Function at 0x4f0a04
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff64
push ebx
xor ebx, ebx
mov dword [ebp - 0x109c], ebx
mov dword [ebp - 0x1094], ebx
mov dword [ebp - 0x1098], ebx
mov dword [ebp - 0x1090], ebx
mov dword [ebp - 0x108c], ebx
mov dword [ebp - 0x1088], ebx
mov dword [ebp - 0x1084], ebx
mov dword [ebp - 0x1080], ebx
mov dword [ebp - 0x107c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1068]
mov edx, dword [0x4e2d0c]
call fcn.004058c4
xor eax, eax
push ebp
push 0x4f1020
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.0041991c
cmp dword [ebp - 8], 0
jne 0x4f0aa7
lea edx, [ebp - 0x107c]
mov eax, dword [ebp - 4]
call fcn.004f0358
mov edx, dword [ebp - 0x107c]
mov eax, dword [ebp + 8]
call fcn.004168c0
jmp 0x4f0fc3
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ee5cc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4f0fc3
cmp dword [ebp - 0xc], 0
jne 0x4f0af8
cmp dword [ebp + 0x10], 1
jne 0x4f0af8
lea ecx, [ebp - 0x1080]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004ee6f8
mov edx, dword [ebp - 0x1080]
mov eax, dword [ebp + 8]
call fcn.004168c0
jmp 0x4f0fc3
mov byte [ebp - 0x45], 0
cmp dword [ebp - 0xc], 0
jge 0x4f0b18
mov eax, dword [ebp - 0xc]
cdq
xor eax, edx
sub eax, edx
jno 0x4f0b11
call fcn.00403a60
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x45], 1
cmp dword [ebp + 0x10], 3
je 0x4f0b28
cmp dword [ebp + 0x10], 4
jne 0x4f0bd9
mov dword [ebp - 0x38], 0x20000
cmp dword [ebp - 0xc], 0
jge 0x4f0b3a
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], 4
jne 0x4f0b54
mov dword [ebp - 0x38], 0x40000
cmp dword [ebp - 0xc], 0
jne 0x4f0b54
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
jne 0x4f0b6b
mov eax, dword [0x5892f4]
mov eax, dword [eax]
xor ecx, ecx
mov edx, dword [ebp - 0x28]
call fcn.005805a8
lea eax, [ebp - 0x24]
mov edx, 0x4f1034
call fcn.00405358
push 0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
add eax, 0x1d50
push eax
mov al, byte [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00506e3c
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x24]
call fcn.004168c0
lea eax, [ebp - 0x1090]
mov edx, 0x4f1054
call fcn.00416844
lea edx, [ebp - 0x1090]
mov eax, dword [ebp + 8]
call fcn.00419968
jne 0x4f0fc3
mov eax, dword [ebp + 8]
call fcn.0041991c
jmp 0x4f0fc3
cmp dword [ebp + 0x10], 2
jne 0x4f0e25
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x40]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004f1060
xor eax, eax
push ebp
push 0x4f0e1e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0xc], 0
jg 0x4f0c15
mov dword [ebp - 0xc], 1
push 0
lea eax, [ebp - 0x1068]
push eax
mov al, byte [ebp - 0x45]
push eax
mov ecx, 0x80000
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004ef6c8
mov eax, dword [ebp - 0x105c]
call fcn.00406234
sub eax, 1
jno 0x4f0c47
call fcn.00403a60
test eax, eax
jl 0x4f0df7
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], 0
push 0
push 0
push 0x406
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x105c]
test edx, edx
je 0x4f0c75
cmp eax, dword [edx - 4]
jb 0x4f0c7a
call fcn.00403a58
mov eax, dword [edx + eax*4]
push eax
call sub.user32.dll_SendMessageA
sub eax, 1
jno 0x4f0c8d
call fcn.00403a60
test eax, eax
jl 0x4f0deb
inc eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x10], 0
add dword [ebp - 0x18], 1
jno 0x4f0cab
call fcn.00403a60
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jl 0x4f0ddf
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0x40d
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x105c]
test edx, edx
je 0x4f0cd6
cmp eax, dword [edx - 4]
jb 0x4f0cdb
call fcn.00403a58
mov eax, dword [edx + eax*4]
push eax
call sub.user32.dll_SendMessageW
lea eax, [ebp - 0x38]
push eax
push 0x400
lea eax, [ebp - 0x1050]
push eax
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_ReadProcessMemory
lea eax, [ebp - 0x1098]
lea edx, [ebp - 0x1050]
mov ecx, 0x800
call fcn.00404d54
mov eax, dword [ebp - 0x1098]
lea edx, [ebp - 0x1094]
call fcn.00409f3c
mov edx, dword [ebp - 0x1094]
