Function at 0x4382d0
Capabilities:
Enumerate gui resources
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [0x462008], 0
xorps xmm0, xmm0
movups xmmword [0x461ff0], xmm0
push ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
push esi
push edi
movq qword [0x462000], xmm0
nop dword [eax + eax]
push 1
push 0
push 0
push dword [0x46200c]
push 0x461ff0
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x438331
push 0x461ff0
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x461ff0
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [0x462064], 0
je 0x4387e0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x462064]
jne 0x43836d
push 3
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 3
push 0
push 0
push 0
push 0
push eax
push dword [0x46200c]
call ebx
jmp 0x438437
push 0x4573fc
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 4
call fcn.00406871
mov edi, dword [ebp - 4]
add esp, 4
mov esi, eax
mov dword [ebp - 8], esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x457404
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 0x28
lea ecx, [ebp - 0x40]
mov dword [esi], eax
push ecx
push 0x28
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x40], edi
push 0x1df62440
push eax
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x438800
mov dword [ebp - 0x10], 0
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x438428
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x438428
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x43842a
xor eax, eax
push 0x64
mov dword [0x462064], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x461fe8]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], 0x3c888889
call dword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [ebp - 0x18]
cvtdq2ps xmm0, xmm0
push 1
movss dword [esi + 0xdb8], xmm0
movd xmm0, dword [ebp - 0x14]
cvtdq2ps xmm0, xmm0
movss dword [esi + 0xdbc], xmm0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x438497
mov byte [esi + 0xdc0], 1
mov eax, dword [esi + 0xdbc]
mov byte [esi + 0x36f8], 1
mov dword [esi + 0x36a8], eax
jmp 0x43849e
mov byte [esi + 0xdc0], 0
cmp dword [0x46bd20], 0
jne 0x4384c2
cmp dword [0x46bd28], 0
jne 0x4384c2
cmp dword [0x46bd24], 0
jne 0x4384c2
cmp dword [0x46bd2c], 0
je 0x438518
push 8
push 0
push 0
push 0
push 0
push 0
push dword [0x46200c]
xorps xmm0, xmm0
mov dword [0x46bd30], 0
movups xmmword [0x46bd20], xmm0
mov dword [0x46bd38], 0
mov dword [0x462020], 0
mov dword [0x462024], 0
call ebx
mov eax, dword [0x462018]
push 0x462020
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [0x461fe8]
test eax, eax
je 0x438526
mov ecx, dword [eax + 0x74]
jmp 0x438528
xor ecx, ecx
cmp dword [ecx + 0xc], 0
jne 0x438543
test eax, eax
je 0x438543
mov eax, dword [eax + 0x74]
test eax, eax
je 0x438543
cmp dword [eax], 0
je 0x438543
call fcn.00431830
call fcn.00432430
call fcn.00418ea0
call fcn.00439dd0
call fcn.00439150
call fcn.0043aaa0
call fcn.004388e0
call fcn.004180d0
mov eax, dword [0x462018]
push 0
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x462018]
push 0
push 0x1b
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x462018]
push 0
push 0xae
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x462018]
push 0
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push 0
push 1
push 0
push 0
push eax
call dword [ecx + 0xac]
mov eax, dword [0x462018]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x438600
call fcn.00417c60
mov eax, dword [0x461fe8]
xor ecx, ecx
mov eax, dword [eax + 0x47d4]
mov eax, dword [eax]
add eax, 0x38
cmp byte [eax], cl
cmovne ecx, eax
call fcn.00431c20
mov eax, dword [0x462018]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov ecx, dword [0x462018]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x44]
cmp eax, 0x88760868
jne 0x4386c1
mov eax, dword [0x462018]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x4386c1
mov esi, dword [0x461fe8]
test esi, esi
je 0x438696
mov esi, dword [esi + 0x74]
test esi, esi
je 0x438696
cmp dword [esi], 0
je 0x438696
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x43865f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 4], 0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x438673
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 8], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x438696
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [0x461fe8]
mov dword [esi + 0xc], 0
mov eax, dword [eax + 0x2c]
mov dword [eax + 4], 0
mov eax, dword [0x462018]
push 0x462020
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov esi, dword [0x461fe8]
test esi, esi
je 0x4386c7
mov eax, dword [esi + 0x74]
test eax, eax
je 0x4386c7
cmp dword [eax], 0
je 0x4386c7
call fcn.00431830
mov esi, dword [0x461fe8]
cmp dword [0x461ff4], 0x12
jne 0x438300
test esi, esi
je 0x4386dd
mov edi, dword [esi + 0x74]
jmp 0x4386df
xor edi, edi
call fcn.00431790
mov ecx, dword [edi]
test ecx, ecx
je 0x4386f0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi + 0xc], 0xfffffff7
mov eax, dword [0x461fe8]
mov dword [esi + 0x6c], 0
mov dword [esi + 0x74], 0
test eax, eax
je 0x438711
dec dword [eax + 0xac]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call edi
mov eax, dword [0x461fe8]
add esp, 4
test eax, eax
je 0x43872b
mov ebx, dword [eax + 0x70]
jmp 0x43872d
xor ebx, ebx
mov ecx, dword [ebx + 0x28]
lea esi, [eax + 8]
test ecx, ecx
je 0x438743
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x461fe8]
and dword [esi + 4], 0xfffffff8
mov dword [esi + 0x60], 0
mov dword [esi + 0x68], 0
test eax, eax
je 0x43875f
dec dword [eax + 0xac]
push ebx
call edi
mov esi, dword [0x461fe8]
add esp, 4
call fcn.0041c4b0
mov dword [0x461fe8], 0
test esi, esi
je 0x43879a
mov ecx, esi
call fcn.004040f0
mov eax, dword [0x461fe8]
test eax, eax
je 0x438794
dec dword [eax + 0xac]
push esi
call edi
add esp, 4
mov ecx, dword [0x462018]
test ecx, ecx
je 0x4387b8
mov eax, dword [ecx]
push ecx
call dword [eax + 0xa8]
mov eax, dword [0x462018]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [0x462010]
test ecx, ecx
je 0x4387c8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [0x46200c]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x461ff8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3