Function at 0x42f6f0
Capabilities:
Log keystrokes via polling
Open clipboard
Read clipboard data

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
cmp ebx, 0xd
push edi
jne 0x42f784
mov eax, dword [0x945ae0]
shl eax, 8
add eax, 0xa0a301
push eax
call fcn.0040bcb0
push 0x4a0690
call fcn.0040bcb0
mov ecx, dword [0x945ae0]
shl ecx, 8
add ecx, 0xa0a300
push ecx
push 0x4a0694
call fcn.0040f840
mov edx, dword [0x945ae0]
mov ecx, dword [0xc38880]
add esp, 0x10
lea eax, [edx + 1]
and eax, 0x1f
mov dword [0x945ae0], eax
mov dword [0x945ae4], eax
shl eax, 8
mov byte [eax + 0xa0a300], 0x5d
mov byte [eax + 0xa0a301], 0
mov eax, 1
cmp ecx, eax
mov dword [0xa0a2e0], eax
jne 0x42fdf7
call fcn.00471a10
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ebx, 9
jne 0x42f96d
mov eax, dword [0x945ae0]
xor ebx, ebx
shl eax, 8
add eax, 0xa0a301
push eax
call fcn.0040c6d0
mov ecx, dword [0x945ae0]
mov esi, eax
shl ecx, 8
add ecx, 0xa0a301
push ecx
call fcn.00410c40
mov edx, dword [0x945ae0]
mov edi, eax
shl edx, 8
add edx, 0xa0a301
push edx
call fcn.0040c820
mov ebp, eax
add esp, 0xc
lea eax, [edi + ebp]
add eax, esi
test eax, eax
je 0x42fdf7
cmp eax, 1
jle 0x42f8b9
push 0x4a0698
call fcn.0040f840
add esp, 4
test esi, esi
je 0x42f836
cmp esi, 1
jne 0x42f810
push str.1_possible_command:_n
call fcn.0040f840
add esp, 4
jmp 0x42f81e
push esi
push str._i_possible_commands:_n
call fcn.0040f840
add esp, 8
mov ecx, dword [0x945ae0]
shl ecx, 8
add ecx, 0xa0a301
push ecx
call fcn.0040c720
add esp, 4
test edi, edi
je 0x42f874
cmp edi, 1
jne 0x42f84e
push str.1_possible_variable:_n
call fcn.0040f840
add esp, 4
jmp 0x42f85c
push edi
push str._i_possible_variables:_n
call fcn.0040f840
add esp, 8
mov edx, dword [0x945ae0]
shl edx, 8
add edx, 0xa0a301
push edx
call fcn.00410c90
add esp, 4
test ebp, ebp
je 0x42fdf7
cmp ebp, 1
jne 0x42f890
push str.1_possible_alias:_n
call fcn.0040f840
add esp, 4
jmp 0x42f89e
push ebp
push str._i_possible_aliases:_n
call fcn.0040f840
add esp, 8
mov eax, dword [0x945ae0]
shl eax, 8
add eax, 0xa0a301
push eax
call fcn.0040c870
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
je 0x42f8d7
mov ecx, dword [0x945ae0]
shl ecx, 8
add ecx, 0xa0a301
push ecx
call fcn.0040c5f0
add esp, 4
mov ebx, eax
test edi, edi
je 0x42f8f5
mov edx, dword [0x945ae0]
shl edx, 8
add edx, 0xa0a301
push edx
call fcn.00410960
add esp, 4
mov ebx, eax
test ebp, ebp
je 0x42f911
mov eax, dword [0x945ae0]
shl eax, 8
add eax, 0xa0a301
push eax
call fcn.0040c7d0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x42fdf7
mov edx, dword [0x945ae0]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
shl edx, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebp, [edx + 0xa0a301]
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
pop esi
mov byte [edx + ecx + 0xa0a300], 0x20
inc ecx
pop ebp
mov dword [0xa0a2e0], ecx
mov byte [edx + ecx + 0xa0a300], al
pop ebx
ret
cmp ebx, 0x82
jne 0x42f98e
mov eax, dword [0xa0a2e0]
cmp eax, 1
jle 0x42fdf7
pop edi
dec eax
pop esi
pop ebp
mov dword [0xa0a2e0], eax
pop ebx
ret
cmp ebx, 0x7f
jne 0x42f9de
mov edx, dword [0xa0a2e0]
cmp edx, 1
jle 0x42fdf7
mov ecx, dword [0x945ae0]
xor eax, eax
shl ecx, 8
lea edi, [ecx + edx + 0xa0a300]
or ecx, 0xffffffff
lea ebx, [edi - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
dec edx
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov dword [0xa0a2e0], edx
pop ebx
ret
cmp ebx, 0x94
jne 0x42fa3c
mov edx, dword [0x945ae0]
or ecx, 0xffffffff
shl edx, 8
xor eax, eax
lea edi, [edx + 0xa0a300]
repne scasb al, byte es:[edi]
mov eax, dword [0xa0a2e0]
not ecx
dec ecx
cmp eax, ecx
jae 0x42fdf7
lea edi, [edx + eax + 0xa0a301]
lea edx, [edx + eax + 0xa0a300]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ebx, 0x83
jne 0x42fab3
mov edx, dword [0x945ae0]
or ecx, 0xffffffff
mov ebx, edx
xor eax, eax
shl ebx, 8
mov esi, dword [0xa0a2e0]
lea edi, [ebx + 0xa0a300]
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jne 0x42faa7
dec edx
or ecx, 0xffffffff
and edx, 0x1f
shl edx, 8
lea edi, [edx + 0xa0a300]
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jbe 0x42fdf7
mov cl, byte [edx + esi + 0xa0a300]
pop edi
mov byte [ebx + esi + 0xa0a300], cl
inc esi
mov dword [0xa0a2e0], esi
mov byte [ebx + esi + 0xa0a300], al
pop esi
pop ebp
pop ebx
ret
inc esi
pop edi
mov dword [0xa0a2e0], esi
pop esi
pop ebp
pop ebx
ret
cmp ebx, 0x93
jne 0x42facd
mov eax, dword [0xa096a0]
pop edi
xor eax, 1
pop esi
pop ebp
mov dword [0xa096a0], eax
pop ebx
ret
cmp ebx, 0x80
jne 0x42fb5d
mov edi, dword [0x945ae4]
mov eax, dword [0x945ae0]
mov ecx, edi
dec edi
and edi, 0x1f
cmp edi, eax
je 0x42fb09
mov edx, edi
shl edx, 8
mov bl, byte [edx + 0xa0a301]
test bl, bl
je 0x42fae6
cmp edi, eax
mov dword [0x945ae4], edi
jne 0x42fb17
jmp 0x42fb0f
mov dword [0x945ae4], edi
mov edi, ecx
mov dword [0x945ae4], edi
shl eax, 8
shl edi, 8
lea edx, [eax + 0xa0a300]
add edi, 0xa0a300
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov dword [0xa0a2e0], ecx
pop ebx
ret
cmp ebx, 0x81
jne 0x42fbc5
mov edi, dword [0x945ae4]
mov eax, dword [0x945ae0]
cmp edi, eax
je 0x42fdf7
inc edi
and edi, 0x1f
cmp edi, eax
je 0x42fb9f
mov ecx, edi
shl ecx, 8
mov dl, byte [ecx + 0xa0a301]
test dl, dl
je 0x42fb78
cmp edi, eax
mov dword [0x945ae4], edi
jne 0x42fb17
jmp 0x42fba5
mov dword [0x945ae4], edi
shl eax, 8
pop edi
pop esi
mov byte [eax + 0xa0a300], 0x5d
pop ebp
mov byte [eax + 0xa0a301], 0
mov dword [0xa0a2e0], 1
pop ebx
ret
cmp ebx, 0x96
je 0x42fdf0
cmp ebx, 0xef
je 0x42fdf0
cmp ebx, 0x95
je 0x42fdde
cmp ebx, 0xf0
je 0x42fdde
cmp ebx, 0x97
jne 0x42fc0f
mov ecx, dword [0xc374cc]
pop edi
dec ecx
pop esi
pop ebp
mov dword [0xc374d0], ecx
pop ebx
ret
cmp ebx, 0x98
jne 0x42fc26
pop edi
pop esi
pop ebp
mov dword [0xc374d0], 0
pop ebx
ret
cmp ebx, 0x56
je 0x42fc34
cmp ebx, 0x76
jne 0x42fd45
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x42fd45
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42fd45
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x14], ebp
je 0x42fd3a
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x42fd33
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalSize]
inc eax
push eax
call fcn.0048c20c
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x4a074c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0048d49d
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0xa0a2e0]
not ecx
dec ecx
mov edx, ecx
lea ecx, [eax + edx]
cmp ecx, 0x100
jl 0x42fcdc
mov edx, 0x100
sub edx, eax
test edx, edx
jle 0x42fd2a
mov byte [edx + ebx], 0
mov ebp, dword [0x945ae0]
shl ebp, 8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add ebp, 0xa0a300
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0xa0a2e0]
mov ecx, ebp
mov ebp, dword [esp + 0x14]
and ecx, 3
add eax, edx
rep movsb byte es:[edi], byte [esi]
mov dword [0xa0a2e0], eax
push ebx
call fcn.0048c280
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ebx, 0x20
jl 0x42fdf7
cmp ebx, 0x7f
jg 0x42fdf7
mov edx, dword [0xa0a2e0]
cmp edx, 0xff
jge 0x42fdf7
mov eax, dword [0xa096a0]
mov ebp, dword [0x945ae0]
test eax, eax
je 0x42fdb3
mov esi, ebp
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
lea edi, [esi + 0xa0a300]
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
cmp ecx, 0xfe
jne 0x42fd9c
mov ecx, 0xfd
cmp ecx, edx
jl 0x42fdb3
mov al, byte [esi + ecx + 0xa0a300]
mov byte [esi + ecx + 0xa0a301], al
dec ecx
cmp ecx, edx
jge 0x42fda0
shl ebp, 8
mov eax, ebp
inc edx
mov dword [0xa0a2e0], edx
movsx ecx, byte [eax + edx + 0xa0a2ff]
mov byte [eax + edx + 0xa0a2ff], bl
test ecx, ecx
jne 0x42fdf7
pop edi
pop esi
pop ebp
mov byte [eax + edx + 0xa0a300], cl
pop ebx
ret
mov eax, dword [0xc374d0]
pop edi
sub eax, 2
pop esi
pop ebp
mov dword [0xc374d0], eax
pop ebx
ret
add dword [0xc374d0], 2
pop edi
pop esi
pop ebp
pop ebx
ret