Function at 0x4bdfd2
Capabilities:
Enumerate gui resources
Hide graphical window
Log keystrokes

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.005423e0
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xffffffff
jne 0x4bdffa
mov dword [esp + 0x1c], 8
push 0x2ee
call sub.KERNEL32.dll_Sleep
mov byte [0x72a83d], 0
lea ebp, [0x72ab5c]
cmp dword [ebp], 0
je 0x4be0b2
call fcn.00533746
mov ebx, eax
cmp ebx, 0xf
jne 0x4be052
push 1
push 0
call fcn.005336ff
push 0
call fcn.005336cf
push 0
push 0
call fcn.005336ff
mov eax, 1
push eax
call fcn.0042dc22
jmp 0x4be0ad
push 1
push 0xf
call fcn.005336ff
push 0xf
call fcn.005336cf
push 0
push 0xf
call fcn.005336ff
lea ebp, [0x72ab5c]
cmp dword [ebp], 0
je 0x4be099
lea ebp, [0x72ad90]
cmp dword [ebp + 0x28], 0
je 0x4be099
mov eax, 1
jmp 0x4be09b
xor eax, eax
and eax, eax
je 0x4be0ad
lea ebp, [0x72a860]
push dword [ebp + 0x20]
call sub.USER32.dll_SetForegroundWindow
jmp 0x4be488
call sub.USER32.dll_GetForegroundWindow
mov dword [esp + 4], eax
lea ebp, [0x72ab78]
mov ebx, dword [ebp + 0x78]
and ebx, ebx
jne 0x4be0dc
lea ebp, [0x72abf8]
mov ebx, dword [ebp + 0x1c]
and ebx, ebx
jne 0x4be0dc
mov eax, 1
jmp 0x4be0de
xor eax, eax
and eax, eax
je 0x4be145
mov ebx, dword [esp + 4]
lea ebp, [0x72a860]
cmp ebx, dword [ebp]
je 0x4be102
mov ebx, dword [esp + 4]
lea ebp, [0x72a860]
cmp ebx, dword [ebp + 0x28]
je 0x4be102
jmp 0x4be109
mov eax, 1
jmp 0x4be10b
xor eax, eax
and eax, eax
je 0x4be140
lea ebp, [0x72a860]
cmp dword [ebp + 0x28], 0
je 0x4be130
push 0x2fb
call fcn.005287cc
and eax, eax
je 0x4be130
mov eax, 1
jmp 0x4be132
xor eax, eax
and eax, eax
je 0x4be13c
mov byte [esp], 2
jmp 0x4be140
mov byte [esp], 1
jmp 0x4be274
lea ebp, [0x72abf8]
mov dword [ebp + 0x1c], 0
lea ebp, [0x72a860]
mov dword [ebp + 0x88], 0
lea ebp, [0x72ab78]
push dword [ebp]
call fcn.004d925e
and eax, eax
je 0x4be274
push 0
lea eax, [0x4615ce]
push eax
call sub.USER32.dll_EnumWindows
mov ebx, dword [esp + 4]
lea ebp, [0x72a860]
cmp ebx, dword [ebp + 0x88]
jne 0x4be222
push 0
lea ebp, [0x72a860]
push dword [ebp + 0x38]
call sub.USER32.dll_GetWindowThreadProcessId
mov dword [esp + 8], eax
push 0
lea ebp, [0x72a860]
push dword [ebp + 0x88]
call sub.USER32.dll_GetWindowThreadProcessId
mov dword [esp + 0xc], eax
push 1
push dword [esp + 0xc]
push dword [esp + 0x14]
call sub.USER32.dll_AttachThreadInput
lea ebp, [0x72a860]
cmp dword [ebp + 0x28], 0
je 0x4be210
push 0xa3
call fcn.004b0428
and eax, eax
je 0x4be200
xor eax, eax
jmp 0x4be205
mov eax, 1
and eax, eax
je 0x4be210
mov eax, 1
jmp 0x4be212
xor eax, eax
and eax, eax
je 0x4be21c
mov byte [esp], 1
jmp 0x4be220
mov byte [esp], 2
