Function at 0x454150
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
push esi
push edi
push dword [ebp + 0x24]
mov ebx, ecx
push dword [ebp + 0x20]
mov dword [esp + 0x1c], ebx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.00463ca0
mov dword [esp + 0x18], eax
test eax, eax
je 0x454395
mov esi, dword [ebp + 0x10]
xor dl, dl
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x1c], 2
mov byte [esp + 0x12], dl
movzx eax, word [esi]
mov byte [esp + 0x13], 1
mov dword [esp + 0x30], connect
mov dword [esp + 0x34], connect
test ax, ax
je 0x4542ca
mov bl, byte [esp + 0x13]
mov ecx, eax
nop word [eax + eax]
movzx edi, cx
test edi, 0xffffff80
je 0x4541cf
xor eax, eax
jmp 0x4541da
push 2
push edi
call fcn.004d4154
add esp, 8
mov ecx, edi
and ecx, 0xffffffdf
test eax, eax
cmove ecx, edi
add ecx, 0xffffffbc
cmp ecx, 0x15
ja case.0x4541f7.69
movzx eax, byte [ecx + 0x4547c8]
jmp dword [eax*4 + 0x4547ac]
mov dword [esp + 0x1c], 0
jmp case.0x4541f7.69
mov dword [esp + 0x1c], 1
jmp case.0x4541f7.69
movzx eax, word [esi + 2]
lea edi, [esi + 2]
mov ecx, eax
mov dword [esp + 0x2c], ecx
test eax, 0xffffff80
je 0x454230
xor eax, eax
jmp 0x45423f
push 2
push eax
call fcn.004d4154
mov ecx, dword [esp + 0x34]
add esp, 8
and ecx, 0xffdf
test eax, eax
movzx edx, cx
mov ecx, dword [esp + 0x2c]
movzx ecx, cx
cmove edx, ecx
movzx eax, bl
movzx edx, dx
xor ecx, ecx
cmp edx, 0x41
cmovne ecx, eax
cmovne edi, esi
mov bl, cl
mov esi, edi
jmp case.0x4541f7.69
push 3
push 0x5090e0
push esi
call fcn.004cff45
add esp, 0xc
test eax, eax
jne case.0x4541f7.69
mov dl, 1
add esi, 4
mov byte [esp + 0x12], dl
jmp 0x4542ad
lea eax, [esi + 2]
push eax
call fcn.004cfe02
mov dword [esp + 0x34], eax
jmp 0x4542a6
lea eax, [esi + 2]
push eax
call fcn.004cfe02
mov dword [esp + 0x38], eax
add esp, 4
mov dl, byte [esp + 0x12]
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x4541c0
mov byte [esp + 0x13], bl
mov ebx, dword [ebp + 0x14]
test dl, dl
jne 0x4542e3
mov ecx, dword [esp + 0x18]
mov edx, ebx
call fcn.004b5ad0
mov esi, eax
mov dword [esp + 0x28], esi
test esi, esi
jne 0x454465
push 0x30
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.004cc590
add esp, 0xc
mov byte [esp + 0x80], 1
nop dword [eax]
movzx eax, word [ebx]
mov esi, eax
cmp eax, 0x20
je 0x45430f
cmp eax, 9
jne 0x454314
add ebx, 2
jmp 0x454300
test eax, 0xffffff80
je 0x45431f
xor eax, eax
jmp 0x45432a
push 2
push eax
call fcn.004d4154
add esp, 8
mov ecx, esi
and ecx, 0xffdf
test eax, eax
movzx edx, cx
mov ecx, esi
cmove edx, ecx
cmp dx, 0x58
jne case.0x45456d.3
cmp word [ebx + 2], 0
lea edi, [ebx + 2]
je case.0x45456d.3
mov ecx, edi
call fcn.00419340
mov dword [esp + 0x58], eax
movzx eax, word [edi]
test ax, ax
je case.0x45456d.3
mov esi, eax
mov ecx, 0x506dbc
mov edx, 0x20
nop dword [eax + eax]
cmp si, dx
je 0x4543c6
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x454370
movzx eax, word [edi + 2]
add edi, 2
mov esi, eax
test ax, ax
jne 0x454361
mov ebx, dword [esp + 0x14]
mov eax, dword [0x51b98c]
test byte [eax + 0x100], 1
jne 0x45478f
mov ecx, dword [0x51eabc]
push 1
push 0
push 0xffffffffffffffff
push 0x5068e4
call fcn.004b3e10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
lea esi, [edi + 2]
nop dword [eax]
movzx eax, word [esi]
cmp eax, 0x20
je 0x4543dd
cmp eax, 9
jne 0x4543e2
add esi, 2
jmp 0x4543d0
test ax, ax
je case.0x45456d.3
push eax
call fcn.004d9eb5
add esp, 4
cmp ax, 0x59
jne case.0x45456d.3
cmp word [esi + 2], 0
lea ecx, [esi + 2]
je case.0x45456d.3
call fcn.00419340
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x48]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x48]
add dword [esp + 0x58], eax
mov eax, dword [esp + 0x4c]
add dword [esp + 0x5c], eax
lea eax, [esp + 0x58]
push eax
push 0x45c330
push ebx
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [esp + 0x70]
mov esi, ebx
mov ecx, dword [esp + 0x5c]
test eax, eax
mov dword [esp + 0x34], ecx
cmovne esi, eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
push esi
mov dword [esp + 0x30], esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edi, dword [ebp + 0xc]
