Function at 0x43c920
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, ecx
mov eax, dword [0x538010]
xor eax, ebp
mov dword [esp + 0x50], eax
mov esi, dword [ecx + 0xd4]
call fcn.00415730
push esi
push eax
call fcn.00436a20
add esp, 8
mov esi, dword [ebx + 0xd8]
mov ecx, ebx
call fcn.00415730
push esi
push eax
call fcn.00436a20
add esp, 8
mov esi, dword [ebx + 0xdc]
mov ecx, ebx
call fcn.00415730
push esi
push eax
call fcn.00436a20
add esp, 8
mov esi, dword [ebx + 0xe0]
mov ecx, ebx
call fcn.00415730
push esi
push eax
call fcn.00436a20
add esp, 8
mov esi, dword [ebx + 0xe4]
mov ecx, ebx
call fcn.00415730
push esi
push eax
call fcn.00436a20
add esp, 8
mov esi, dword [ebx + 0xe8]
mov ecx, ebx
call fcn.00415730
push esi
push eax
call fcn.00436a20
add esp, 8
mov esi, dword [ebx + 0xec]
mov ecx, ebx
call fcn.00415730
push esi
push eax
call fcn.00436a20
add esp, 8
call fcn.00491f90
push eax
push dword [ebx + 0x24]
push dword [ebx + 0x20]
call fcn.00437190
add esp, 0xc
cmp eax, 1
jne 0x43ca3a
mov ecx, dword [ebx + 0x4c]
call fcn.00429520
test al, al
je 0x43ca3a
mov ecx, dword [ebx + 0x4c]
call fcn.004298e0
test al, al
jne 0x43ca3a
lea edi, [esp + 8]
mov ecx, edi
push 0x2bf
push str.OnInitDialog
push 0
call fcn.0044c760
lea ecx, [esp + 0x44]
push 0x51f6b8
push str.Declined_running_the_installer_as_admin
call fcn.00415500
mov ecx, edi
call fcn.0044c9f0
mov ecx, ebx
call fcn.0043e1a0
mov ecx, ebx
call fcn.00415730
push 0x3e8
push eax
call fcn.004312d0
add esp, 8
mov ecx, ebx
call fcn.0043e9a0
lea edi, [ebx + 0x50]
mov ecx, edi
call fcn.00430bf0
mov esi, eax
mov ecx, edi
call fcn.00430c60
mov dword [esp], ebx
mov ebx, eax
mov ecx, dword [esp]
call fcn.00415730
xor ecx, ecx
push 4
push ebx
push esi
push ecx
push ecx
push ecx
xor esi, esi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.00430cd0
mov ebx, eax
mov ecx, edi
call fcn.00430d60
mov ecx, dword [esp]
push eax
push ebx
call fcn.0043e3a0
mov ecx, dword [esp]
push esi
call fcn.0042f880
mov eax, dword [esp]
mov eax, dword [eax + 0x30]
mov ecx, dword [esp]
mov edi, dword [ecx + 0x168]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x4c]
mov ecx, ebx
call dword [section..00cfg]
lea esi, [esp + 8]
mov ecx, edi
push esi
call ebx
mov edi, dword [esp]
movups xmm0, xmmword [esi]
sub esp, 0x20
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
movups xmmword [esp], xmm0
mov dword [esp + 0x1c], 0xdf
mov dword [esp + 0x18], 0xde
mov ecx, edi
call fcn.0043e440
mov ecx, edi
call fcn.0043f3f0
push dword [edi + 0x24]
push dword [edi + 0x20]
call fcn.00436de0
add esp, 8
mov ecx, edi
test al, al
je 0x43cb38
call fcn.00440420
test al, al
jne 0x43cb3d
jmp 0x43cc09
call fcn.0043ef70
mov ecx, edi
call fcn.0043ff20
mov ecx, edi
call fcn.00415730
push 1
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
sub esp, 0x1c
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ebx, 0xffffffe8
mov esi, dword [esp]
mov edi, dword [ebx + 0x51f6d4]
mov ecx, esi
call fcn.00415730
push edi
push eax
mov eax, dword [sym.imp.USER32.dll_GetDlgItem]
call eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x51f6d8]
mov ecx, esi
call fcn.00415730
push edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
sub esp, 0x1c
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x18], 3
call dword [sym.imp.USER32.dll_SetWindowPos]
add ebx, 4
jne 0x43cb80
cmp dword [0x53d938], 0
jne 0x43cbfc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x43df40
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x53d938], eax
mov ecx, dword [esp]
call fcn.00415730
mov dword [0x53d93c], eax
xor esi, esi
inc esi
mov ecx, dword [esp + 0x50]
xor ecx, ebp
call fcn.004d1573
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10