Function at 0x437487
Capabilities:
Log keystrokes
Resume thread
Terminate process
Terminate thread

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4705d0]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x114]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
mov dword [esp + 0x14], eax
lea eax, [esp + 0x19]
push ebx
push eax
mov byte [esp + 0x20], bl
call fcn.004464f0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
cmp dword [0x472480], ebx
jne 0x4374d9
cmp dword [0x476020], ebx
je 0x43751a
push 0x3e8
call edi
mov eax, dword [0x472480]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp eax, ebx
je 0x4374f8
push eax
call esi
mov dword [0x472480], ebx
mov eax, dword [0x476020]
cmp eax, ebx
je 0x43750a
push eax
call esi
mov dword [0x476020], ebx
mov eax, dword [0x4725c0]
cmp eax, ebx
je 0x43751a
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x472484]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp eax, ebx
je 0x437533
push ebx
push eax
call ebp
mov dword [0x472484], ebx
mov eax, dword [0x476360]
cmp eax, ebx
je 0x437549
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x476360], ebx
mov eax, dword [0x476364]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
cmp eax, ebx
je 0x43756f
push eax
call esi
test eax, eax
je 0x43756f
push ebx
push ebx
push 0x10
push dword [0x476364]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x4725c0], ebx
je 0x43763d
cmp dword [esp + 0x128], ebx
jne 0x4375cb
push str.Attempting_to_stop_run...
mov dword [0x472698], 1
call fcn.0042036e
mov dword [esp], str.Run_Failure
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x4375b1
push ebx
push eax
call fcn.00440998
push ebx
push 0xdac
push 0x8069
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x43785c
mov eax, dword [esp + 0x120]
mov dword [eax*4 + 0x4725f4], ebx
mov eax, dword [0x472474]
cmp eax, ebx
je 0x437623
push eax
call esi
test eax, eax
je 0x437623
push ebx
push ebx
push 0x10
push dword [0x472474]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x64
call edi
mov eax, dword [0x472474]
cmp eax, ebx
je 0x437619
push eax
call esi
test eax, eax
je 0x437619
push dword [0x472474]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x64
call edi
mov dword [0x472474], ebx
push ebx
push dword [0x4725c0]
call ebp
push str.Run_forcibly_terminated
mov dword [0x4725c0], ebx
call fcn.0042036e
pop ecx
push 0x8069
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [0x477604]
call fcn.0043f01c
test eax, eax
je 0x43766e
push ebx
push dword [0x477604]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x477604], ebx
cmp dword [0x4775e0], ebx
je 0x437681
push str.WARNING___Key_was_pressed_with_the__Down_TYPE_command__but_not_released_with__Up
call fcn.0042036e
pop ecx
test byte [0x4775e0], 1
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
je 0x4376a3
push ebx
push 3
push ebx
push 0x11
call edi
push eax
push 0x11
call esi
test byte [0x4775e0], 2
je 0x4376b9
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
test byte [0x4775e0], 4
je 0x4376cf
push ebx
push 2
push ebx
push 0x12
call edi
push eax
push 0x12
call esi
mov dword [0x4775e0], ebx
cmp byte [0x47625b], bl
je 0x4376f4
push ebx
push ebx
push ebx
push ebx
push 4
call dword [sym.imp.USER32.dll_mouse_event]
push str.WARNING___Mouse_drag_was_started__but_the_mouse_button_was_not_let_up
call fcn.0042036e
pop ecx
cmp dword [esp + 0x130], ebx
jne 0x4377b3
mov ebp, 0x4773d0
xor esi, esi
dec ebp
lea edi, [esi + 0x4773d8]
cmp byte [edi], bl
je 0x437723
lea eax, [esi + 1]
push eax
push str.WARNING___Excel_Workbook__d_was_modified__but_not_saved__use__Save_Workbook__action_
call fcn.0042036e
pop ecx
pop ecx
mov byte [edi], bl
lea edi, [esi + 0x4773c8]
cmp byte [edi], bl
je 0x43773f
lea eax, [esi + 1]
push eax
push str.WARNING___Excel_Workbook__d_was_not_closed__use__Close_Workbook__action_
call fcn.0042036e
pop ecx
pop ecx
mov byte [edi], bl
lea edi, [esi + 1]
cmp byte [edi + ebp], bl
je 0x43776f
fldz
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
push ebx
push ebx
push ebx
push 4
call fcn.0040a97e
push edi
push str.WARNING___Excel_Workbook__d_was_opened_hidden__and_is_being_closed_automatically
call fcn.0042036e
pop ecx
pop ecx
mov esi, edi
cmp esi, 8
mov byte [edi + ebp], bl
jl 0x437709
mov eax, dword [0x475564]
cmp eax, ebx
je 0x437794
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x475564], ebx
call dword [sym.imp.ole32.dll_OleUninitialize]
mov esi, 0x476f28
mov eax, dword [esi]
cmp eax, ebx
je 0x4377a8
push eax
call fcn.00445e06
pop ecx
mov dword [esi], ebx
add esi, 4
cmp esi, 0x476f68
jl 0x437799
push str.DisableScreenSaver
call fcn.0044426c
pop ecx
test eax, eax
je 0x43780b
push str.ScreenSaverHolder
lea eax, [esp + 0x18]
push 0xff
push eax
call fcn.00444468
push str.SOFTWARE_vTaskScreenSaverHolder
push ebx
push ebx
push ebx
push 4
call fcn.0044129f
add esp, 0x20
push str.HKEY_CURRENT_USERControl_PanelDesktopScreenSaveActive
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 2
call fcn.0044129f
add esp, 0x14
mov edx, dword [esp + 0x120]
lea eax, [edx*4 + 0x4725f4]
mov ecx, dword [eax]
cmp ecx, ebx
jle 0x437845
cmp ecx, 0x77359400
je 0x43782a
dec ecx
mov dword [eax], ecx
cmp dword [eax], ebx
jne 0x437831
or dword [eax], 0xffffffff
push ebx
push ebx
push ebx
push 0x405
push dword [esp + 0x20]
push edx
call fcn.00436f39
jmp 0x43785c
test byte [0x472680], 4
je 0x43785c
push ebx
push ebx
push 0x10
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004464bf
add esp, 0x10c
ret 0x14