cmp edi, 1
jl 0x454770
mov ecx, dword [esp + 0x30]
cmp ecx, 0x80000000
je 0x454488
mov eax, dword [esp + 0x34]
cmp eax, 0x80000000
jne 0x4544d7
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je case.0x45456d.3
mov ecx, dword [esp + 0x30]
cmp ecx, 0x80000000
jne 0x4544bb
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x38]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x34]
cmp eax, 0x80000000
jne 0x4544d7
mov eax, dword [esp + 0x44]
sub eax, dword [esp + 0x3c]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x34], eax
movzx edx, ax
shl edx, 0x10
movzx eax, cx
or edx, eax
mov dword [esp + 0x20], 0
mov al, byte [ebp + 8]
mov dword [esp + 0x24], edx
cmp al, 0x9f
je 0x4544fd
cmp al, 0x9e
je 0x4544fd
xor bh, bh
jmp 0x4544ff
mov bh, 1
cmp al, 0x9c
je 0x45450b
cmp al, 0x9d
je 0x45450b
xor bl, bl
jmp 0x45450d
mov bl, 1
test bh, bh
je 0x454538
cmp al, 0x9f
mov esi, 0xffffff88
mov eax, dword [esp + 0x2c]
mov ecx, 0x78
cmove esi, ecx
mov dword [esp + 0x14], eax
imul esi, edi
mov edi, 0x20a
shl esi, 0x10
jmp 0x4545d9
test bl, bl
je 0x454560
cmp al, 0x9c
mov esi, 0x78
mov eax, dword [esp + 0x2c]
mov ecx, 0xffffff88
cmove esi, ecx
mov dword [esp + 0x14], eax
imul esi, edi
mov edi, 0x20e
shl esi, 0x10
jmp 0x4545d9
movzx eax, al
dec eax
cmp eax, 5
ja case.0x45456d.3
jmp dword [eax*4 + 0x4547e0]
mov edi, 0x201
mov dword [esp + 0x14], 0x202
mov esi, 1
jmp 0x4545d9
mov edi, 0x204
mov dword [esp + 0x14], 0x205
mov esi, 2
jmp 0x4545d9
mov edi, 0x207
mov dword [esp + 0x14], 0x208
mov esi, 0x10
jmp 0x4545d9
mov dword [esp + 0x20], 0x10000
mov esi, 0x10020
jmp 0x4545cc
mov dword [esp + 0x20], 0x20000
mov esi, 0x20040
mov dword [esp + 0x14], 0x20c
mov edi, 0x20b
cmp byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
je 0x454637
push 0
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x454627
cmp eax, dword [0x5203dc]
je 0x454627
mov ecx, dword [esp + 0x18]
call fcn.004b5f60
test al, al
jne 0x454627
push 1
push dword [esp + 0x30]
push dword [0x5203dc]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x24]
jmp 0x45463f
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
test bh, bh
jne 0x45470d
test bl, bl
jne 0x45470d
mov eax, dword [sym.imp.USER32.dll_PostMessageW]
mov ebx, dword [esp + 0x28]
cmp dword [esp + 0x1c], 1
je 0x4546ad
push edx
push esi
push edi
push ebx
call eax
mov eax, dword [0x51b98c]
cmp dword [eax + 0x58], 0xffffffff
jle 0x4546a1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5203dc], eax
je 0x45468e
mov eax, dword [0x51b98c]
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4546a1
mov ecx, dword [0x51b98c]
mov edx, 1
mov ecx, dword [ecx + 0x58]
call fcn.00401860
cmp dword [esp + 0x1c], 0
je 0x4546f8
mov eax, dword [sym.imp.USER32.dll_PostMessageW]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x1c]
push ebx
call eax
mov eax, dword [0x51b98c]
cmp dword [eax + 0x58], 0xffffffff
jle 0x4546f8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5203dc], eax
je 0x4546e5
mov eax, dword [0x51b98c]
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4546f8
mov ecx, dword [0x51b98c]
mov edx, 1
mov ecx, dword [ecx + 0x58]
call fcn.00401860
sub dword [ebp + 0xc], 1
mov edx, dword [esp + 0x24]
mov eax, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x454658
jmp 0x454757
mov ebx, dword [esp + 0x28]
push edx
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x51b98c]
cmp dword [eax + 0x58], 0xffffffff
jle 0x454757
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5203dc], eax
je 0x454744
mov eax, dword [0x51b98c]
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x454757
mov ecx, dword [0x51b98c]
mov edx, 1
mov ecx, dword [ecx + 0x58]
call fcn.00401860
cmp byte [esp + 0x12], 0
je 0x454770
push 0
push dword [esp + 0x30]
push dword [0x5203dc]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [0x51eabc]
push 1
push 0
push 0xffffffffffffffff
push 0x4f04b0
call fcn.004b3e10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
push 0x4f03e8
push 0
push 0x5068e4
mov ecx, ebx
call fcn.0044d520
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20