Function at 0x4320e0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x50], eax
mov edi, dword [ecx + 0xd8]
call fcn.00412f80
push edi
push eax
call fcn.0042d310
add esp, 8
mov edi, dword [esi + 0xdc]
mov ecx, esi
call fcn.00412f80
push edi
push eax
call fcn.0042d310
add esp, 8
mov edi, dword [esi + 0xe0]
mov ecx, esi
call fcn.00412f80
push edi
push eax
call fcn.0042d310
add esp, 8
mov edi, dword [esi + 0xe4]
mov ecx, esi
call fcn.00412f80
push edi
push eax
call fcn.0042d310
add esp, 8
call fcn.004db0c0
push eax
push dword [esi + 0x14]
call fcn.0042d970
add esp, 8
cmp eax, 1
jne 0x43218b
mov ecx, dword [esi + 0x88]
call fcn.004224d0
test al, al
je 0x43218b
mov ecx, dword [esi + 0x88]
call fcn.00422730
test al, al
je 0x432464
mov ecx, esi
call fcn.00433570
mov ecx, esi
call fcn.00412f80
push 0x3e8
push eax
call fcn.004285c0
add esp, 8
mov ecx, esi
call fcn.004339a0
lea ebx, [esi + 0x90]
mov ecx, ebx
call fcn.00428000
mov dword [esp + 4], eax
mov ecx, ebx
call fcn.00428070
mov ebx, eax
mov ecx, esi
call fcn.00412f80
xor edi, edi
push 4
push ebx
push dword [esp + 0xc]
push edi
push edi
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
push edi
call fcn.00426ea0
mov ecx, esi
call fcn.004347d0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x150]
mov ebx, dword [eax]
lea eax, [esp + 8]
push eax
call fcn.004304e0
lea eax, [esp + 8]
movups xmm0, xmmword [eax]
sub esp, 0x20
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
movups xmmword [esp], xmm0
mov dword [esp + 0x1c], 0x7b
mov dword [esp + 0x18], 0x7a
mov ecx, esi
call fcn.004336b0
mov ecx, esi
call fcn.00433fb0
push dword [esi + 0x14]
call fcn.0042d6e0
add esp, 4
mov ecx, esi
test al, al
je 0x432252
call fcn.00434bb0
jmp 0x432257
call fcn.00433e90
mov ecx, esi
call fcn.00412f80
xor edi, edi
inc edi
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push eax
call ebx
sub esp, 0x1c
mov ecx, 3
mov dword [esp + 0x18], ecx
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
call fcn.00412f80
push edi
push eax
call ebx
mov edi, eax
mov ecx, esi
call fcn.00412f80
mov ecx, 0x71
push ecx
push eax
call ebx
sub esp, 0x1c
mov ecx, 3
mov dword [esp + 0x18], ecx
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowPos]
call eax
mov ecx, esi
call fcn.00412f80
mov ecx, 0x71
push ecx
push eax
call ebx
mov edi, eax
mov ecx, esi
call fcn.00412f80
mov ecx, 0x6d
push ecx
push eax
call ebx
sub esp, 0x1c
mov ecx, 3
mov dword [esp + 0x18], ecx
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
call fcn.00412f80
mov ecx, 0x6d
push ecx
push eax
call ebx
mov edi, eax
mov ecx, esi
call fcn.00412f80
mov ecx, 0x6f
push ecx
push eax
call ebx
sub esp, 0x1c
mov ecx, 3
mov dword [esp + 0x18], ecx
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
call fcn.00412f80
mov ecx, 0x6f
push ecx
push eax
call ebx
mov edi, eax
mov ecx, esi
call fcn.00412f80
mov ecx, 0x6e
push ecx
push eax
call ebx
sub esp, 0x1c
mov ecx, 3
mov dword [esp + 0x18], ecx
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
call fcn.00412f80
mov ecx, 0x6e
push ecx
push eax
call ebx
mov edi, eax
mov ecx, esi
call fcn.00412f80
mov ecx, 0x76
push ecx
push eax
call ebx
sub esp, 0x1c
mov ecx, 3
mov dword [esp + 0x18], ecx
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
call fcn.00412f80
mov ecx, 0x76
push ecx
push eax
call ebx
mov edi, eax
mov ecx, esi
call fcn.00412f80
push 0x7b
push eax
call ebx
sub esp, 0x1c
mov ecx, 3
mov dword [esp + 0x18], ecx
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [0x52b060], 0
jne 0x43243e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x433310
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x52b060], eax
mov ecx, esi
call fcn.00412f80
mov dword [0x52b064], eax
xor esi, esi
inc esi
mov ecx, dword [esp + 0x50]
xor ecx, ebp
call fcn.004948c8
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
lea edi, [esp + 8]
mov ecx, edi
push 0x248
push str.OnInitDialog
push 0
call fcn.0043bcc0
lea ecx, [esp + 0x44]
push 0x50e010
push str.Declined_running_the_installer_as_admin
call fcn.004be8c0
mov ecx, edi
call fcn.0043bef0
jmp 0x43218b