dword [ebp + 0x18], eax
jne 0x4218be
inc eax
jmp 0x421d17
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
push ebx
mov ebx, 0x80000000
push esi
mov dword [ebp - 4], 2
mov byte [ebp + 0x27], 0
mov byte [ebp + 0x23], 1
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov edi, eax
je 0x42197b
lea esi, [eax + 1]
movsx eax, byte [edi]
push eax
call fcn.0044234f
sub eax, 0x44
pop ecx
je 0x421966
sub eax, 0xa
je 0x42194f
dec eax
dec eax
je 0x421931
sub eax, 5
je 0x421928
sub eax, 3
je 0x42191c
dec eax
jne 0x42196a
push esi
call fcn.00401378
pop ecx
mov dword [ebp - 0xc], eax
jmp 0x42196a
push esi
call fcn.00401378
pop ecx
mov dword [ebp - 0x10], eax
jmp 0x42196a
mov dword [ebp - 4], 1
jmp 0x42196a
push 3
push 0x45e064
push edi
call fcn.00441f04
add esp, 0xc
test eax, eax
jne 0x42196a
inc edi
inc edi
inc esi
inc esi
mov byte [ebp + 0x27], 1
jmp 0x42196a
movsx eax, byte [esi]
push eax
call fcn.0044234f
cmp eax, 0x41
pop ecx
jne 0x42196a
inc edi
inc esi
mov byte [ebp + 0x23], 0
jmp 0x42196a
and dword [ebp - 4], 0
inc edi
inc esi
cmp byte [edi], 0
jne 0x4218eb
cmp byte [ebp + 0x27], 0
jne 0x421993
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.0043acbc
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x1c], eax
jne 0x421a68
and dword [ebp - 0x58], 0
push 9
pop ecx
push dword [ebp + 0x14]
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
call fcn.00401ed8
mov edi, eax
movsx eax, byte [edi]
push eax
call fcn.0044234f
cmp eax, 0x58
pop ecx
pop ecx
jne 0x421a76
inc edi
cmp byte [edi], 0
je 0x421a76
push edi
call fcn.0040137d
mov dword [esp], 0x45ac08
push edi
mov dword [ebp - 0x58], eax
call fcn.0043956b
test eax, eax
pop ecx
pop ecx
je 0x421a76
inc eax
push eax
call fcn.00401ed8
mov esi, eax
mov al, byte [esi]
test al, al
pop ecx
je 0x421a76
movsx eax, al
push eax
call fcn.0044234f
cmp eax, 0x59
pop ecx
jne 0x421a76
inc esi
cmp byte [esi], 0
je 0x421a76
push esi
call fcn.0040137d
mov esi, dword [ebp + 0x18]
pop ecx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x54], eax
lea eax, [ebp - 0x58]
push eax
push 0x43adeb
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [ebp - 0x40]
test eax, eax
mov dword [ebp + 0x1c], eax
jne 0x421a4f
mov dword [ebp + 0x1c], esi
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_ScreenToClient]
xor edi, edi
inc edi
cmp dword [ebp + 0xc], edi
jge 0x421a7e
push edi
jmp 0x421d01
xor eax, eax
inc eax
jmp 0x421d15
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x421a8c
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x421acd
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x421b5e
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
jne 0x421ab8
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x421acd
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xc], eax
movzx esi, ax
movzx eax, cx
shl esi, 0x10
or esi, eax
mov al, byte [ebp + 8]
cmp al, 0x9f
mov dword [ebp - 8], esi
je 0x421aea
cmp al, 0x9e
mov byte [ebp + 0xb], 0
jne 0x421aee
mov byte [ebp + 0xb], 1
cmp al, 0x9c
je 0x421afa
cmp al, 0x9d
mov byte [ebp + 0x17], 0
jne 0x421afe
mov byte [ebp + 0x17], 1
cmp byte [ebp + 0xb], 0
je 0x421b26
xor ebx, ebx
cmp al, 0x9f
setne bl
mov edi, 0x20a
dec ebx
and ebx, 0xf0
add ebx, 0xffffff88
imul ebx, dword [ebp + 0xc]
shl ebx, 0x10
jmp 0x421ba9
cmp byte [ebp + 0x17], 0
je 0x421b4b
xor ebx, ebx
cmp al, 0x9c
setne bl
mov edi, 0x20e
dec ebx
and ebx, 0xffffff10
add ebx, 0x78
imul ebx, dword [ebp + 0xc]
shl ebx, 0x10
jmp 0x421ba9
movzx eax, al
dec eax
je 0x421b9a
dec eax
je 0x421b8a
dec eax
dec eax
je 0x421b7a
dec eax
je 0x421b76
dec eax
je 0x421b65
mov eax, edi
jmp 0x421d15
push 0x40
mov edi, 0x20b
mov dword [ebp + 0x10], 0x20c
pop ebx
jmp 0x421ba9
push 0x20
jmp 0x421b67
mov edi, 0x207
mov dword [ebp + 0x10], 0x208
push 0x10
jmp 0x421b73
mov edi, 0x204
mov dword [ebp + 0x10], 0x205
push 2
jmp 0x421b73
xor ebx, ebx
mov edi, 0x201
mov dword [ebp + 0x10], 0x202
inc ebx
cmp byte [ebp + 0x23], 0
mov byte [ebp + 0x27], 0
je 0x421bfa
push 0
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
mov dword [ebp + 0x20], eax
je 0x421bf1
cmp eax, dword [0x466c9c]
je 0x421bf1
push dword [ebp + 0x18]
call fcn.0043bba4
test al, al
pop ecx
jne 0x421bf1
push 1
push dword [ebp + 0x20]
push dword [0x466c9c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [ebp + 0x27]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
cmp byte [ebp + 0xb], 0
jne 0x421cae
cmp byte [ebp + 0x17], 0
jne 0x421cae
cmp dword [ebp + 0xc], 0
jle 0x421ce8
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp + 8], eax
cmp dword [ebp - 4], 1
je 0x421c62
push dword [ebp - 8]
push ebx
push edi
push dword [ebp + 0x1c]
call esi
mov eax, dword [0x464108]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x421c62
cmp eax, 0x19
jge 0x421c58
cmp byte [0x467399], 0
je 0x421c58
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x421c62
push 1
push eax
call fcn.0040dca7
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x421ca3
push dword [ebp - 8]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
call esi
mov eax, dword [0x464108]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x421ca3
cmp eax, 0x19
jge 0x421c99
cmp byte [0x467399], 0
je 0x421c99
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x421ca3
push 1
push eax
call fcn.0040dca7
pop ecx
pop ecx
dec dword [ebp + 8]
jne 0x421c24
jmp 0x421ce8
push esi
push ebx
push edi
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x464108]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x421ce8
cmp eax, 0x19
jge 0x421cde
cmp byte [0x467399], 0
je 0x421cde
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x421ce8
push 1
push eax
call fcn.0040dca7
pop ecx
pop ecx
cmp byte [ebp + 0x27], 0
je 0x421cff
push 0
push dword [ebp + 0x20]
push dword [0x466c9c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ecx, dword [0x466b78]
push 0
push 0xffffffffffffffff
push 0x459724
call fcn.0040187e
pop esi
pop ebx
pop edi
leave
ret 0x20