Function at 0x432900
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x6c
push ebx
push ebp
push esi
push edi
push dword [esp + 0x9c]
mov ebp, ecx
push dword [esp + 0x9c]
mov dword [esp + 0x1c], ebp
push dword [esp + 0x9c]
push dword [esp + 0x9c]
call fcn.0043fd50
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x432ec8
mov esi, dword [esp + 0x88]
xor cl, cl
mov edi, dword [esp + 0x8c]
mov dword [esp + 0x18], 2
mov byte [esp + 0x9c], cl
mov byte [esp + 0x98], 1
mov dword [esp + 0x20], CreateStatusWindowA
mov dword [esp + 0x24], CreateStatusWindowA
cmp byte [esi], cl
je 0x432a5f
lea ebp, [esi + 1]
mov edi, edi
movzx ebx, byte [esi]
test ebx, 0xffffff80
jne 0x43299d
push 2
push ebx
call fcn.00485bac
add esp, 8
test eax, eax
je 0x43299d
and ebx, 0xffffffdf
movsx eax, bl
add eax, 0xffffffbc
cmp eax, 0x15
ja case.0x4329b3.69
movzx eax, byte [eax + 0x432f30]
jmp dword [eax*4 + 0x432f14]
mov dword [esp + 0x18], 0
jmp case.0x4329b3.69
mov dword [esp + 0x18], 1
jmp case.0x4329b3.69
movzx ebx, byte [ebp]
test ebx, 0xffffff80
jne 0x4329ef
push 2
push ebx
call fcn.00485bac
add esp, 8
test eax, eax
je 0x4329ef
and ebx, 0xffffffdf
mov cl, byte [esp + 0x9c]
cmp bl, 0x41
jne 0x432a4c
inc esi
mov byte [esp + 0x98], 0
inc ebp
jmp 0x432a4c
push 3
push 0x4a18bc
push esi
call fcn.00484c8d
add esp, 0xc
test eax, eax
jne case.0x4329b3.69
mov cl, 1
add esi, 2
add ebp, 2
mov byte [esp + 0x9c], cl
jmp 0x432a4c
push ebp
call fcn.00485ca0
mov dword [esp + 0x24], eax
jmp 0x432a42
push ebp
call fcn.00485ca0
mov dword [esp + 0x28], eax
add esp, 4
mov cl, byte [esp + 0x9c]
inc esi
inc ebp
cmp byte [esi], 0
jne 0x432980
test cl, cl
jne 0x432a72
mov ebx, dword [esp + 0x1c]
mov edx, edi
mov ecx, ebx
call fcn.00475e50
mov ebp, eax
test ebp, ebp
jne 0x432b8f
push 0x2c
lea eax, [esp + 0x50]
mov dword [esp + 0x4c], 0
push 0
push eax
call fcn.0048e820
add esp, 0xc
mov byte [esp + 0x70], 1
mov al, byte [edi]
cmp al, 0x20
je 0x432a9a
cmp al, 9
jne 0x432a9d
inc edi
jmp 0x432a90
movzx ebx, byte [edi]
test ebx, 0xffffff80
jne 0x432aba
push 2
push ebx
call fcn.00485bac
add esp, 8
test eax, eax
je 0x432aba
and ebx, 0xffffffdf
cmp bl, 0x58
jne case.0x432cbd.3
cmp byte [edi + 1], 0
je case.0x432cbd.3
lea ecx, [edi + 1]
call fcn.0040dd10
mov edx, 0x49e8b4
mov dword [esp + 0x48], eax
lea ecx, [edi + 1]
call fcn.00409840
test eax, eax
je case.0x432cbd.3
lea esi, [eax + 1]
mov al, byte [esi]
cmp al, 0x20
je 0x432afb
cmp al, 9
jne 0x432afe
inc esi
jmp 0x432af1
mov al, byte [esi]
test al, al
je case.0x432cbd.3
movsx eax, al
push eax
call fcn.00486e4d
add esp, 4
cmp eax, 0x59
jne case.0x432cbd.3
cmp byte [esi + 1], 0
lea ecx, [esi + 1]
je case.0x432cbd.3
call fcn.0040dd10
mov ebx, dword [esp + 0x1c]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x38]
push eax
push ebx
call esi
mov eax, dword [esp + 0x38]
add dword [esp + 0x48], eax
mov eax, dword [esp + 0x3c]
add dword [esp + 0x4c], eax
lea eax, [esp + 0x48]
push eax
push 0x4394d0
push ebx
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [esp + 0x60]
mov ebp, ebx
test eax, eax
cmovne ebp, eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.USER32.dll_ScreenToClient]
jmp 0x432b95
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x84]
cmp edi, 1
jl 0x432ea4
mov ecx, dword [esp + 0x20]
cmp ecx, 0x80000000
je 0x432bbc
mov eax, dword [esp + 0x24]
cmp eax, 0x80000000
jne 0x432c07
lea eax, [esp + 0x28]
push eax
push ebp
call esi
test eax, eax
je case.0x432cbd.3
