Function at 0x410db1
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8018
call fcn.00417db0
push ebx
push esi
push dword [ebp + 0xc]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 8], ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0040fd62
mov ecx, esi
call fcn.0040fe01
test al, al
je 0x410e03
mov ecx, dword [ebp + 8]
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
mov ecx, esi
push dword [esi + 0x17d4]
call fcn.004103b2
test al, al
jne 0x410e11
push 1
mov ecx, esi
call fcn.00402b3b
jmp 0x41117a
push edi
push 1
push dword [esi + 0x17d4]
call fcn.00416118
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push 3
call fcn.00402301
mov ecx, eax
call fcn.004018ad
mov edi, eax
push str.ISVISIBLE
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x410e5f
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x41148d
push eax
jmp 0x41148f
push str.ISENABLED
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x410e7e
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
jmp 0x410e51
push str.TABLEFT
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x410ed8
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x25
call ebx
shl eax, 0x10
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
or al, 1
push eax
push 0x25
push 0x100
push dword [esi + 0x1804]
call edi
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x25
call ebx
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
push 0x101
jmp 0x411553
push str.TABRIGHT
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x410f2a
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x25
call ebx
shl eax, 0x10
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
or al, 1
push eax
push 0x27
push 0x100
push dword [esi + 0x1804]
call edi
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x25
call ebx
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
jmp 0x410ece
push str.CURRENTTAB
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x410f6f
mov ecx, dword [ebp + 8]
push eax
push 4
call fcn.00402301
mov ecx, eax
call fcn.004018d3
push eax
push 0x130b
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x411161
inc eax
push eax
jmp 0x41148f
push str.SHOWDROPDOWN
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x410f9b
push eax
push 1
push 0x14f
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jmp 0x41115f
push str.HIDEDROPDOWN
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x410fb0
push eax
push eax
jmp 0x410f83
push str.ADDSTRING
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x411036
mov ecx, dword [ebp + 8]
push 5
push str.Combo
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x410feb
mov ebx, 0x143
mov ecx, dword [ebp + 8]
push 4
push str.List
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x411015
mov ebx, 0x180
test ebx, ebx
je 0x41116a
mov ecx, dword [ebp + 8]
push 4
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push 0
jmp 0x4110b7
push str.DELSTRING
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x4110bd
mov ecx, dword [ebp + 8]
push 5
push str.Combo
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x411071
mov ebx, 0x144
mov ecx, dword [ebp + 8]
push 4
push str.List
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x41109b
mov ebx, 0x182
test ebx, ebx
je 0x41116a
mov ecx, dword [ebp + 8]
push 0
push 4
call fcn.00402301
mov ecx, eax
call fcn.004018d3
push eax
push ebx
jmp 0x410f88
push str.FINDSTRING
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x411180
mov ecx, dword [ebp + 8]
push 5
push str.Combo
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x4110fc
mov ebx, 0x158
mov ecx, dword [ebp + 8]
push 4
push str.List
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x411126
mov ebx, 0x1a2
test ebx, ebx
je 0x411161
mov ecx, dword [ebp + 8]
push 4
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push 1
push ebx
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00401aa7
mov ecx, dword [ebp + 0x10]
call fcn.004018d3
cmp eax, 0xffffffff
jne 0x41116a
push 1
mov ecx, esi
call fcn.00402b3b
push 0
push dword [esi + 0x17d4]
call fcn.00416118
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
push str.SETCURRENTSELECTION
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x411296
mov ecx, dword [ebp + 8]
push 5
push str.Combo
push 2
pop edi
push edi
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x4111cf
mov ebx, 0x14e
mov dword [ebp - 8], 1
mov dword [ebp - 4], 9
mov ecx, dword [ebp + 8]
push 4
push str.List
push edi
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x411202
mov ebx, 0x186
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
test ebx, ebx
je 0x41116a
mov ecx, dword [ebp + 8]
push 0
push 4
call fcn.00402301
mov ecx, eax
call fcn.004018d3
push eax
push ebx
push dword [esi + 0x1804]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
call ebx
cmp eax, 0xffffffff
je 0x411161
mov eax, dword [esi + 0x1804]
push eax
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
movzx ecx, word [ebp - 8]
movzx eax, ax
shl ecx, 0x10
or eax, ecx
mov edi, 0x111
push eax
push edi
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call ebx
mov eax, dword [esi + 0x1804]
push eax
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
