Function at 0x47bf30
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7c80
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x528c24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [0x52b860]
push 0x170
xor esi, esi
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_LoadMenuW]
xor ecx, ecx
cmp eax, esi
setne cl
mov dword [ebp - 0x14], eax
cmp ecx, esi
jne 0x47bfa2
cmp eax, esi
je 0x47c19a
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x11b
push ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
call ebx
lea edx, [ebp - 0x3c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x3c]
mov edx, dword [edi + 4]
mov ecx, dword [ebp - 0x30]
push 0x11b
add eax, 0xffffffda
push edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
call ebx
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
push esi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
call fcn.004782e0
test eax, eax
je 0x47c017
mov edx, dword [ebp - 0x2c]
add edx, 0x82
cmp edx, edi
jle 0x47c017
add edi, 0xffffff7e
mov dword [ebp - 0x2c], edi
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.0047b880
mov edi, dword [eax]
mov dword [ebp - 0x24], edi
mov ebx, dword [sym.imp.USER32.dll_ModifyMenuW]
push esi
push 0x8002
push pe_nt_image_headers32
push 0x8002
push edi
mov byte [ebp - 4], 1
call ebx
push esi
push 0x8003
push pe_nt_image_headers32
push 0x8003
push edi
call ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x52b85c]
mov edx, dword [0x527788]
push esi
push ecx
mov ecx, dword [0x52777c]
push esi
push esi
mov ebx, eax
mov eax, dword [0x527780]
sub edx, eax
push edx
mov edx, dword [0x527784]
sub edx, ecx
push edx
push eax
push ecx
push esi
push esi
push str.32770
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x47c0dd
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
push eax
push edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
call fcn.00479ae0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add esp, 8
push 0
push ecx
push 0
push edx
push eax
push 0x102
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47c12e
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x1c]
sub eax, 0x8002
je 0x47c15e
sub eax, 1
jne 0x47c183
push 0x452
call fcn.0043b4c0
add esp, 4
call fcn.004788c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push 0
push 0
push 0x10
push ecx
jmp 0x47c17d
push 0x451
call fcn.0043b4c0
add esp, 4
call fcn.00478740
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, dword [sym.imp.USER32.dll_DestroyMenu]
test edi, edi
je 0x47c190
push edi
call esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x47c19a
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret