Function at 0x40e1f0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
mov dword [0x43bea8], 0xffffffff
mov dword [0x43ac20], edi
mov dword [0x43ac24], edi
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], 3
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
je 0x40e4b8
mov eax, dword [0x43ac20]
push 0x7f00
push 0
mov dword [esp + 0x20], 0x30
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0x40e4d0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0
mov dword [esp + 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x65
push dword [0x43ac20]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0x436434
call esi
push 0x66
push dword [0x43ac20]
mov dword [esp + 0x38], eax
call esi
mov dword [esp + 0x44], eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx eax, ax
test ax, ax
je 0x40e4b8
push 0
push edi
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push dword [0x43ac50]
push 0x436434
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x43ac4c], eax
test eax, eax
je 0x40e4b8
cmp word [0x43ac64], 0
mov dword [0x43bdc8], 0x43ac4c
jne 0x40e335
xor eax, eax
mov dword [0x43ac64], 0x6e0065
mov word [0x43ac68], ax
mov eax, dword [0x43ad0c]
test eax, eax
push 1
cmove eax, dword [0x43ac20]
mov dword [0x43ad0c], eax
mov ax, word [0x43ac18]
mov word [0x43ad04], ax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x437be7
push 2
call fcn.0041e7b5
mov eax, dword [0x43ad34]
add esp, 8
mov ecx, 0x43ad00
test eax, eax
je 0x40e389
nop dword [eax]
mov ecx, eax
mov eax, dword [ecx + 0x34]
test eax, eax
jne 0x40e380
mov dword [0x43ac48], 0
mov dword [ecx + 0x34], 0x43ac14
mov ecx, 0x43ac14
call fcn.00417a30
mov ecx, 7
call fcn.00417d20
test eax, eax
je 0x40e4b8
push dword [ebp + 0x14]
push dword [0x43ac4c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x43ac4c]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x232b
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x43be5c], eax
test eax, eax
jne 0x40e3f2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
call fcn.00412830
push eax
push 0x9c40
push 0x111
push dword [0x43ac4c]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push dword [0x43ac4c]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
push 0
push 0x40faf0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
push 0x43bea0
mov dword [0x43be58], eax
call esi
test eax, eax
je 0x40e49a
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop word [eax + eax]
push 0x43bea0
push dword [0x43be5c]
push dword [0x43ac4c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x40e489
push 0x43bea0
call edi
push 0x43bea0
call ebx
push 0
push 0
push 0
push 0x43bea0
call esi
test eax, eax
jne 0x40e460
push dword [0x43be54]
push dword [0x43ac4c]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [0x43be58]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x43bea8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10