Function at 0x4697d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub esp, 0x18
push ebx
push esi
push edi
cmp eax, 0x53
ja 0x46995c
je 0x46992b
lea ecx, [eax - 2]
cmp ecx, 0x4c
ja case.default.0x46997b
movzx ecx, byte [ecx + 0x469e74]
jmp dword [ecx*4 + 0x469e5c]
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 8], 0xfffffdee
je 0x469838
cmp dword [ecx + 4], 0x801
jne case.default.0x46997b
push ecx
mov ecx, dword [0x50b3a4]
call fcn.0044f2e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 0x10]
push ecx
mov ecx, dword [0x50b3a4]
push edx
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0044f740
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x50b3a4]
call fcn.00453800
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x50b3a4]
call fcn.00450eb0
mov eax, dword [0x50b3a4]
mov esi, dword [sym.imp.USER32.dll_DestroyWindow]
xor edi, edi
cmp dword [eax + 0xf385c], edi
je 0x4698af
mov edx, dword [eax + 0xf385c]
push edx
call esi
mov eax, dword [0x50b3a4]
mov dword [eax + 0xf385c], edi
mov eax, dword [0x50b3a4]
cmp dword [eax + 0xf3860], edi
je 0x4698d1
mov ecx, dword [eax + 0xf3860]
push ecx
call esi
mov edx, dword [0x50b3a4]
mov dword [edx + 0xf3860], edi
mov eax, dword [0x50b3a4]
cmp dword [eax + 0xf3650], edi
je 0x4698f7
mov eax, dword [eax + 0xf3650]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [0x50b3a4]
mov dword [ecx + 0xf3650], edi
mov eax, dword [0x50b3a4]
push 0x5c
add eax, 0xf2d64
push edi
push eax
mov dword [0x50bb90], edi
call fcn.004b03e0
mov edx, dword [0x50b3a4]
add esp, 0xc
mov dword [edx + 0xf38cc], edi
mov dword [0x50bb94], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x10], 0
jne 0x46994e
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x46994e
cmp dword [eax], 0x1c
jb 0x46994e
push eax
mov eax, dword [0x50b3a4]
mov ecx, dword [eax + 0xf38d0]
call fcn.0046bb50
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x312
ja case.default.0x46997b
je 0x469dd6
add eax, 0xfffffef0
cmp eax, 3
ja case.default.0x46997b
jmp dword [eax*4 + 0x469ec4]
mov ecx, dword [0x50b39c]
call fcn.00406f30
mov ecx, dword [0x50b3a8]
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ecx
push 1
push 0x80
push esi
mov dword [0x50bb90], esi
call edi
mov edx, dword [0x50b3ac]
push edx
push 0
push 0x80
push esi
call edi
mov eax, dword [0x50b3a8]
push eax
push 0xfffffffffffffff2
push esi
call dword [sym.imp.USER32.dll_SetClassLongW]
mov ecx, dword [0x50b3a4]
call fcn.00455af0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0xabc5
cmp word [ebp + 0x10], cx
jne case.default.0x46997b
mov edx, dword [0x50bb90]
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [0x50bb90]
mov esi, eax
push 3
push 0
and esi, 8
push 0
mov eax, esi
neg eax
push 0
sbb eax, eax
push 0
dec eax
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [0x50bb90]
neg esi
sbb esi, esi
and esi, 0xfffffff8
add esi, 8
push esi
push 0xabc5
push 0
push edx
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp + 8]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
mov ebx, ecx
shr ebx, 0x10
movzx eax, bx
cmp eax, 0x100
jg 0x469c8c
je 0x469d0c
sub eax, 0
je 0x469ab5
sub eax, 1
je 0x469a96
sub eax, 4
jne case.default.0x46997b
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push edx
push ecx
mov ecx, dword [0x50b3a4]
push eax
call fcn.00459080
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
movzx eax, cx
cmp eax, 0x64a
jg 0x469bdf
je 0x469b26
cmp eax, 8
jg 0x469af4
je 0x469ad6
dec eax
cmp eax, 1
ja 0x469bef
mov ecx, dword [0x50bb90]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
add eax, 0xfffff9c5
cmp eax, 1
ja 0x469bef
xor eax, eax
mov edx, 0x63b
cmp cx, dx
mov ecx, dword [0x50b3a4]
sete al
push eax
call fcn.00464840
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0x10
movzx esi, ax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
mov eax, 0xa09
sete bl
cmp si, ax
je 0x469dc0
mov eax, dword [0x50b3a4]
cmp dword [eax + 0xf2d68], 0
je 0x469ba0
mov ecx, dword [eax + 0xf2d68]
push 0x5f0
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x469ba0
mov ecx, dword [0x50b3a4]
mov edx, dword [ecx + 0xf2d68]
push 0
push 0x5f0
push edx
call fcn.004653c0
mov ecx, dword [0x50b3a0]
push 0
push 0
call fcn.0044afa0
test eax, eax
je case.default.0x46997b
test bl, bl
jne case.default.0x46997b
mov eax, dword [0x50bb90]
push 0
push 1
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
sub eax, 0xa0a
je 0x469dc0
sub eax, 2
je 0x469c0e
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push edx
push ecx
mov ecx, dword [0x50b3a4]
push eax
call fcn.004653c0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x50bb90]
push 1
push 0
push 0
push str.XML_files__.xml_
push ecx
push 0x4dbbd8
push str.Export_configuration
call fcn.00421f50
mov esi, eax
add esp, 0x1c
test esi, esi
je case.default.0x46997b
mov edx, dword [str._xml_]
mov eax, dword [0x4d654c]
mov ecx, dword [0x4d6550]
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
xor eax, eax
push edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [0x50b3a0]
mov dword [ebp - 8], eax
push eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
call fcn.0044afa0
push esi
call fcn.00441300
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x200
je 0x469d0c
cmp eax, 0x300
jne case.default.0x46997b
mov eax, 0xa09
cmp cx, ax
jne 0x469ced
mov esi, dword [ebp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x469cd9
push 0
push 0x5dc
push 0x66
push esi
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x66
push esi
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push edx
push ecx
mov ecx, dword [0x50b3a4]
push eax
call fcn.004605d0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, 0xa09
cmp cx, dx
jne case.default.0x46997b
mov edi, dword [ebp + 8]
push 0xa0a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x64a
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
mov eax, 0x100
cmp bx, ax
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
jne 0x469d69
push edi
call ebx
and eax, 0xfffffffe
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xfffffffffffffff0
push esi
call ebx
or eax, 1
push eax
push 0xfffffffffffffff0
push esi
jmp 0x469d85
push esi
call ebx
and eax, 0xfffffffe
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xfffffffffffffff0
push edi
call ebx
or eax, 1
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
call esi
push 0
push 0
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x10], 0x66
jne case.default.0x46997b
mov ecx, dword [ebp + 8]
push 0x66
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [0x50b3a4]
call fcn.00455550
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp edx, 0x101
jne 0x469e00
mov ecx, dword [0x50b3a4]
push edx
call fcn.0044f2e0
mov ecx, dword [0x50b3a4]
call fcn.00450e60
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp edx, 0x102
jne case.0x469801.6
mov ecx, dword [0x50b3a4]
push edx
call fcn.0044f2e0
mov ecx, dword [0x50b3a4]
call fcn.00450e60
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test dx, dx
je 0x469e45
mov ecx, dword [0x50b3a4]
call fcn.00450e60
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x50b3a4]
call fcn.00450eb0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10