Function at 0x44e010
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
sub esp, 0x38
push ebx
push ebp
mov ebx, ecx
mov ecx, dword [esp + 0x44]
push esi
push edi
mov dword [esp + 0x14], ebx
call fcn.0044d1f0
mov ebp, eax
test ebp, ebp
je 0x44e3e4
push dword [esp + 0x64]
push dword [esp + 0x64]
push dword [esp + 0x64]
push dword [esp + 0x64]
call fcn.0043fd50
mov edi, eax
test edi, edi
je 0x44e3e4
mov esi, dword [esp + 0x54]
mov ecx, edi
mov edx, esi
call fcn.00475e50
mov ebx, eax
test ebx, ebx
je 0x44e3e0
lea eax, [ebp - 1]
cmp eax, 0x10
ja case.default.0x44e072
jmp dword [eax*4 + 0x44e78c]
lea eax, [esp + 0x4c]
push eax
push 0x7d0
push 2
push 0
push 0
push pe_nt_image_headers32
push ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
je 0x44e3e0
xor eax, eax
cmp ebp, 1
sete al
cmp dword [esp + 0x4c], eax
je case.default.0x44e072
push 0
push edi
mov byte [esp + 0x58], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
test ebp, ebp
je 0x44e0ec
cmp ebp, dword [0x4ae958]
je 0x44e0ec
mov ecx, edi
call fcn.00476330
test al, al
jne 0x44e0ec
push 1
push ebp
push dword [0x4ae958]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x50]
cmp edi, ebx
jne 0x44e0f9
mov ecx, ebx
call fcn.004762b0
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
jne 0x44e128
xor edx, edx
mov dword [esp + 0x24], eax
xor ecx, ecx
mov dword [esp + 0x1c], edx
xor esi, esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], esi
jmp 0x44e138
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
sub eax, edx
sub ecx, esi
cdq
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
sub eax, edx
sar eax, 1
movzx edi, ax
mov eax, ecx
cdq
sub eax, edx
shl edi, 0x10
sar eax, 1
movzx eax, ax
or edi, eax
push edi
push 1
push 0x201
push ebx
call esi
push edi
push 0
push 0x202
push ebx
call esi
cmp byte [esp + 0x50], 0
je case.default.0x44e072
push 0
push ebp
push dword [0x4ae958]
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp case.default.0x44e072
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x44e072
push 0
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x44e072
push 4
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x44e072
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x44e072
mov edi, dword [esp + 0x50]
cmp byte [edi], 0
jne 0x44e1de
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x1c
xor eax, eax
cmp ebp, 7
sete al
lea eax, [eax*4 - 0x14]
push eax
push ebx
mov dword [esp + 0x58], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
movsx edx, byte [edi]
mov ebp, eax
push edx
push 0x4a1ecc
call fcn.004855e4
add esp, 8
test eax, eax
jne 0x44e21b
mov ecx, edi
call fcn.004133c0
mov esi, eax
jmp 0x44e249
lea ecx, [edi + 1]
call fcn.004133c0
mov esi, eax
movsx eax, byte [edi]
sub eax, 0x2b
je 0x44e247
sub eax, 2
je 0x44e241
sub eax, 0x31
jne 0x44e23b
xor esi, ebp
jmp 0x44e249
mov esi, dword [esp + 0x50]
jmp 0x44e249
not esi
and esi, ebp
jmp 0x44e249
or esi, ebp
cmp esi, ebp
je 0x44e28f
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
mov esi, dword [esp + 0x54]
push esi
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
test eax, eax
jne 0x44e274
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44e3e0
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp eax, ebp
je 0x44e3e0
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
push 0xffffffffffffffff
push 0x49bca8
mov ecx, dword [0x4ad0c8]
call fcn.004744e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x1c
lea eax, [esp + 0x4c]
push eax
push 0x7d0
xor eax, eax
cmp ebp, 9
push 2
push 0
sete al
push eax
push 0x14f
jmp 0x44e73f
mov ecx, dword [esp + 0x50]
cmp byte [ecx], 0
je 0x44e2e2
call fcn.0040dd10
mov esi, eax
jmp 0x44e2e7
mov esi, 1
cmp ebp, 0xb
setne al
xor dl, dl
lea eax, [eax*2 + 0x25]
mov cl, al
mov dword [esp + 0x50], eax
call fcn.00412900
movzx edi, ax
shl edi, 0x10
test esi, esi
jle case.default.0x44e072
mov ecx, dword [esp + 0x50]
mov eax, edi
or eax, 1
movzx ebp, cl
mov dword [esp + 0x64], eax
or edi, 0xc0000001
push eax
push ebp
push 0x100
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edx, 1
mov dword [0x4aa1d0], 0
xor ecx, ecx
call fcn.00401790
push edi
push ebp
push 0x101
push ebx
mov dword [0x4aa1d0], 1
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x64]
dec esi
jne 0x44e325
jmp case.default.0x44e072
cmp byte [esi], 0
jne 0x44e384
push 0x20
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameA]
lea esi, [esp + 0x28]
mov edx, str.Combo
mov ecx, esi
call fcn.00471970
test eax, eax
je 0x44e39b
mov eax, 0x143
jmp 0x44e3b0
mov edx, str.List
mov ecx, esi
call fcn.00471970
