Function at 0x46d788
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push dword [0x465e94]
push dword [0x465e94]
push dword [0x465e94]
push dword [0x465e94]
push dword [0x465e94]
call fcn.00403484
mov edx, dword [0x464b40]
add dword [esp], edx
call fcn.0040856b
mov edx, dword [0x464b40]
add dword [esp], edx
call fcn.00408675
pop dword [0x465e94]
call fcn.00403414
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
jle 0x46d8b4
mov dword [esp + 4], 0
jmp 0x46d7f2
mov ebx, dword [esp]
dec ebx
cmp ebx, dword [esp + 4]
jl 0x46d8b4
push dword [0x465e94]
push dword [0x465e94]
push dword [0x465e94]
push dword [0x465e94]
push dword [esp + 0x14]
call fcn.004033a8
mov edx, dword [0x464b40]
add dword [esp], edx
call fcn.0040b6a0
lea eax, [esp + 0xc]
push eax
call fcn.0040c7c0
push dword [0x465e94]
push dword [0x465e94]
push dword [esp + 0x10]
call fcn.0040b6a0
add dword [0x465e94], 2
mov edx, str._log
mov ecx, dword [esp]
add ecx, dword [0x464b40]
call fcn.00401100
je 0x46d879
lea ebp, [0x465670]
mov dword [ebp + 0xc], 2
jmp 0x46d896
mov edx, 0x461690
mov ecx, dword [esp]
add ecx, dword [0x464b40]
call fcn.00401100
je 0x46d896
mov dword [esp + 0x10], 1
pop dword [0x465e94]
mov edx, 0x45f052
lea ecx, [esp + 8]
call fcn.004010f8
inc dword [esp + 4]
jno 0x46d7f2
cmp dword [esp + 0xc], 0
je 0x46d8d1
mov eax, str.Created_by_WizardSoft
push eax
mov eax, str.AutoLogoff__c__2024_WizardSoft_info_wizardsoft.nl
push eax
call fcn.0040323a
jmp 0x468447
lea ebp, [0x465670]
mov ebx, dword [ebp + 0xc]
cmp ebx, 1
jle 0x46d8e4
call fcn.0046a17f
mov eax, str.___AutoLogoff_started___
push eax
call fcn.0046a995
call fcn.00406d88
call fcn.0046bfe5
push 0
push 0
push 0
push 0
call fcn.0046beaa
push dword [0x465570]
lea eax, [0x46f2c4]
push eax
call fcn.0040785b
push 0x3e8
push dword [0x465570]
push dword [0x465570]
call fcn.00407040
push dword [0x465570]
lea eax, [0x46db56]
push eax
push 0x3336
call fcn.00408f6b
push 0
push 0x3ff
call sub.KERNEL32.dll_SetProcessShutdownParameters
push 0
push dword [0x465570]
call fcn.00407a84
push eax
call fcn.00469307
push 0
push 0
lea eax, [0x46dcdf]
push eax
push 0xd
call sub.USER32.dll_SetWindowsHookExW
mov dword [0x465578], eax
push 0
push 0
lea eax, [0x46de49]
push eax
push 0xe
call sub.USER32.dll_SetWindowsHookExW
mov dword [0x465574], eax
call fcn.00406d88
push edx
push eax
pop dword [0x465504]
pop dword [0x465508]
lea ebp, [0x465670]
cmp dword [ebp + 0x18], 0
je 0x46da17
push 0
push 4
mov eax, 0x45f344
push eax
mov eax, str.WarnOnClose
push eax
mov eax, str.HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerTabbedBrowsing
push eax
call fcn.0046ade8
push 0
push 4
mov eax, 0x45f344
push eax
mov eax, str.AskToCloseAllTabs
push eax
mov eax, str.HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweMicrosoftEdgeMain
push eax
call fcn.0046ade8
lea ebp, [0x465670]
cmp dword [ebp + 0x14], 0
je 0x46db3b
push 0
mov eax, str.ClearBrowsingHistoryOnExit
push eax
mov eax, str.HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerPrivacy
push eax
call fcn.0046abc1
and eax, eax
je 0x46da45
xor eax, eax
jmp 0x46da4a
mov eax, 1
and eax, eax
je 0x46dab1
push 0
push 4
mov eax, 0x45f344
push eax
mov eax, str.CleanCookies
push eax
mov eax, str.HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerPrivacy
push eax
call fcn.0046ade8
push 0
push 4
mov eax, 0x45f344
push eax
mov eax, str.CleanHistory
push eax
mov eax, str.HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerPrivacy
push eax
call fcn.0046ade8
push 0
push 4
mov eax, 0x45f358
push eax
mov eax, str.ClearBrowsingHistoryOnExit
push eax
mov eax, str.HKEY_CURRENT_USERSOFTWAREMicrosoftInternet_ExplorerPrivacy
push eax
call fcn.0046ade8
push 0
mov eax, str.ClearBrowsingHistoryOnExit
push eax
mov eax, str.HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweMicrosoftEdgePrivacy
push eax
call fcn.0046abc1
and eax, eax
je 0x46dacf
xor eax, eax
jmp 0x46dad4
mov eax, 1
and eax, eax
je 0x46db3b
push 0
push 4
mov eax, 0x45f344
push eax
mov eax, str.CleanCookies
push eax
mov eax, str.HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweMicrosoftEdgePrivacy
push eax
call fcn.0046ade8
push 0
push 4
mov eax, 0x45f344
push eax
mov eax, str.CleanHistory
push eax
mov eax, str.HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweMicrosoftEdgePrivacy
push eax
call fcn.0046ade8
push 0
push 4
mov eax, 0x45f358
push eax
mov eax, str.ClearBrowsingHistoryOnExit
push eax
mov eax, str.HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweMicrosoftEdgePrivacy
push eax
call fcn.0046ade8
call fcn.0046b8c4
call fcn.004701f3
xor eax, eax
push dword [esp + 8]
call fcn.0040c870
add esp, 0x10
pop ebx
pop ebp
ret