movzx ecx, word [ebp - 4]
movzx eax, ax
shl ecx, 0x10
or eax, ecx
push eax
push edi
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call ebx
jmp 0x41116a
push str.GETCURRENTSELECTION
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x4113a4
mov ecx, dword [ebp + 8]
push 8
push str.ComboBox
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x4112e3
mov ebx, 0x147
mov dword [ebp - 8], 0x149
mov dword [ebp - 4], 0x148
mov ecx, dword [ebp + 8]
push 7
push str.ListBox
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x41131b
mov ebx, 0x188
mov dword [ebp - 8], 0x18a
mov dword [ebp - 4], 0x189
test ebx, ebx
je 0x41116a
push 0
push 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi + 0x1804]
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x411161
push 0
push edi
push dword [ebp - 8]
push dword [esi + 0x1804]
call ebx
cmp eax, 0xffffffff
push 1
je 0x411163
add eax, 0x101
push eax
call fcn.004189a1
pop ecx
mov dword [ebp + 8], eax
pop ecx
push eax
push edi
push dword [ebp - 4]
push dword [esi + 0x1804]
call ebx
cmp eax, 0xffffffff
jne 0x411387
push 1
mov ecx, esi
call fcn.00402b3b
jmp 0x411392
push dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
call fcn.00401af4
cmp dword [ebp + 8], 0
je 0x41116a
push dword [ebp + 8]
jmp 0x411613
push str.SELECTSTRING
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x411462
mov ecx, dword [ebp + 8]
push 8
push str.ComboBox
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x4113f2
push 1
mov ebx, 0x14d
pop edi
mov dword [ebp - 4], 9
mov dword [ebp - 8], edi
jmp 0x4113f5
push 1
pop edi
mov ecx, dword [ebp + 8]
push 7
push str.ListBox
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x411429
mov ebx, 0x18c
mov dword [ebp - 8], edi
mov dword [ebp - 4], 2
test ebx, ebx
je 0x41116a
mov ecx, dword [ebp + 8]
push 4
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push edi
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi + 0x1804]
call ebx
cmp eax, 0xffffffff
jne 0x411236
push edi
jmp 0x411163
push str.ISCHECKED
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x41149f
xor edi, edi
push edi
push edi
push 0xf0
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x41149c
push 1
mov ecx, dword [ebp + 0x10]
call fcn.00401aa7
jmp 0x41116a
push edi
jmp 0x41148f
push str.CHECK
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x4114c7
push eax
push eax
push 0xf0
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jmp 0x4114f2
push str.UNCHECK
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x411560
push eax
push eax
push 0xf0
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x41116a
push dword [esi + 0x17d4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xc]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
sub eax, dword [ebp - 0x14]
cdq
sub eax, edx
sar eax, 1
movzx ebx, ax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
shl ebx, 0x10
cdq
sub eax, edx
sar eax, 1
movzx eax, ax
or ebx, eax
push ebx
push 1
push 0x201
push dword [esi + 0x1804]
call edi
push ebx
push 0
push 0x202
push dword [esi + 0x1804]
call edi
jmp 0x41116a
push str.GETSELECTED
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x41161e
and dword [ebp + 8], eax
lea eax, [ebp + 0xc]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push eax
lea eax, [ebp - 4]
push eax
push 0xb0
push dword [esi + 0x1804]
call ebx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x4115fd
push 0
push 0
push 0xe
push dword [esi + 0x1804]
call ebx
mov edi, eax
push 1
test edi, edi
je 0x4115ff
lea eax, [edi + 0x100]
push eax
call fcn.004189a1
pop ecx
mov dword [ebp + 8], eax
pop ecx
push eax
lea eax, [edi + 1]
push eax
push 0xd
push dword [esi + 0x1804]
call ebx
test eax, eax
je 0x4115fd
mov eax, dword [ebp + 0xc]
cmp eax, 0x7fff
ja 0x4115fd
cmp eax, edi
je 0x4115ea
mov ecx, dword [ebp + 8]
and byte [eax + ecx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add eax, ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00401af4
jmp 0x411606
push 1
mov ecx, esi
call fcn.00402b3b
cmp dword [ebp + 8], 0
je 0x41116a
push dword [ebp + 8]
call fcn.004188b8
pop ecx
jmp 0x41116a
push str.GETLINECOUNT
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x411647
push eax
push eax
push 0xba
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x410f69
push str.GETCURRENTLINE
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x411671
push eax
push 0xffffffffffffffff
push 0xc9
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x410f68
push str.EDITPASTE
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x4116ac
mov ecx, dword [ebp + 8]
push 4
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push 1
push 0xc2
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x41116a
push str.GETLINE
push edi
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
jne 0x411161
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x8018]
push eax
push 4
mov dword [ebp - 0x8018], 0x8000
call fcn.00402301
mov ecx, eax
call fcn.004018d3
dec eax
push eax
push 0xc4
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x411161
and byte [ebp + eax - 0x8018], 0
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x8018]
push eax
call fcn.00401af4
jmp 0x41116a