Function at 0x4bdf87
Capabilities:
Enumerate gui resources
Hide graphical window
Log keystrokes

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.005423e0
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xffffffff
jne 0x4bdfaf
mov dword [esp + 0x1c], 8
push 0x2ee
call sub.KERNEL32.dll_Sleep
mov byte [0x72a82d], 0
lea ebp, [0x72ab4c]
cmp dword [ebp], 0
je 0x4be067
call fcn.00533746
mov ebx, eax
cmp ebx, 0xf
jne 0x4be007
push 1
push 0
call fcn.005336ff
push 0
call fcn.005336cf
push 0
push 0
call fcn.005336ff
mov eax, 1
push eax
call fcn.0042dbd7
jmp 0x4be062
push 1
push 0xf
call fcn.005336ff
push 0xf
call fcn.005336cf
push 0
push 0xf
call fcn.005336ff
lea ebp, [0x72ab4c]
cmp dword [ebp], 0
je 0x4be04e
lea ebp, [0x72ad80]
cmp dword [ebp + 0x28], 0
je 0x4be04e
mov eax, 1
jmp 0x4be050
xor eax, eax
and eax, eax
je 0x4be062
lea ebp, [0x72a850]
push dword [ebp + 0x20]
call sub.USER32.dll_SetForegroundWindow
jmp 0x4be43d
call sub.USER32.dll_GetForegroundWindow
mov dword [esp + 4], eax
lea ebp, [0x72ab68]
mov ebx, dword [ebp + 0x78]
and ebx, ebx
jne 0x4be091
lea ebp, [0x72abe8]
mov ebx, dword [ebp + 0x1c]
and ebx, ebx
jne 0x4be091
mov eax, 1
jmp 0x4be093
xor eax, eax
and eax, eax
je 0x4be0fa
mov ebx, dword [esp + 4]
lea ebp, [0x72a850]
cmp ebx, dword [ebp]
je 0x4be0b7
mov ebx, dword [esp + 4]
lea ebp, [0x72a850]
cmp ebx, dword [ebp + 0x28]
je 0x4be0b7
jmp 0x4be0be
mov eax, 1
jmp 0x4be0c0
xor eax, eax
and eax, eax
je 0x4be0f5
lea ebp, [0x72a850]
cmp dword [ebp + 0x28], 0
je 0x4be0e5
push 0x2fb
call fcn.005287cc
and eax, eax
je 0x4be0e5
mov eax, 1
jmp 0x4be0e7
xor eax, eax
and eax, eax
je 0x4be0f1
mov byte [esp], 2
jmp 0x4be0f5
mov byte [esp], 1
jmp 0x4be229
lea ebp, [0x72abe8]
mov dword [ebp + 0x1c], 0
lea ebp, [0x72a850]
mov dword [ebp + 0x88], 0
lea ebp, [0x72ab68]
push dword [ebp]
call fcn.004d9213
and eax, eax
je 0x4be229
push 0
lea eax, [0x461583]
push eax
call sub.USER32.dll_EnumWindows
mov ebx, dword [esp + 4]
lea ebp, [0x72a850]
cmp ebx, dword [ebp + 0x88]
jne 0x4be1d7
push 0
lea ebp, [0x72a850]
push dword [ebp + 0x38]
call sub.USER32.dll_GetWindowThreadProcessId
mov dword [esp + 8], eax
push 0
lea ebp, [0x72a850]
push dword [ebp + 0x88]
call sub.USER32.dll_GetWindowThreadProcessId
mov dword [esp + 0xc], eax
push 1
push dword [esp + 0xc]
push dword [esp + 0x14]
call sub.USER32.dll_AttachThreadInput
lea ebp, [0x72a850]
cmp dword [ebp + 0x28], 0
je 0x4be1c5
push 0xa3
call fcn.004b03dd
and eax, eax
je 0x4be1b5
xor eax, eax
jmp 0x4be1ba
mov eax, 1
and eax, eax
je 0x4be1c5
mov eax, 1
jmp 0x4be1c7
xor eax, eax
and eax, eax
je 0x4be1d1
mov byte [esp], 1
jmp 0x4be1d5
mov byte [esp], 2