mov eax, dword [ebp + 8]
call fcn.00416844
cmp byte [ebp + 0xc], 0
je 0x4f0dd5
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0x40a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x105c]
test edx, edx
je 0x4f0d5f
cmp eax, dword [edx - 4]
jb 0x4f0d64
call fcn.00403a58
mov eax, dword [edx + eax*4]
push eax
call sub.user32.dll_SendMessageW
lea eax, [ebp - 0x38]
push eax
push 0x10
lea eax, [ebp - 0x1078]
push eax
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_ReadProcessMemory
lea eax, [ebp - 0x1078]
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x105c]
test edx, edx
je 0x4f0da0
cmp eax, dword [edx - 4]
jb 0x4f0da5
call fcn.00403a58
mov eax, dword [edx + eax*4]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x1074]
add eax, 4
jno 0x4f0dbe
call fcn.00403a60
push eax
mov eax, dword [ebp - 0x1078]
add eax, 4
jno 0x4f0dcf
call fcn.00403a60
push eax
call sub.user32.dll_SetCursorPos
call fcn.004044f0
jmp 0x4f0fc3
inc dword [ebp - 0x10]
dec dword [ebp - 0x50]
jne 0x4f0ca0
inc dword [ebp - 0x14]
dec dword [ebp - 0x4c]
jne 0x4f0c5a
mov eax, dword [ebp + 8]
call fcn.0041991c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f0fc3
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004f1060
ret
mov dword [ebp - 0x1c], 0x20000
cmp dword [ebp + 0x10], 1
jne 0x4f0e39
mov dword [ebp - 0x1c], 0x40000
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 0x34], eax
push 0
mov eax, dword [ebp - 0x28]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x30]
jne 0x4f0e9b
cmp dword [ebp - 0xc], 0
jle 0x4f0e88
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x1068]
push eax
mov al, byte [ebp - 0x45]
push eax
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jns 0x4f0e78
call fcn.00403a58
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004ef6c8
mov dword [ebp - 0x2c], eax
jmp 0x4f0f03
mov eax, dword [ebp - 0x28]
push eax
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetFocus
mov dword [ebp - 0x2c], eax
jmp 0x4f0f03
cmp dword [ebp - 0xc], 0
jle 0x4f0ecc
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x1068]
push eax
mov al, byte [ebp - 0x45]
push eax
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jns 0x4f0ebc
call fcn.00403a58
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004ef6c8
mov dword [ebp - 0x2c], eax
jmp 0x4f0f03
push 0xffffffffffffffff
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x4f0fc3
mov eax, dword [ebp - 0x28]
push eax
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetFocus
mov dword [ebp - 0x2c], eax
push 0
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_AttachThreadInput
cmp dword [ebp - 0x2c], 0
je 0x4f0fc3
push 0
push 0
push 0xe
mov eax, dword [ebp - 0x2c]
push eax
call sub.user32.dll_SendMessageW
mov dword [ebp - 0x20], eax
imul eax, dword [ebp - 0x20], 2
jno 0x4f0f2a
call fcn.00403a60
add eax, 2
jno 0x4f0f34
call fcn.00403a60
test eax, eax
jns 0x4f0f3d
call fcn.00403a58
call fcn.00402dc0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x20]
add eax, 1
jno 0x4f0f56
call fcn.00403a60
push eax
push 0xd
mov eax, dword [ebp - 0x2c]
push eax
call sub.user32.dll_SendMessageW
lea eax, [ebp - 0x109c]
mov edx, dword [ebp - 0x3c]
call fcn.00405460
mov edx, dword [ebp - 0x109c]
mov eax, dword [ebp + 8]
call fcn.004168c0
mov eax, dword [ebp - 0x3c]
call fcn.00402df4
cmp byte [ebp + 0xc], 0
je 0x4f0fc3
lea eax, [ebp - 0x1078]
push eax
mov eax, dword [ebp - 0x2c]
push eax
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1074]
add eax, 4
jno 0x4f0fac
call fcn.00403a60
push eax
mov eax, dword [ebp - 0x1078]
add eax, 4
jno 0x4f0fbd
call fcn.00403a60
push eax
call sub.user32.dll_SetCursorPos
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1027
lea eax, [ebp - 0x109c]
call fcn.004052f4
lea eax, [ebp - 0x1098]
mov edx, 2
call fcn.00404af0
lea eax, [ebp - 0x1090]
call fcn.004120f8
lea eax, [ebp - 0x1080]
mov edx, 2
call fcn.0040530c
lea eax, [ebp - 0x1068]
mov edx, dword [0x4e2d0c]
call fcn.00405994
lea eax, [ebp - 0x24]
call fcn.004052f4
ret