Function at 0x1005ab00
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
cmp ebx, 1
jne 0x1005ac00
test dword [0x1014b4cc], 0x100
je 0x1005ab5e
push dword [edi + 0x4c]
cmp byte [edi + 0xe8], 0
mov ecx, 0x1010ca30
push dword [edi + 0x54]
mov eax, str._arrow_
cmove eax, ecx
push eax
push dword [edi + 0xe4]
push str.End_Hover__hover_d_s__hot_d__submenu_d
call fcn.1003bea0
add esp, 0x14
mov ecx, dword [edi + 0xe4]
test ecx, ecx
js 0x1005b2a7
mov edx, ecx
cmp ecx, dword [edi + 0x4c]
je 0x1005abd7
cmp ecx, dword [edi + 0x1c4]
je 0x1005abd7
cmp ecx, dword [edi + 0x54]
jne 0x1005abd7
mov al, byte [edi + 0xe8]
cmp al, byte [edi + 0x5d]
jne 0x1005abd7
cmp byte [0x1014b502], 0
jne 0x1005abd7
cmp dword [edi + 0x1b0], 1
jg 0x1005abd7
cmp ecx, dword [edi + 0x1c0]
jne 0x1005abba
mov eax, dword [edi + 0x1b8]
push dword [eax + 8]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [edi + 0xe4]
push 0
push 0
push 1
push ecx
mov ecx, edi
call fcn.10040810
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [edi + 0xe4]
mov dword [edi + 0x50], eax
cmp edx, dword [edi + 0x1bc]
jne 0x1005abe6
mov byte [edi + 0x195], 1
push 1
mov dword [edi + 0xe4], 0xffffffff
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x1005b2a7
mov esi, dword [sym.imp.USER32.dll_KillTimer]
cmp ebx, 2
je 0x1005ac16
cmp ebx, 3
jne 0x1005adb1
jmp 0x1005ac30
cmp byte [0x1014b503], 0
je 0x1005ac30
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1005b2a7
cmp byte [edi + 0x30], 0
mov ecx, str.SubMenuScrollSpeed
mov esi, dword [0x1014e914]
mov eax, str.MainMenuScrollSpeed
cmove ecx, eax
mov dword [ebp - 0x84c], ecx
cmp dword [esi], 0
je 0x1005ac86
mov eax, dword [esi + 4]
cmp eax, 2
je 0x1005ac69
cmp eax, 3
je 0x1005ac69
cmp eax, 4
je 0x1005ac69
cmp eax, 5
jne 0x1005ac7e
push ecx
push dword [esi]
call fcn.100dc721
add esp, 8
test eax, eax
je 0x1005ac94
mov ecx, dword [ebp - 0x84c]
add esi, 0x60
cmp dword [esi], 0
jne 0x1005ac52
xor esi, esi
cmp esi, 1
jge 0x1005acaf
mov esi, 1
jmp 0x1005acb9
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov esi, dword [esi + 0x40]
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
jmp 0x1005ac88
mov eax, 0x14
cmp esi, eax
cmovg esi, eax
cmp byte [edi + 0x18c], 0
je 0x1005ad03
cmp byte [edi + 0x18e], 0
je 0x1005ad03
xor ecx, ecx
mov eax, 0xa68
cmp byte [edi + 0x30], cl
cmovne ecx, eax
mov eax, 0x2aaaaaab
mov ecx, dword [ecx + 0x1014c288]
imul ecx, esi
mov esi, dword [edi + 0x180]
imul ecx
mov ecx, 0
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
sub edx, eax
cmovns ecx, edx
jmp 0x1005ad6d
cmp byte [edi + 0x18d], 0
je 0x1005adab
cmp byte [edi + 0x18f], 0
je 0x1005adab
xor ecx, ecx
mov eax, 0xa68
cmp byte [edi + 0x30], cl
cmovne ecx, eax
mov eax, 0x2aaaaaab
mov ecx, dword [ecx + 0x1014c288]
imul ecx, esi
mov esi, dword [edi + 0x180]
imul ecx
imul ecx, dword [edi + 0x178], 0x54
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [edi + 0xa0]
add edx, esi
mov eax, dword [ecx + eax - 0x28]
mov ecx, edx
sub eax, dword [edi + 0x17c]
sub eax, dword [edi + 0x120]
cmp edx, eax
cmovg ecx, eax
cmp esi, ecx
je 0x1005adab
mov dword [edi + 0x180], ecx
mov ecx, edi
call fcn.10058e40
cmp byte [edi + 0x18c], 0
