Function at 0x401340
Capabilities:
Execute command
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x3b4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x3b0], eax
push ebx
push esi
push edi
push str.FLYFF
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, eax
mov dword [esp + 0x4c], ebx
test ebx, ebx
je 0x401603
push str.Ventana_Encontrada___Magia_Activada_n
call fcn.00401300
add esp, 4
lea eax, [esp + 0x54]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [esp + 0x54]
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x401610
push dword [esp + 0x54]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x220
mov esi, eax
lea eax, [esp + 0x78]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_Module32Next]
lea eax, [esp + 0x7c]
add esp, 0xc
mov dword [esp + 0x70], 0x224
push eax
push esi
call ebx
test eax, eax
je 0x401439
nop word [eax + eax]
mov ecx, str.Neuz.exe
lea eax, [esp + 0x90]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401420
test dl, dl
je 0x40141c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401420
add eax, 2
add ecx, 2
test dl, dl
jne 0x401400
xor eax, eax
jmp 0x401425
sbb eax, eax
or eax, 1
test eax, eax
je 0x4015f7
lea eax, [esp + 0x70]
push eax
push esi
call ebx
test eax, eax
jne 0x4013f0
xor edx, edx
lea eax, [edx + 0x847bf8]
mov dword [esp + 0x58], edi
mov dword [esp + 0x64], eax
lea ecx, [edx + 0x87235c]
lea eax, [edx + 0x8483e0]
mov dword [esp + 0x60], ecx
push 0
push 4
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
lea eax, [esp + 0x50]
push eax
push ecx
push edi
mov dword [esp + 0x64], 0
mov dword [esp + 0x5c], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [esp + 0x58]
push eax
mov eax, dword [esp + 0x54]
add eax, 0x20
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 4
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0
push eax
push dword [esp + 0x6c]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [esp + 0x50]
push eax
mov eax, dword [esp + 0x54]
add eax, 0x20
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [esp + 0x48], 0
jne 0x4015ee
lea eax, [esp + 0x298]
push eax
lea ecx, [esp + 0x5c]
call section..text
cmp dword [esp + 0x298], 0
mov edi, dword [esp + 0x58]
je 0x4015b6
movss xmm0, dword [esp + 0x2a8]
lea eax, [esp + 0x2b4]
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push dword [esp + 0x2b8]
push dword [esp + 0x2b8]
push eax
push str.seleccionando_objeto:_n_tnombre:__s_n_tlvl:__d_n_thp:__d_n_thyp:__f_n
call fcn.00401300
mov eax, dword [esp + 0x2b0]
add esp, 0x18
mov dword [esp + 0x50], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0
push 0
push 4
push eax
push dword [esp + 0x6c]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [esp + 0x58]
push eax
mov eax, dword [esp + 0x54]
add eax, 0x20
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x32
call esi
push 0
push 0x31
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x31
push 0x100
push dword [esp + 0x58]
call ebx
push 0x32
call esi
push 0
push 0x31
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x31
push 0x101
push dword [esp + 0x58]
call ebx
push 0x32
call esi
push 0
push 0x27
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x27
push 0x100
push dword [esp + 0x58]
call ebx
push 0x32
call esi
push 0
push 0x27
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x27
push 0x101
push dword [esp + 0x58]
call ebx
push 0x14
call esi
jmp 0x4014a6
mov edx, dword [esp + 0x84]
jmp 0x40143b
push str.Ventana_No_Encontrada___Magia_No_Activada_n
call fcn.00401300
add esp, 4
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [esp + 0x3c0]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401635
mov esp, ebp
pop ebp
ret