jmp 0x4be229
mov ebx, dword [esp + 4]
lea ebp, [0x72a850]
cmp ebx, dword [ebp + 0x88]
je 0x4be1fa
mov ebx, dword [esp + 4]
lea ebp, [0x72a850]
cmp ebx, dword [ebp]
je 0x4be1fa
jmp 0x4be201
mov eax, 1
jmp 0x4be203
xor eax, eax
and eax, eax
jne 0x4be218
mov ebx, dword [esp + 4]
lea ebp, [0x72a850]
cmp ebx, dword [ebp + 0x28]
je 0x4be218
jmp 0x4be21f
mov eax, 1
jmp 0x4be221
xor eax, eax
and eax, eax
je 0x4be229
mov byte [esp], 3
movsx ebx, byte [esp]
push ebx
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4be2c8
lea ebp, [0x72a850]
cmp dword [ebp + 0x28], 0
je 0x4be263
push 0x11
call fcn.005339a6
mov ebx, eax
cmp ebx, 0x20000000
jne 0x4be263
mov eax, 1
jmp 0x4be265
xor eax, eax
and eax, eax
je 0x4be274
mov eax, 1
push eax
call fcn.00484c6b
push dword [esp + 0x20]
lea ebp, [0x72a850]
push dword [ebp + 0x28]
call sub.USER32.dll_ShowWindow
lea ebp, [0x72a850]
push dword [ebp + 0x28]
call sub.USER32.dll_SetForegroundWindow
push 0
push 2
push 0x86
lea ebp, [0x72a850]
push dword [ebp + 0x28]
call sub.USER32.dll_SendMessageW
push 0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.USER32.dll_AttachThreadInput
jmp 0x4be43c
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4be389
push 1
push 0
call fcn.005336ff
lea ebp, [0x72a850]
cmp dword [ebp + 0x28], 0
je 0x4be300
push 1
push 0x11
call fcn.005336ff
push dword [esp + 0x20]
lea ebp, [0x72a850]
push dword [ebp]
call sub.USER32.dll_ShowWindow
lea ebp, [0x72a850]
push dword [ebp]
call sub.USER32.dll_SetForegroundWindow
push 0
push 2
push 0x86
lea ebp, [0x72a850]
push dword [ebp]
call sub.USER32.dll_SendMessageW
push 0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.USER32.dll_AttachThreadInput
lea ebp, [0x72a850]
cmp dword [ebp + 0x28], 0
je 0x4be36a
push 0
push 0x11
call fcn.005336ff
push 0
push 0
call fcn.005336ff
mov eax, 1
push eax
call fcn.0042dbd7
jmp 0x4be43c
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4be43c
lea ebp, [0x72a850]
cmp dword [ebp + 0x28], 0
je 0x4be3be
push 0x11
call fcn.005339a6
mov ebx, eax
cmp ebx, 0x20000000
jne 0x4be3be
mov eax, 1
jmp 0x4be3c0
xor eax, eax
and eax, eax
je 0x4be3e9
xor eax, eax
push eax
call fcn.00484c6b
push 0
push 2
push 0x86
lea ebp, [0x72a850]
push dword [ebp + 0x28]
call sub.USER32.dll_SendMessageW
lea ebp, [0x72abe8]
mov dword [ebp + 4], 1
push dword [esp + 0x20]
lea ebp, [0x72a850]
push dword [ebp + 0x88]
call sub.USER32.dll_ShowWindow
lea ebp, [0x72a850]
push dword [ebp + 0x88]
call sub.USER32.dll_SetForegroundWindow
push 0
push 2
push 0x86
lea ebp, [0x72a850]
push dword [ebp + 0x88]
call sub.USER32.dll_SendMessageW
pop eax
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
ret 4