mov esi, dword [sym.imp.USER32.dll_KillTimer]
jne 0x1005ad9c
cmp byte [edi + 0x18d], 0
jne 0x1005ad9c
push ebx
push dword [edi + 0xc]
call esi
push 1
push 0
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x1005adb1
mov esi, dword [sym.imp.USER32.dll_KillTimer]
cmp ebx, 4
jne 0x1005b0a3
push ebx
push dword [edi + 0xc]
call esi
mov edx, dword [0x1014b5dc]
test edx, edx
je 0x1005b2a7
cmp byte [edx + 0x31], 0
jne 0x1005b2a7
cmp edx, dword [0x1014b5d4]
jne 0x1005b2a7
mov esi, dword [0x1014b5e0]
cmp esi, dword [0x1014b5d8]
jne 0x1005b2a7
mov eax, dword [0x1014c064]
mov ecx, dword [0x1014c068]
cmp eax, ecx
je 0x1005b2a7
nop dword [eax]
cmp dword [eax], edx
je 0x1005ae20
add eax, 4
cmp eax, ecx
jne 0x1005ae10
jmp 0x1005b2a7
cmp eax, ecx
je 0x1005b2a7
mov ecx, dword [edx + 0xa4]
mov eax, 0x30c30c31
sub ecx, dword [edx + 0xa0]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jge 0x1005b2a7
cmp byte [edi + 0x30], 0
jne 0x1005ae69
cmp dword [0x1014b4d4], 2
jne 0x1005ae69
cmp byte [0x1014c070], 0
jne 0x1005b2a7
xor eax, eax
mov dword [ebp - 0x848], 0x30
cmp byte [0x1014b4f3], al
xorps xmm0, xmm0
push ecx
setne al
movq qword [ebp - 0x820], xmm0
movups xmmword [ebp - 0x840], xmm0
mov dword [ebp - 0x83c], 1
movups xmmword [ebp - 0x830], xmm0
lea eax, [eax*4 + 0x1a0]
mov dword [ebp - 0x844], eax
lea eax, [ebp - 0x808]
push eax
push ecx
call fcn.1005dc70
test al, al
je 0x1005b2a7
mov ecx, dword [0x1014b5dc]
lea eax, [ebp - 0x818]
push eax
push dword [0x1014b5e0]
call fcn.10059640
push 2
lea eax, [ebp - 0x818]
push eax
mov eax, dword [0x1014b5dc]
push 0
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_MapWindowPoints]
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx esi, ax
shr eax, 0x10
movsx ebx, ax
lea eax, [ebp - 0x818]
push ebx
push esi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x1005af1f
add esi, 8
add ebx, 0x10
jmp 0x1005af4a
mov eax, dword [0x1014b5dc]
test dword [eax + 0x3c], 0x400000
jne 0x1005b2a7
mov eax, dword [ebp - 0x810]
add eax, dword [ebp - 0x818]
mov ebx, dword [ebp - 0x80c]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
lea eax, [ebp - 0x808]
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x848]
push eax
push 0
push 0x439
push dword [0x1014c168]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, bx
mov eax, esi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push 0
push 0x412
push dword [0x1014c168]
call ebx
lea eax, [ebp - 0x848]
push eax
push 1
push 0x411
push dword [0x1014c168]
call ebx
lea eax, [ebp - 0x818]
push eax
push dword [0x1014c168]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x818]
xor edx, edx
mov ebx, dword [0x1014b518]
xor ecx, ecx
cmp eax, ebx
jge 0x1005afda
mov edx, ebx
sub edx, eax
mov eax, dword [ebp - 0x810]
mov ebx, dword [0x1014b520]
add eax, edx
cmp eax, ebx
jle 0x1005aff4
sub ebx, dword [ebp - 0x810]
add edx, ebx
mov eax, dword [ebp - 0x814]
mov ebx, dword [0x1014b51c]
cmp eax, ebx
jge 0x1005b008
mov ecx, ebx
sub ecx, eax
mov eax, dword [ebp - 0x80c]
mov ebx, dword [0x1014b524]
add eax, ecx
cmp eax, ebx
jle 0x1005b022
sub ebx, dword [ebp - 0x80c]
add ecx, ebx
test edx, edx
jne 0x1005b02a
test ecx, ecx
je 0x1005b054
mov eax, dword [ebp - 0x84c]
