Function at 0x40dd60
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x26c
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x274]
push ebp
mov ebp, dword [esp + 0x280]
mov eax, dword [ebx + 0x6c]
push esi
mov esi, dword [esp + 0x288]
push edi
mov edi, dword [esp + 0x290]
cmp eax, ecx
je 0x40df96
cmp ebp, 0x5c20
ja 0x40de04
je 0x40dde9
cmp ebp, 7
je 0x40dddd
cmp ebp, 0x14
je 0x40e147
cmp ebp, 0xbd3
jne 0x40df96
cmp esi, 1
jne 0x40e26c
cmp edi, 2
jne 0x40e26c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26c
ret 0x14
mov ecx, ebx
call fcn.0040f0e0
jmp 0x40dfb3
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x28]
test eax, eax
je 0x40e26c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x58]
jmp 0x40e26c
cmp ebp, 0x5c23
je 0x40de24
cmp ebp, 0x6789
jne 0x40df96
mov ecx, ebx
call fcn.0040f000
jmp 0x40e26c
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x28]
test eax, eax
je 0x40e26c
mov eax, dword [0x5ef9c0]
test eax, eax
jne 0x40e26c
mov eax, dword [esp + 0x284]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
mov dword [esp + 0x1c], edi
je 0x40e26c
push 1
push 1
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
test esi, esi
mov dword [esp + 0x24], esi
je 0x40df7b
push esi
call fcn.004844d0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x40df6d
mov edx, dword [ebx + 4]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
xor edx, edx
push 0
mov dx, word [ebp + 0xe]
mov ecx, dword [esp + 0x34]
shr edx, 3
imul edx, ecx
mov eax, dword [esp + 0x38]
push 0
imul edx, eax
mov dword [ebp + 8], eax
lea eax, [esp + 0x20]
push eax
push 0
push ebp
push edi
mov dword [ebp + 4], ecx
mov dword [ebp + 0x14], edx
mov dword [esp + 0x30], 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
je 0x40df62
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
test eax, eax
mov dword [esp + 0x14], eax
je 0x40df5b
mov ecx, esi
mov esi, eax
push ecx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebx + 4]
push 0
push esi
push edx
mov dword [esp + 0x2c], eax
call fcn.004a64a0
mov eax, dword [esp + 0x24]
mov ecx, 0xb
mov esi, ebp
lea edi, [esp + 0x4c]
add esp, 0xc
lea edx, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x14]
push 0x3c
push 1
mov dword [esp + 0x78], ecx
push edx
push 0x5f
mov ecx, ebx
mov dword [esp + 0x7c], eax
call fcn.0040edf0
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [esp + 0x24]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebp, dword [esp + 0x288]
mov ecx, dword [esp + 0x284]
push edi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [esp + 0x28c]
jmp 0x40e26c
cmp ebp, 0x210
ja 0x40e1ab
je 0x40e159
cmp ebp, 0x21
ja 0x40e0ea
je 0x40e020
mov eax, ebp
dec eax
je 0x40e012
sub eax, 4
je 0x40dff8
sub eax, 0xb
jne 0x40e26c
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x40e482
push 1
push 0
mov ecx, ebx
call fcn.0040f190
push 0
push 0
push 0x12
mov ecx, ebx
call fcn.0040ed30
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x26c
ret 0x14
mov edx, dword [ebx]
mov eax, edi
shr eax, 0x10
and edi, 0xffff
push eax
push edi
push esi
mov ecx, ebx
call dword [edx + 0x38]
jmp 0x40e482
push ebx
lea ecx, [ebx + 0x74]
call fcn.004ab100
jmp 0x40e482
cmp eax, ecx
je 0x40e482
mov eax, dword [ebx + 0x5c]
mov ebp, 1
cmp eax, ebp
je 0x40e482
mov ecx, dword [ebx + 4]
push ecx
mov ecx, ebx
call fcn.0040f150
test eax, eax
jne 0x40e482
mov eax, dword [0x5b8070]
test eax, eax
je 0x40e0d0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x76]
mov word [esp + 0x74], 0
lea edx, [esp + 0x74]
rep stosd dword es:[edi], eax
push 0x104
push edx
push esi
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [esp + 0x74]
push str.DV2ControlHost
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x40e0d0
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40e0d0
push 0
push 0x1b
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, eax
push 0
push 0
push edi
push 0x1b
call esi
push 0
push 2
push edi
push 0x1b
call esi
mov ecx, ebx
call fcn.0040f1f0
mov ecx, dword [ebx + 4]
push 0
push ebx
push 0xbd1
push ecx
mov dword [ebx + 0x5c], ebp
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40e482
mov eax, ebp
sub eax, 0x111
je 0x40e128
sub eax, 2
jne 0x40e26c
cmp esi, 0x3000
jne 0x40e11b
mov edx, dword [ebx + 4]
push esi
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, ebx
call fcn.0040f1f0
jmp 0x40e482
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax + 0x34]
