Function at 0x42a820
Capabilities:
Check if file exists
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
movzx ecx, word [ebp + 8]
lea edx, [ecx - 0x420]
cmp edx, 0x18
ja case.0x42a852.1068
movzx eax, byte [edx + 0x42ac20]
jmp dword [eax*4 + 0x42abfc]
mov eax, dword [edi + 0xd0]
test eax, eax
je case.default.0x42a870
cmp edx, 3
ja case.default.0x42a870
jmp dword [edx*4 + 0x42ac3c]
mov edi, dword [eax + 0xc]
test edi, edi
je case.default.0x42a870
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a887
jmp 0x42a8eb
mov edi, dword [eax + 0x10]
test edi, edi
je case.default.0x42a870
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a8a4
jmp 0x42a8eb
mov edi, dword [eax + 0x28]
test edi, edi
je case.default.0x42a870
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a8c1
jmp 0x42a8eb
mov edi, dword [eax + 0x2c]
test edi, edi
je case.default.0x42a870
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a8e0
sub ecx, edx
sar ecx, 1
lea ebx, [ecx*2 + 2]
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je case.default.0x42a870
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je case.default.0x42a870
push ebx
push edi
push eax
call fcn.004def30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov ebx, dword [edi + 0xd0]
mov dword [ebp - 0x444], ebx
test ebx, ebx
je case.default.0x42a870
push dword [ebx + 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42a9ac
push dword [ebx + 0x10]
push 0x51c36c
push eax
push 0x51c380
push dword [edi]
call fcn.00425190
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
push 0x10
movzx ebx, ax
call esi
shr eax, 0xf
shr ebx, 0xf
and al, 1
test bl, 1
je 0x42a9d5
test al, al
jne 0x42a9d5
mov ebx, 1
jmp 0x42a9d7
xor ebx, ebx
mov esi, dword [ebp - 0x444]
push dword [esi + 0x10]
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov dword [ebp - 0x444], eax
test eax, eax
je 0x42aa16
push ebx
push 0
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHOpenFolderAndSelectItems]
push dword [ebp - 0x444]
mov ebx, eax
call dword [sym.imp.SHELL32.dll_SHFree]
shr ebx, 0x1f
xor bl, 1
jne case.default.0x42a870
push dword [esi + 0x10]
lea eax, [ebp - 0x440]
push 0x51c38c
push 0x208
push eax
call fcn.00407ae0
add esp, 0x10
lea eax, [ebp - 0x440]
push 0
push 0x51c3bc
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
cmp ecx, 0x427
sete al
xor edx, edx
cmp ecx, 0x428
movzx eax, al
push eax
sete dl
mov ecx, edi
call fcn.0042af30
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
cmp ecx, 0x42a
mov ecx, edi
sete dl
call fcn.0042acf0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xd4]
test eax, eax
je case.default.0x42a870
lea edx, [ecx - 0x430]
cmp edx, 3
ja case.default.0x42a870
jmp dword [edx*4 + 0x42ac4c]
mov edi, dword [eax + 4]
test edi, edi
je case.default.0x42a870
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42aaf0
jmp 0x42a8eb
mov edi, dword [eax + 0x20]
test edi, edi
je case.default.0x42a870
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ab10
jmp 0x42a8eb
movzx eax, word [eax + 8]
cmp ecx, 0x432
push eax
mov edx, 0x51cc70
mov eax, 0x51c1c8
cmovne eax, edx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0042ba00
lea ecx, [ebp - 0x2c]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ab50
sub ecx, edx
sar ecx, 1
lea edi, [ecx*2 + 2]
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je case.default.0x42a870
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je case.default.0x42a870
push edi
lea ecx, [ebp - 0x2c]
push ecx
jmp 0x42a91a
cmp ecx, 0x434
sete al
xor edx, edx
cmp ecx, 0x435
movzx eax, al
push eax
sete dl
mov ecx, edi
call fcn.0042b190
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
cmp ecx, 0x437
mov ecx, edi
sete dl
call fcn.0042ae10
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dadd7
mov esp, ebp
pop ebp
ret