add eax, ecx
movzx ecx, ax
lea eax, [edx + esi]
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push 0
push 0x412
push dword [0x1014c168]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1014b5dc]
imul ecx, dword [0x1014b5e0], 0x54
mov eax, dword [eax + 0xa0]
test byte [eax + ecx + 0x30], 1
je 0x1005b08b
cmp dword [eax + ecx], 0x26
je 0x1005b08b
push 0
push dword [0x1014b5e4]
push 5
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1005b2a7
push 0
push dword [0x1014b5ec]
push 5
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1005b2a7
cmp ebx, 5
jne 0x1005b104
lea eax, [ebp - 0x848]
mov dword [ebp - 0x848], 0x30
push eax
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x844], 0x1a0
push 0x411
push dword [0x1014c168]
movups xmmword [ebp - 0x840], xmm0
mov dword [ebp - 0x83c], 1
movups xmmword [ebp - 0x830], xmm0
movq qword [ebp - 0x820], xmm0
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push dword [edi + 0xc]
call esi
jmp 0x1005b2a7
cmp ebx, 6
jne 0x1005b15a
push 0x2c
lea eax, [ebp - 0x844]
mov dword [ebp - 0x848], 0x30
push 0
push eax
call fcn.100d6eb0
mov eax, dword [0x1014c16c]
add esp, 0xc
mov dword [ebp - 0x83c], 1
test eax, eax
je 0x1005b14e
lea ecx, [ebp - 0x848]
push ecx
push 0
push 0x411
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 6
push dword [edi + 0xc]
call esi
jmp 0x1005b2a7
cmp ebx, 7
jne 0x1005b172
push ecx
mov ecx, edi
call fcn.1005a500
push ebx
push dword [edi + 0xc]
call esi
jmp 0x1005b2a7
cmp ebx, 8
jne 0x1005b2a7
cmp byte [0x1014b4ea], 0
jne 0x1005b2a7
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
test eax, eax
je 0x1005b1c3
push 2
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
test eax, eax
je 0x1005b1c3
push 0x100
lea ecx, [ebp - 0x208]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
jmp 0x1005b1cc
xor eax, eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x208]
push str.OpenShell.CMenuContainer
push eax
call fcn.100dc721
add esp, 8
test eax, eax
je 0x1005b29b
call dword [sym.imp.USER32.dll_GetMessageTime]
mov esi, dword [0x1014e914]
mov ebx, eax
sub ebx, dword [edi + 0xd8]
cmp dword [esi], 0
je 0x1005b233
mov eax, dword [esi + 4]
cmp eax, 2
je 0x1005b218
cmp eax, 3
je 0x1005b218
cmp eax, 4
je 0x1005b218
cmp eax, 5
jne 0x1005b22b
push str.DragHideDelay
push dword [esi]
call fcn.100dc721
add esp, 8
test eax, eax
je 0x1005b280
add esi, 0x60
cmp dword [esi], 0
jne 0x1005b201
xor esi, esi
cmp ebx, esi
jle 0x1005b2a7
mov esi, dword [0x1014c064]
mov ecx, dword [0x1014c068]
cmp esi, ecx
je 0x1005b26c
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
nop
mov eax, dword [esi]
cmp byte [eax + 0x31], 0
jne 0x1005b265
push 0
push dword [eax + 0xc]
call ebx
mov ecx, dword [0x1014c068]
add esi, 4
cmp esi, ecx
jne 0x1005b250
push 8
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_KillTimer]
mov byte [0x1014b4ea], 1
jmp 0x1005b2a7
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov esi, dword [esi + 0x40]
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
jmp 0x1005b235
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [edi + 0xd8], eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d4906
mov esp, ebp
pop ebp
ret 0x10