jmp 0x40e482
mov ecx, dword [esp + 0x290]
mov edx, dword [esp + 0x28c]
mov eax, dword [ebx + 0x28]
push ecx
push edx
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x26c
ret 0x14
mov eax, esi
and eax, 0xffff
sub eax, 2
je 0x40e180
sub eax, 0x1ff
jne 0x40e482
push 0x5ef9b0
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x40e482
mov edx, dword [ebx]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ecx
push edi
push esi
mov ecx, ebx
call dword [edx + 0x3c]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40e482
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26c
ret 0x14
cmp ebp, 0xbd2
ja 0x40e254
je 0x40e247
mov eax, ebp
sub eax, 0x319
je 0x40e224
sub eax, 0x8b7
je 0x40e218
dec eax
jne 0x40e26c
cmp esi, ebx
jne 0x40e482
mov dword [ebx + 0x5c], ecx
mov ecx, dword [ebx + 0x2c]
push ecx
mov ecx, ebx
call fcn.0040f150
test eax, eax
jne 0x40e20c
push 1
push 1
mov ecx, ebx
call fcn.0040f190
mov edx, dword [ebx + 4]
push 0
push 0x64
push 0x3000
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, ebx
call fcn.0040f090
jmp 0x40e482
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
jmp 0x40e482
mov edx, dword [ebx]
push edi
push esi
mov ecx, ebx
call dword [edx + 0x30]
test eax, eax
je 0x40e482
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x26c
ret 0x14
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x18]
jmp 0x40e482
cmp ebp, 0x4400
je 0x40e46c
cmp ebp, 0x5678
je 0x40e459
mov eax, dword [ebx + 0x58]
test eax, eax
jne 0x40e482
mov eax, dword [0x53adec]
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
test eax, eax
jne 0x40e29d
push str.PhoenixStudioTaiHang_Simple_Message
call edi
push 1
push eax
mov dword [0x53adec], eax
call fcn.004a6500
add esp, 8
cmp dword [0x53adec], ebp
je 0x40e431
mov eax, dword [0x53adf0]
test eax, eax
jne 0x40e2c9
push str.PhoenixStudioTaiHang_Struct_Message
call edi
push 1
push eax
mov dword [0x53adf0], eax
call fcn.004a6500
add esp, 8
cmp dword [0x53adf0], ebp
je 0x40e431
mov eax, dword [0x53adf8]
test eax, eax
jne 0x40e2f5
push str.PhoenixStudioTaiHang_Struct_Message_Direct
call edi
push 1
push eax
mov dword [0x53adf8], eax
call fcn.004a6500
add esp, 8
cmp dword [0x53adf8], ebp
jne 0x40e383
mov eax, dword [ebx + 0x68]
test eax, eax
je 0x40e356
mov eax, dword [0x53adf0]
test eax, eax
jne 0x40e328
push str.PhoenixStudioTaiHang_Struct_Message
call edi
push 1
push eax
mov dword [0x53adf0], eax
call fcn.004a6500
add esp, 8
mov ecx, dword [esp + 0x290]
mov edx, dword [0x53adf0]
mov eax, dword [esp + 0x284]
push ecx
push esi
push edx
push eax
mov ecx, ebx
call fcn.0040e4c0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x26c
ret 0x14
mov eax, dword [esp + 0x290]
mov edx, dword [ebx]
push eax
push esi
mov ecx, ebx
mov dword [ebx + 0x68], 1
call dword [edx + 0x44]
pop edi
pop esi
mov dword [ebx + 0x68], 0
pop ebp
xor eax, eax
pop ebx
add esp, 0x26c
ret 0x14
mov eax, dword [0x53adf4]
test eax, eax
jne 0x40e3a3
push str.PhoenixStudioTaiHang_Direct_Simple_Message
call edi
push 1
push eax
mov dword [0x53adf4], eax
call fcn.004a6500
add esp, 8
cmp dword [0x53adf4], ebp
jne 0x40e482
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x40e404
mov eax, dword [0x53adec]
test eax, eax
jne 0x40e3d6
push str.PhoenixStudioTaiHang_Simple_Message
call edi
push 1
push eax
mov dword [0x53adec], eax
call fcn.004a6500
add esp, 8
mov ecx, dword [esp + 0x290]
mov edx, dword [0x53adec]
mov eax, dword [esp + 0x284]
push ecx
push esi
push edx
push eax
mov ecx, ebx
call fcn.0040e4c0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x26c
ret 0x14
mov eax, dword [esp + 0x290]
mov edx, dword [ebx]
push eax
push esi
mov ecx, ebx
mov dword [ebx + 0x64], 1
call dword [edx + 0x40]
pop edi
pop esi
mov dword [ebx + 0x64], 0
pop ebp
xor eax, eax
pop ebx
add esp, 0x26c
ret 0x14
mov ecx, dword [esp + 0x290]
mov edx, dword [esp + 0x284]
push ecx
push esi
push ebp
push edx
mov ecx, ebx
call fcn.0040e4c0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x26c
ret 0x14
cmp esi, 1
jne 0x40e482
cmp edi, 2
jne 0x40e482
mov ecx, ebx
call fcn.0040e750
jmp 0x40e482
mov eax, dword [esp + 0x284]
neg esi
sbb esi, esi
and esi, 5
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x290]
mov edx, dword [esp + 0x28c]
mov eax, dword [esp + 0x288]
push ecx
mov ecx, dword [esp + 0x288]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26c
ret 0x14