Function at 0x4021b0
Capabilities:
Enumerate gui resources
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43316a
mov eax, dword fs:[0]
push eax
sub esp, 0x3c0
mov eax, dword [0x440080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 5
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
mov eax, 1
test eax, eax
je 0x402825
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
cmp eax, 0xffff8000
jne 0x402273
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x4f4fc1
je 0x402239
cmp dword [ebp - 0x4c], 0xff
jne 0x40226e
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 2
call dword [sym.imp.USER32.dll_mouse_event]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 4
call dword [sym.imp.USER32.dll_mouse_event]
nop
jmp 0x402820
push 0x70
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
cmp eax, 0xffff8000
jne 0x402458
push 1
push 0x40
push 1
mov ecx, dword [ebp + 0x20]
push ecx
lea ecx, [ebp - 0x104]
call fcn.00406d00
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x104]
call fcn.0040e5b0
movzx edx, al
test edx, edx
je 0x402423
lea ecx, [ebp - 0x28]
call fcn.004077e0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.004063c0
add esp, 8
mov dword [ebp - 0x44], 0
jmp 0x4022ea
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 4
jge 0x40235d
cmp dword [ebp - 0x44], 0
jne 0x40230e
lea ecx, [ebp - 0x28]
call fcn.0040bf30
push eax
call fcn.00416dee
add esp, 4
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x402348
cmp dword [ebp - 0x44], 1
jne 0x40232c
lea ecx, [ebp - 0x28]
call fcn.0040bf30
push eax
call fcn.00416dee
add esp, 4
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
jmp 0x402348
cmp dword [ebp - 0x44], 2
jne 0x402348
lea ecx, [ebp - 0x28]
call fcn.0040bf30
push eax
call fcn.00416dee
add esp, 4
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.004063c0
add esp, 8
jmp 0x4022e1
lea ecx, [ebp - 0x104]
call fcn.0040c120
push 1
push 0x40
push 2
mov ecx, dword [ebp + 0x20]
push ecx
lea ecx, [ebp - 0x31c]
call fcn.00407060
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x31c]
call fcn.0040e5d0
movzx edx, al
test edx, edx
je 0x402407
push 0x406180
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push ecx
push 0x406180
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
push eax
push 0x406180
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edx
push 0x406180
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x31c]
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
mov ecx, eax
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
mov ecx, eax
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
mov ecx, eax
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
lea ecx, [ebp - 0x31c]
call fcn.0040c160
nop
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x31c]
call fcn.00409480
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004087e0
nop
call fcn.00402840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x104]
call fcn.004093f0
nop
jmp 0x402825
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
cmp edx, 0xffff8000
jne 0x4026bd
push 0x71
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
cmp eax, 0xffff8000
jne 0x4026bd
push 1
push 0x40
push 2
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x26c]
call fcn.00407060
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x26c]
call fcn.0040e5d0
movzx edx, al
test edx, edx
je 0x4024d1
push 0x434220
lea eax, [ebp - 0x26c]
push eax
call fcn.00402d50
add esp, 8
lea ecx, [ebp - 0x26c]
call fcn.0040c160
nop
push 1
push 0x40
push 1
mov ecx, dword [ebp + 0x20]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.00406d00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1bc]
call fcn.0040e5b0
movzx edx, al
test edx, edx
je 0x40266a
lea ecx, [ebp - 0x40]
call fcn.004077e0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.004063c0
add esp, 8
mov dword [ebp - 0x48], 0
jmp 0x402531
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 4
jge 0x4025a4
cmp dword [ebp - 0x48], 0
jne 0x402555
lea ecx, [ebp - 0x40]
call fcn.0040bf30
push eax
call fcn.00416dee
add esp, 4
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x40258f
cmp dword [ebp - 0x48], 1
jne 0x402573
lea ecx, [ebp - 0x40]
call fcn.0040bf30
push eax
call fcn.00416dee
add esp, 4
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
jmp 0x40258f
cmp dword [ebp - 0x48], 2
jne 0x40258f
lea ecx, [ebp - 0x40]
call fcn.0040bf30
push eax
call fcn.00416dee
add esp, 4
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x1bc]
push eax
call fcn.004063c0
add esp, 8
jmp 0x402528
lea ecx, [ebp - 0x1bc]
call fcn.0040c120
push 1
push 0x40
push 2
mov ecx, dword [ebp + 0x20]
push ecx
lea ecx, [ebp - 0x3cc]
call fcn.00407060
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3cc]
call fcn.0040e5d0
movzx edx, al
test edx, edx
je 0x40264e
push 0x406180
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push ecx
push 0x406180
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
push eax
push 0x406180
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edx
push 0x406180
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x3cc]
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
mov ecx, eax
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
mov ecx, eax
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
mov ecx, eax
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
lea ecx, [ebp - 0x3cc]
call fcn.0040c160
nop
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3cc]
call fcn.00409480
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.004087e0
nop
call fcn.00402840
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1bc]
call fcn.004093f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.00409480
nop
jmp 0x402825
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
cmp edx, 0xffff8000
jne 0x4026f3
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
cmp eax, 0xffff8000
jne 0x4026f3
push 0
push 0x401ce0
call dword [sym.imp.USER32.dll_EnumWindows]
nop
jmp 0x402820
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
cmp ecx, 0xffff8000
jne 0x402762
push 0x26
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
cmp edx, 0xffff8000
jne 0x402762
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp + 0x1c]
mov dword [edx], ecx
push 0x406180
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push ecx
push 0x43428c
push 0x441360
call fcn.00402d50
add esp, 8
mov ecx, eax
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
nop
jmp 0x402820
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
cmp edx, 0xffff8000
jne 0x402820
push 0x28
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
cmp eax, 0xffff8000
jne 0x402820
mov ecx, dword [ebp + 0x1c]
cmp dword [ecx], 0
jg 0x4027d4
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x406180
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
push eax
push 0x4342a0
push 0x441360
call fcn.00402d50
add esp, 8
mov ecx, eax
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0
mov edx, dword [ebp + 0x1c]
cmp dword [edx], 0
jle 0x402820
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
sub ecx, 1
mov edx, dword [ebp + 0x1c]
mov dword [edx], ecx
push 0x406180
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push ecx
push 0x4342b8
push 0x441360
call fcn.00402d50
add esp, 8
mov ecx, eax
call fcn.00408de0
mov ecx, eax
call fcn.00408fa0
nop
jmp 0x4021eb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041145c
mov esp, ebp
pop ebp
ret