jmp 0x4be274
mov ebx, dword [esp + 4]
lea ebp, [0x72a860]
cmp ebx, dword [ebp + 0x88]
je 0x4be245
mov ebx, dword [esp + 4]
lea ebp, [0x72a860]
cmp ebx, dword [ebp]
je 0x4be245
jmp 0x4be24c
mov eax, 1
jmp 0x4be24e
xor eax, eax
and eax, eax
jne 0x4be263
mov ebx, dword [esp + 4]
lea ebp, [0x72a860]
cmp ebx, dword [ebp + 0x28]
je 0x4be263
jmp 0x4be26a
mov eax, 1
jmp 0x4be26c
xor eax, eax
and eax, eax
je 0x4be274
mov byte [esp], 3
movsx ebx, byte [esp]
push ebx
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4be313
lea ebp, [0x72a860]
cmp dword [ebp + 0x28], 0
je 0x4be2ae
push 0x11
call fcn.005339a6
mov ebx, eax
cmp ebx, 0x20000000
jne 0x4be2ae
mov eax, 1
jmp 0x4be2b0
xor eax, eax
and eax, eax
je 0x4be2bf
mov eax, 1
push eax
call fcn.00484cb6
push dword [esp + 0x20]
lea ebp, [0x72a860]
push dword [ebp + 0x28]
call sub.USER32.dll_ShowWindow
lea ebp, [0x72a860]
push dword [ebp + 0x28]
call sub.USER32.dll_SetForegroundWindow
push 0
push 2
push 0x86
lea ebp, [0x72a860]
push dword [ebp + 0x28]
call sub.USER32.dll_SendMessageW
push 0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.USER32.dll_AttachThreadInput
jmp 0x4be487
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4be3d4
push 1
push 0
call fcn.005336ff
lea ebp, [0x72a860]
cmp dword [ebp + 0x28], 0
je 0x4be34b
push 1
push 0x11
call fcn.005336ff
push dword [esp + 0x20]
lea ebp, [0x72a860]
push dword [ebp]
call sub.USER32.dll_ShowWindow
lea ebp, [0x72a860]
push dword [ebp]
call sub.USER32.dll_SetForegroundWindow
push 0
push 2
push 0x86
lea ebp, [0x72a860]
push dword [ebp]
call sub.USER32.dll_SendMessageW
push 0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.USER32.dll_AttachThreadInput
lea ebp, [0x72a860]
cmp dword [ebp + 0x28], 0
je 0x4be3b5
push 0
push 0x11
call fcn.005336ff
push 0
push 0
call fcn.005336ff
mov eax, 1
push eax
call fcn.0042dc22
jmp 0x4be487
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4be487
lea ebp, [0x72a860]
cmp dword [ebp + 0x28], 0
je 0x4be409
push 0x11
call fcn.005339a6
mov ebx, eax
cmp ebx, 0x20000000
jne 0x4be409
mov eax, 1
jmp 0x4be40b
xor eax, eax
and eax, eax
je 0x4be434
xor eax, eax
push eax
call fcn.00484cb6
push 0
push 2
push 0x86
lea ebp, [0x72a860]
push dword [ebp + 0x28]
call sub.USER32.dll_SendMessageW
lea ebp, [0x72abf8]
mov dword [ebp + 4], 1
push dword [esp + 0x20]
lea ebp, [0x72a860]
push dword [ebp + 0x88]
call sub.USER32.dll_ShowWindow
lea ebp, [0x72a860]
push dword [ebp + 0x88]
call sub.USER32.dll_SetForegroundWindow
push 0
push 2
push 0x86
lea ebp, [0x72a860]
push dword [ebp + 0x88]
call sub.USER32.dll_SendMessageW
pop eax
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
ret 4