Function at 0x421a7f
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x64
push ebx
call edi
push 0x66
push 0x65
push ebx
mov esi, eax
call edi
push eax
call edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x2c], 1
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x20]
push dword [esp + 0x20]
push ebx
call fcn.00421780
mov ebp, eax
add esp, 0xc
test ebp, ebp
mov dword [esp + 0x14], ebp
je 0x421db1
mov eax, dword [0x42eb28]
test eax, eax
je 0x421c4d
cmp eax, ebp
je 0x421db1
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ebx, 0x110a
push 3
push ebx
push esi
call edi
cmp eax, ebp
je 0x421db1
cmp ebp, dword [0x42ee74]
je 0x421db1
cmp ebp, dword [0x42ee78]
je 0x421b3d
cmp ebp, dword [0x42ee80]
je 0x421b3d
push ebp
push esi
call fcn.0041b5e1
pop ecx
test eax, eax
pop ecx
je 0x421db1
cmp dword [eax + 4], 2
jne 0x421db1
push dword [0x42eb28]
push esi
call fcn.0041b5e1
pop ecx
mov dword [esp + 0x18], eax
test eax, eax
pop ecx
je 0x421db1
cmp dword [eax + 4], 2
jne 0x421ba4
cmp ebp, dword [0x42eb28]
je 0x421db1
cmp ebp, dword [0x42ee74]
je 0x421db1
push ebp
push esi
call fcn.0041b674
cmp eax, dword [0x42ee78]
pop ecx
pop ecx
je 0x421db1
push ebp
push 3
push ebx
push esi
call edi
test eax, eax
je 0x421ba4
cmp eax, dword [0x42eb28]
je 0x421db1
push eax
jmp 0x421b8b
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [eax + 4], 0
je 0x421bfe
push dword [0x42eb28]
push esi
call fcn.0041b674
push ebp
push esi
mov ebx, eax
call fcn.0041b674
add esp, 0x10
cmp eax, ebx
je 0x421bee
cmp ebp, dword [0x42ee74]
jne 0x421bfe
push dword [0x42eb28]
push esi
call fcn.0041b674
cmp eax, dword [0x42ee78]
pop ecx
pop ecx
jne 0x421bfe
cmp dword [esp + 0x2c], 1
je 0x421c39
push 0x11
call edi
test ax, ax
jge 0x421c39
push dword [0x42eb28]
push esi
call fcn.0041b674
cmp eax, dword [0x42ee74]
pop ecx
pop ecx
je 0x421c41
push dword [0x42eb28]
push esi
call fcn.0041b674
push ebp
push esi
mov ebx, eax
call fcn.0041b674
add esp, 0x10
cmp eax, ebx
je 0x421c41
push 0x11
call edi
test ax, ax
jge 0x421c41
mov dword [esp + 0x28], 3
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov ebx, 0x110a
push 9
push ebx
push esi
call edi
push eax
push esi
call fcn.0041b674
mov edx, eax
push ebp
push esi
mov dword [esp + 0x28], edx
call fcn.0041b674
mov ecx, dword [esp + 0x28]
add esp, 0x10
cmp eax, ecx
jne 0x421c93
cmp dword [esp + 0x2c], 1
je 0x421cc2
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x421cc2
push 0
push 9
push ebx
push esi
call edi
push eax
push esi
call fcn.0041b674
push dword [esp + 0x1c]
mov ebp, eax
push esi
call fcn.0041b674
add esp, 0x10
cmp eax, ebp
je 0x421cca
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x421cca
mov dword [esp + 0x28], 3
push 2
push 0xffffffffffffffff
push 0x100c
push dword [esp + 0x1c]
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x2c], eax
je 0x421c41
mov ebp, dword [esp + 0x14]
push dword [esp + 0x2c]
push dword [esp + 0x14]
call fcn.00412985
pop ecx
mov dword [esp + 0x18], eax
test eax, eax
pop ecx
je 0x421db1
cmp eax, ebp
je 0x421db1
push eax
push 3
push ebx
push esi
call edi
cmp eax, ebp
je 0x421db1
cmp ebp, dword [0x42ee74]
je 0x421db1
cmp ebp, dword [0x42ee78]
je 0x421d4b
cmp ebp, dword [0x42ee80]
je 0x421d4b
push ebp
push esi
call fcn.0041b5e1
pop ecx
test eax, eax
pop ecx
je 0x421db1
cmp dword [eax + 4], 2
jne 0x421db1
push dword [esp + 0x14]
push esi
call fcn.0041b5e1
pop ecx
test eax, eax
pop ecx
je 0x421db1
cmp dword [eax + 4], 2
jne 0x421d8e
cmp ebp, dword [0x42ee74]
je 0x421db1
push ebp
push esi
call fcn.0041b674
cmp eax, dword [0x42ee78]
pop ecx
pop ecx
je 0x421db1
push ebp
push 3
push ebx
push esi
call edi
test eax, eax
je 0x421d8e
cmp eax, dword [esp + 0x14]
je 0x421db1
push eax
jmp 0x421d7b
push 2
push dword [esp + 0x30]
push 0x100c
push dword [esp + 0x1c]
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x2c], eax
jne 0x421cea
jmp 0x421c41
xor eax, eax
jmp 0x421c45