mov ecx, dword [esp + 0x20]
cmp ecx, 0x80000000
jne 0x432beb
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x24]
cmp eax, 0x80000000
jne 0x432c07
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
movzx ebx, ax
shl ebx, 0x10
movzx eax, cx
or ebx, eax
mov dword [esp + 0x88], 0
mov al, byte [esp + 0x80]
cmp al, 0x9f
je 0x432c30
cmp al, 0x9e
je 0x432c30
xor dl, dl
jmp 0x432c32
mov dl, 1
mov byte [esp + 0x80], dl
cmp al, 0x9c
je 0x432c45
cmp al, 0x9d
je 0x432c45
xor cl, cl
jmp 0x432c47
mov cl, 1
mov byte [esp + 0x9c], cl
test dl, dl
je 0x432c7f
cmp al, 0x9f
mov esi, 0xffffff88
mov eax, dword [esp + 0x80]
mov ecx, 0x78
cmove esi, ecx
mov dword [esp + 0x90], eax
imul esi, edi
mov edi, 0x20a
shl esi, 0x10
jmp 0x432d3b
test cl, cl
je 0x432cb0
cmp al, 0x9c
mov esi, 0x78
mov eax, dword [esp + 0x80]
mov ecx, 0xffffff88
cmove esi, ecx
mov dword [esp + 0x90], eax
imul esi, edi
mov edi, 0x20e
shl esi, 0x10
jmp 0x432d3b
movzx eax, al
dec eax
cmp eax, 5
ja case.0x432cbd.3
jmp dword [eax*4 + 0x432f48]
mov edi, 0x201
mov dword [esp + 0x90], 0x202
mov esi, 1
jmp 0x432d3b
mov edi, 0x204
mov dword [esp + 0x90], 0x205
mov esi, 2
jmp 0x432d3b
mov edi, 0x207
mov dword [esp + 0x90], 0x208
mov esi, 0x10
jmp 0x432d3b
mov dword [esp + 0x88], 0x10000
mov esi, 0x10020
jmp 0x432d2b
mov dword [esp + 0x88], 0x20000
mov esi, 0x20040
mov dword [esp + 0x90], 0x20c
mov edi, 0x20b
cmp byte [esp + 0x98], 0
mov byte [esp + 0x94], 0
je 0x432dab
push 0
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x98], eax
test eax, eax
je 0x432d98
cmp eax, dword [0x4ae958]
je 0x432d98
mov ecx, dword [esp + 0x1c]
call fcn.00476330
test al, al
jne 0x432d98
push 1
push dword [esp + 0x9c]
push dword [0x4ae958]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x94]
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov dl, byte [esp + 0x80]
jmp 0x432db9
mov eax, dword [esp + 0x80]
mov dword [esp + 0x98], eax
test dl, dl
jne 0x432e64
cmp byte [esp + 0x9c], dl
jne 0x432e64
mov eax, dword [esp + 0x84]
test eax, eax
jle 0x432e85
mov ecx, dword [sym.imp.USER32.dll_PostMessageA]
mov edx, dword [esp + 0x18]
cmp edx, 1
je 0x432e1a
push ebx
push esi
push edi
push ebp
call ecx
mov eax, dword [0x4aa1d8]
mov ecx, dword [eax + 0x58]
cmp ecx, 0xffffffff
jle 0x432e09
mov edx, 1
call fcn.00401790
mov edx, dword [esp + 0x18]
mov ecx, dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x84]
test edx, edx
je 0x432e52
push ebx
push dword [esp + 0x8c]
push dword [esp + 0x98]
push ebp
call ecx
mov eax, dword [0x4aa1d8]
mov ecx, dword [eax + 0x58]
cmp ecx, 0xffffffff
jle 0x432e47
mov edx, 1
call fcn.00401790
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x84]
mov ecx, dword [sym.imp.USER32.dll_PostMessageA]
dec eax
mov dword [esp + 0x84], eax
jne 0x432de7
jmp 0x432e85
push ebx
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x4aa1d8]
mov ecx, dword [eax + 0x58]
cmp ecx, 0xffffffff
jle 0x432e85
mov edx, 1
call fcn.00401790
cmp byte [esp + 0x94], 0
je 0x432ea4
push 0
push dword [esp + 0x9c]
push dword [0x4ae958]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49bca8
call fcn.004744e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 0x20
mov ebp, dword [esp + 0x14]
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
jne 0x432ef6
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 0x20
push 0x49bc4d
push 0
push 0x49e628
mov ecx, ebp
call fcn.0042c8f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 0x20