Function at 0x404565
Capabilities:
Enumerate gui resources
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x37
call dword [sym.imp.USER32.dll_GetSystemMetrics]
dec eax
xor ebx, ebx
dec eax
cmp eax, dword [0x4069bc]
mov dword [ebp - 4], eax
je 0x4045d9
mov dword [0x4069bc], eax
mov eax, 0x154
push ebx
push 0x40669c
push eax
push 0x29
mov dword [0x40669c], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [0x4069b8]
cmp eax, ebx
je 0x4045b3
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x40673c
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov dword [0x4069b8], eax
push dword [0x4069b4]
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebp + 8], ebx
je 0x4049d3
test byte [ebp + 0x11], 4
mov edi, dword [sym.imp.USER32.dll_keybd_event]
je 0x40466f
push dword [0x406cc0]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x30
call esi
lea eax, [ebp - 8]
push eax
push fcn.004049d8
call dword [sym.imp.USER32.dll_EnumWindows]
push ebx
push ebx
push ebx
push 0x12
call edi
push ebx
push ebx
push ebx
push 0x57
call edi
push ebx
push 2
push ebx
push 0x57
call edi
push ebx
push 2
push ebx
push 0x12
call edi
push 0x60
call esi
lea eax, [ebp - 4]
push eax
push fcn.004049d8
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x40466f
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x40466f
mov eax, dword [ebp - 0x10]
add eax, 0xffffffee
push eax
mov eax, dword [ebp - 0x1c]
add eax, 0xc
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x4049d3
push dword [0x406cd4]
or dword [0x4069b0], 0xffffffff
call dword [sym.imp.USER32.dll_GetMenuItemCount]
dec eax
mov dword [ebp - 4], eax
js 0x40469f
push 0x400
push eax
push dword [0x406cd4]
call dword [sym.imp.USER32.dll_RemoveMenu]
mov eax, dword [ebp - 4]
jmp 0x404682
push 1
mov dword [0x40669c], ebx
mov dword [0x4069a4], ebx
mov dword [0x4069ac], ebx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [0x4069bc]
sub eax, 8
cdq
add ecx, 4
idiv ecx
or eax, dword [ebp + 0x10]
or eax, 0x80000000
push eax
mov dword [ebp - 8], eax
push dword [0x406cc0]
call fcn.004049d8
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
test ax, ax
jge 0x4046fa
push 0xd
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x11
jmp 0x4046e7
push dword [ebp - 8]
push fcn.004049d8
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x4069ac], ebx
jg 0x404720
push 0x1a
push 3
call fcn.00404c25
pop ecx
pop ecx
jmp 0x4049d3
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_mouse_event]
push ebx
push 2
push ebx
push ebx
call edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
movsx eax, word [ebp + 0xe]
movsx ecx, word [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
movsx eax, word [ebp + 0xe]
push ebx
push dword [ebp + 8]
push ebx
push eax
movsx eax, word [ebp + 0xc]
push eax
push 0x110
push dword [0x406cd4]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0x10
mov dword [ebp - 0xc], eax
call esi
movzx eax, ax
shr eax, 1
push 0x1b
mov dword [ebp + 0xc], eax
call esi
movzx eax, ax
or dword [ebp + 0xc], eax
push 0x11
shr dword [ebp + 0xc], 1
call esi
movzx ecx, ax
mov eax, dword [ebp + 0xc]
or eax, ecx
shr eax, 0xc
test byte [0x406c88], 4
mov dword [ebp - 8], eax
je 0x4047a8
mov dword [0x406cac], ebx
mov esi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 1
pop eax
mov dword [ebp + 0xc], ebx
cmp dword [0x4069ac], eax
mov dword [ebp - 4], eax
jl 0x40488f
cmp eax, dword [ebp - 0xc]
jne 0x4047cc
or dword [ebp - 8], 1
cmp dword [ebp - 8], ebx
lea ecx, [eax + eax*2]
je 0x404830
shl ecx, 2
cmp byte [ecx + 0x406698], bl
je 0x4047f0
push 8
push dword [ecx + 0x406690]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
mov eax, dword [ebp - 4]
lea eax, [eax + eax*2]
push 0xfffffffffffffff0
push dword [eax*4 + 0x406690]
call esi
test eax, 0x20000000
je 0x404878
test byte [ebp - 8], 3
je 0x404825
mov eax, dword [ebp - 4]
push 9
lea eax, [eax + eax*2]
push dword [eax*4 + 0x406690]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
inc dword [ebp + 0xc]
jmp 0x404878
test byte [ebp - 8], 8
mov eax, dword [ebp - 4]
jne 0x404839
jmp 0x40487b
cmp byte [ecx*4 + 0x406698], bl
je 0x40487b
lea eax, [eax + eax*2]
push 0xfffffffffffffff8
push dword [eax*4 + 0x406690]
call esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
lea eax, [eax + eax*2]
push dword [eax*4 + 0x406690]
call fcn.00403ca2
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1c], ebx
pop ecx
lea ecx, [eax + eax*2]
mov dword [ecx*4 + 0x406690], ebx
je 0x40487b
push dword [ebp - 0x1c]
call fcn.00403ca2
pop ecx
mov eax, dword [ebp - 4]
and dword [ebp - 8], 0xe
inc eax
cmp eax, dword [0x4069ac]
mov dword [ebp - 4], eax
jle 0x4047c3
mov al, byte [ebp - 0xc]
mov byte [0x4066a6], al
mov eax, dword [0x4069ac]
cmp eax, ebx
mov dword [ebp - 4], eax
jle 0x4049bd
lea ecx, [eax + eax*2]
mov cl, byte [ecx*4 + 0x40669a]
cmp cl, bl
je 0x4049b7
movsx eax, cl
push 0xfffffffffffffff0
lea eax, [eax + eax*2]
mov eax, dword [eax*4 + 0x406690]
push eax
mov dword [ebp - 0x1c], eax
call esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
lea ecx, [eax + eax*2]
mov byte [ecx*4 + 0x40669a], bl
mov ecx, dword [ebp - 0x18]
xor ecx, 0x10000000
test ecx, 0x30000000
je 0x404908
push 4
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
inc dword [ebp + 0xc]
push 0x30
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
cmp eax, 1
jne 0x4049a0
cmp dword [ebp + 0xc], ebx
jne 0x404991
cmp dword [ebp - 0xc], eax
jne 0x404991
test byte [ebp - 0x15], al
je 0x40492d
push 9
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
jmp 0x404991
test byte [ebp + 0x11], 0x20
je 0x404991
push 0xfffffffffffffff8
push dword [ebp - 0x1c]
call esi
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x404947
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
je 0x40496c
push 0xfffffffffffffff0
push eax
call esi
test eax, 0x10000000
mov dword [ebp - 0x14], eax
je 0x40496c
cmp eax, 0x96000000
jne 0x404965
mov dword [ebp - 0x18], ebx
cmp eax, 0x94000000
jne 0x40497e
push 2
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_GetWindow]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x404947
push dword [ebp - 0x1c]
call fcn.00403ca2
mov eax, dword [ebp - 0x18]
pop ecx
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x4049bd
push ebx
push 2
push ebx
push ebx
call edi
push 0x3d
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
inc dword [ebp + 0xc]
push 0x30
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
dec eax
jmp 0x40489c
push 2
push dword [0x406cc0]
push 0x800d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
leave
ret