Function at 0x46c463
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
mov eax, 0x2004
call fcn.00483980
push ebp
mov ebp, dword [esp + 0x200c]
push edi
xor edi, edi
cmp ebp, edi
jne 0x46c483
xor eax, eax
jmp 0x46c769
push ebx
push 0x14
call dword [sym.imp.NSCRT.dll_malloc]
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x46c4b8
push 0x14
push edi
push ebx
call sub.NSCRT.dll_memset
add esp, 0xc
push ebx
push str.SecurityPromptProp
push esi
call dword [sym.imp.USER32.dll_SetPropW]
test eax, eax
jne 0x46c4b8
push ebx
call dword [sym.imp.NSCRT.dll_free]
pop ecx
push edi
push esi
call dword [sym.imp.USER32.dll_GetSystemMenu]
cmp eax, edi
mov dword [esp + 0xc], eax
je 0x46c4e3
mov ebx, dword [sym.imp.USER32.dll_DeleteMenu]
push edi
push 0xf060
push eax
call ebx
push edi
push 0xf000
push dword [esp + 0x14]
call ebx
push 0x7f03
push edi
push esi
call fcn.0046ba98
push dword [ebp]
push esi
call fcn.0046ba10
mov eax, dword [ebp + 4]
add esp, 0x14
cmp eax, edi
je 0x46c53f
test eax, 0xffff0000
jne 0x46c52e
push 0x1000
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0x4ac3b8]
push eax
push dword [0x4adbd0]
push dword [0x4adbd4]
push edi
push 0xb
call fcn.004700d7
cmp eax, edi
je 0x46c53f
cmp word [eax], di
je 0x46c53f
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x4d5
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, edi
mov dword [esp + 0xc], eax
je 0x46c5c8
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x46c589
test ebx, 0xffff0000
jne 0x46c589
mov ecx, dword [0x4ac3b8]
push 0x1000
lea eax, [esp + 0x14]
push eax
push ebx
push dword [0x4adbd0]
push dword [0x4adbd4]
push edi
push 0xb
call fcn.004700d7
mov ebx, eax
push esi
call fcn.0046c3b3
cmp eax, edi
pop ecx
je 0x46c5a2
push edi
push eax
push 0x30
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp ebx, edi
je 0x46c5bb
cmp word [ebx], di
je 0x46c5bb
push 8
pop eax
jmp 0x46c5bd
xor eax, eax
push eax
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x56b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, edi
mov dword [esp + 0xc], eax
je 0x46c638
mov ebx, dword [ebp + 0xc]
cmp ebx, edi
je 0x46c612
test ebx, 0xffff0000
jne 0x46c612
mov ecx, dword [0x4ac3b8]
push 0x1000
lea eax, [esp + 0x14]
push eax
push ebx
push dword [0x4adbd0]
push dword [0x4adbd4]
push edi
push 0xb
call fcn.004700d7
mov ebx, eax
push ebx
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp ebx, edi
je 0x46c62b
cmp word [ebx], di
je 0x46c62b
push 8
pop eax
jmp 0x46c62d
xor eax, eax
push eax
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x4ac3b8]
push 0x1000
lea eax, [esp + 0x14]
push eax
push 0x1a8
push dword [0x4adbd0]
push dword [0x4adbd4]
push edi
push 0xb
call fcn.004700d7
push edi
push dword [0x4b0600]
lea eax, [esp + 0x18]
push 0x2710
push esi
push edi
push edi
push edi
push edi
push 0x50010018
push eax
push str.NullsoftCommandLink
push 4
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, edi
mov dword [esp + 0xc], eax
mov ebx, 0x56c
je 0x46c6cc
push ebx
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, edi
je 0x46c6b3
push 0x13
push edi
push edi
push edi
push edi
push eax
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
push edi
push edi
push 0x31
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0x30
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x10]
shr eax, 0xd
and eax, 1
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_CheckDlgButton]
push esi
call fcn.0046bd6f
push dword [ebp]
push esi
call fcn.0046b99b
add esp, 0xc
push edi
push edi
push 0x402
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push edi
push esi
call ebx
push edi
push esi
mov ebp, eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call ebx
cmp ebp, eax
je 0x46c72a
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x569
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
cmp ebx, edi
je 0x46c766
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0x18000000
cmp eax, 0x10000000
jne 0x46c766
push 1
push ebx
push 0x28
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x46c766
xor eax, eax
inc eax
jmp 0x46c768
xor eax, eax
pop ebx
pop edi
pop ebp
add esp, 0x2004
ret