Function at 0x440239
Capabilities:
Log keystrokes
Resume thread
Terminate process
Terminate thread

Disassembly:
sub esp, 0x110
mov eax, dword [0x47e5d0]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x128]
xor ebx, ebx
push 0x103
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1d]
push ebx
push eax
mov byte [esp + 0x24], bl
call fcn.00452e00
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
cmp dword [0x480120], ebx
jne 0x440296
cmp dword [0x483e68], ebx
je 0x4402d7
push 0x3e8
call edi
mov eax, dword [0x480120]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp eax, ebx
je 0x4402b5
push eax
call esi
mov dword [0x480120], ebx
mov eax, dword [0x483e68]
cmp eax, ebx
je 0x4402c7
push eax
call esi
mov dword [0x483e68], ebx
mov eax, dword [0x480260]
cmp eax, ebx
je 0x4402d7
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x480124]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp eax, ebx
je 0x4402f0
push ebx
push eax
call ebp
mov dword [0x480124], ebx
mov eax, dword [0x4841a8]
cmp eax, ebx
je 0x440306
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4841a8], ebx
mov eax, dword [0x4841ac]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
cmp eax, ebx
je 0x44032c
push eax
call esi
test eax, eax
je 0x44032c
push ebx
push ebx
push 0x10
push dword [0x4841ac]
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.00450725
cmp dword [0x480260], ebx
je 0x4403fc
cmp dword [esp + 0x12c], ebx
jne 0x44038d
push str.Attempting_to_stop_run...
mov dword [0x480338], 1
call fcn.0042604a
mov dword [esp], str.Run_Failure
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x440373
push ebx
push eax
call fcn.0044a2f8
push ebx
push 0xdac
push 0x8069
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x440641
mov eax, dword [esp + 0x14]
mov dword [eax*4 + 0x480294], ebx
mov eax, dword [0x480114]
cmp eax, ebx
je 0x4403e2
push eax
call esi
test eax, eax
je 0x4403e2
push ebx
push ebx
push 0x10
push dword [0x480114]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x64
call edi
mov eax, dword [0x480114]
cmp eax, ebx
je 0x4403d8
push eax
call esi
test eax, eax
je 0x4403d8
push dword [0x480114]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x64
call edi
mov dword [0x480114], ebx
push ebx
push dword [0x480260]
call ebp
push str.Run_forcibly_terminated
mov dword [0x480260], ebx
call fcn.0042604a
pop ecx
mov ebp, dword [esp + 0x10]
push 0x8069
push ebp
call dword [sym.imp.USER32.dll_KillTimer]
push dword [0x485454]
call fcn.004487cd
test eax, eax
je 0x44042e
push ebx
push dword [0x485454]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x485454], ebx
cmp dword [0x485430], ebx
je 0x440441
push str.WARNING___Key_was_pressed_with_the__Down_TYPE_command__but_not_released_with__Up
call fcn.0042604a
pop ecx
test byte [0x485430], 1
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
je 0x440463
push ebx
push 3
push ebx
push 0x11
call edi
push eax
push 0x11
call esi
test byte [0x485430], 2
je 0x440479
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
test byte [0x485430], 4
je 0x44048f
push ebx
push 2
push ebx
push 0x12
call edi
push eax
push 0x12
call esi
mov dword [0x485430], ebx
cmp byte [0x4840a3], bl
je 0x4404b8
push ebx
push ebx
push ebx
push ebx
push dword [0x47e414]
call dword [sym.imp.USER32.dll_mouse_event]
push str.WARNING___Mouse_drag_was_started__but_the_mouse_button_was_not_let_up
call fcn.0042604a
pop ecx
cmp dword [esp + 0x134], ebx
jne 0x440580
xor esi, esi
mov ebp, 0x485220
cmp byte [esi + 0x485228], bl
je 0x4404e4
lea eax, [esi + 1]
push eax
push str.WARNING___Excel_Workbook__d_was_modified__but_not_saved__use__Save_Workbook__action_
call fcn.0042604a
pop ecx
pop ecx
mov byte [esi + 0x485228], bl
cmp byte [esi + 0x485218], bl
je 0x440502
lea eax, [esi + 1]
push eax
push str.WARNING___Excel_Workbook__d_was_not_closed__use__Close_Workbook__action_
call fcn.0042604a
pop ecx
pop ecx
lea edi, [esi + 1]
mov byte [esi + 0x485218], bl
cmp byte [edi + ebp - 1], bl
je 0x440537
fldz
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
push ebx
push ebx
push ebx
push 4
call fcn.0040ed62
push edi
push str.WARNING___Excel_Workbook__d_was_opened_hidden__and_is_being_closed_automatically
call fcn.0042604a
pop ecx
pop ecx
mov esi, edi
mov byte [edi + ebp - 1], bl
cmp esi, 8
jl 0x4404cc
mov eax, dword [0x4833ac]
cmp eax, ebx
je 0x44055d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x4833ac], ebx
call dword [sym.imp.ole32.dll_OleUninitialize]
mov esi, 0x484d78
mov eax, dword [esi]
cmp eax, ebx
je 0x440571
push eax
call fcn.00452756
pop ecx
mov dword [esi], ebx
add esi, 4
cmp esi, 0x484db8
jl 0x440562
mov ebp, dword [esp + 0x10]
mov esi, 0x2710
push esi
push ebx
push ebx
push ebx
push 1
push 3
push ebp
call fcn.004515bd
push esi
push ebx
push ebx
push ebx
push ebx
push 3
push ebp
call fcn.004515bd
push ebx
push ebx
push str.DisableScreenSaver
call fcn.0040225d
test eax, eax
je 0x4405f9
push str.ScreenSaverHolder
lea eax, [esp + 0x1c]
push 0xff
push eax
call fcn.0044def5
push str.SOFTWARE_vTaskScreenSaverHolder
push ebx
push ebx
push ebx
push 4
call fcn.0044ad45
add esp, 0x20
push str.HKEY_CURRENT_USERControl_PanelDesktopScreenSaveActive
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [esp + 0x20]
push eax
push 1
push 2
call fcn.0044ad45
add esp, 0x14
mov edx, dword [esp + 0x14]
lea eax, [edx*4 + 0x480294]
mov ecx, dword [eax]
cmp ecx, ebx
jle 0x44062d
cmp ecx, 0x77359400
je 0x440615
dec ecx
mov dword [eax], ecx
cmp dword [eax], ebx
jne 0x44061c
or dword [eax], 0xffffffff
push ebx
push ebx
push ebx
push 0x405
push ebp
push edx
call fcn.0043fcd7
jmp 0x440641
test byte [0x480320], 4
je 0x440641
push ebx
push ebx
push 0x10
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00452dee
add esp, 0x110
ret 0x14