test eax, eax
je 0x44e3e0
mov eax, 0x180
lea ecx, [esp + 0x4c]
push ecx
push 0x7d0
push 2
push dword [esp + 0x5c]
push 0
push eax
push ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
je 0x44e3e0
mov eax, dword [esp + 0x4c]
cmp eax, 0xffffffff
je 0x44e3e0
cmp eax, 0xfffffffe
jne case.default.0x44e072
mov ebx, dword [esp + 0x14]
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
jne 0x44e76e
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
jmp 0x44e29a
mov ecx, dword [esp + 0x50]
cmp byte [ecx], 0
je 0x44e3e0
call fcn.0040dd10
mov edi, eax
dec edi
js 0x44e3e0
cmp byte [esi], 0
jne 0x44e430
push 0x20
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameA]
lea esi, [esp + 0x28]
mov edx, str.Combo
mov ecx, esi
call fcn.00471970
test eax, eax
je 0x44e447
mov eax, 0x144
jmp 0x44e45c
mov edx, str.List
mov ecx, esi
call fcn.00471970
test eax, eax
je 0x44e3e0
mov eax, 0x182
lea ecx, [esp + 0x4c]
push ecx
push 0x7d0
push 2
push 0
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
je 0x44e3e0
cmp dword [esp + 0x4c], 0xffffffff
jmp 0x44e748
mov ecx, dword [esp + 0x50]
cmp byte [ecx], 0
je 0x44e3e0
call fcn.0040dd10
mov edi, eax
dec edi
js 0x44e3e0
cmp byte [esi], 0
jne 0x44e4b7
push 0x20
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameA]
lea esi, [esp + 0x28]
mov edx, str.Combo
mov ecx, esi
call fcn.00471970
test eax, eax
je 0x44e4d3
mov eax, 0x14e
mov ebp, 9
jmp 0x44e516
mov edx, str.List
mov ecx, esi
call fcn.00471970
test eax, eax
je 0x44e3e0
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebp, 2
test eax, 0x808
je 0x44e511
lea eax, [esp + 0x4c]
push eax
push 0x7d0
push ebp
push edi
push 1
push 0x185
jmp 0x44e526
mov eax, 0x186
lea ecx, [esp + 0x4c]
push ecx
push 0x7d0
push 2
push 0
push edi
push eax
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
push ebx
call esi
test eax, eax
je 0x44e3e0
cmp dword [esp + 0x4c], 0xffffffff
je 0x44e3e0
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
test edi, edi
je 0x44e3e0
push ebx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
test eax, eax
je 0x44e3e0
lea ecx, [esp + 0x4c]
movzx eax, ax
push ecx
push 0x7d0
push 2
push ebx
mov dword [esp + 0x60], eax
or eax, 0x10000
push eax
push 0x111
push edi
call esi
test eax, eax
je 0x44e3e0
lea eax, [esp + 0x4c]
push eax
push 0x7d0
push 2
movzx eax, bp
push ebx
shl eax, 0x10
or eax, dword [esp + 0x60]
push eax
push 0x111
push edi
call esi
jmp 0x44e746
cmp byte [esi], 0
jne 0x44e5c8
push 0x20
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameA]
lea esi, [esp + 0x28]
mov edx, str.Combo
mov ecx, esi
call fcn.00471970
test eax, eax
je 0x44e5e7
mov eax, 0x14d
mov edi, 9
jmp 0x44e673
mov edx, str.List
mov ecx, esi
call fcn.00471970
test eax, eax
je 0x44e3e0
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, 2
test eax, 0x808
je 0x44e66e
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [esp + 0x64]
push eax
push 0x7d0
push edi
push dword [esp + 0x5c]
push 0xffffffffffffffff
push 0x18f
push ebx
call esi
test eax, eax
je 0x44e3e0
mov eax, dword [esp + 0x64]
cmp eax, 0xffffffff
je 0x44e3e0
lea ecx, [esp + 0x4c]
push ecx
push 0x7d0
push edi
push eax
push 1
push 0x185
push ebx
call esi
test eax, eax
je 0x44e3e0
cmp dword [esp + 0x4c], 0xffffffff
jne 0x44e6a2
jmp 0x44e3e0
mov eax, 0x18c
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea ecx, [esp + 0x4c]
push ecx
push 0x7d0
push 2
push dword [esp + 0x5c]
push 0xffffffffffffffff
push eax
push ebx
call esi
test eax, eax
je 0x44e3e0
cmp dword [esp + 0x4c], 0xffffffff
je 0x44e3e0
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov ebp, eax
test ebp, ebp
je 0x44e3e0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [esp + 0x50], eax
test eax, eax
jne 0x44e6dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44e3e0
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x4c]
movzx eax, ax
push ecx
push 0x7d0
push 2
push ebx
mov dword [esp + 0x60], eax
or eax, 0x10000
push eax
push 0x111
push ebp
call esi
test eax, eax
je 0x44e3e0
lea eax, [esp + 0x4c]
push eax
push 0x7d0
push 2
movzx eax, di
push ebx
shl eax, 0x10
or eax, dword [esp + 0x60]
push eax
push 0x111
push ebp
call esi
jmp 0x44e746
lea eax, [esp + 0x4c]
push eax
push 0x7d0
push 2
push dword [esp + 0x5c]
push 1
push 0xc2
push ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
je 0x44e3e0
mov eax, dword [0x4aa1d8]
mov ecx, dword [eax + 0x58]
cmp ecx, 0xffffffff
jle 0x44e28f
mov edx, 1
call fcn.00401790
jmp 0x44e28f
push 0x49bc4d
push 0
push 0x49e628
mov ecx, ebx
call fcn.0042c8f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x1c