Function at 0x41e660
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
mov dword [0x448d48], eax
sub esp, 0x244
push edi
push 0x40
push 0x4488a8
push 1
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
call fcn.0041f680
test eax, eax
jne 0x41e695
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x448dd0]
lea edi, [ebp - 0x144]
mov ecx, 0x25
mov dword [eax + 0x698], 0xff0000
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x144], 0x94
lea ecx, [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x41e702
cmp eax, 1
mov eax, dword [0x448dd0]
je 0x41e722
mov dword [eax + 0x630], 4
cmp dword [ebp - 0x140], 4
mov eax, dword [0x448dd0]
jae 0x41e731
mov dword [eax + 0x634], 1
jmp 0x41e73b
mov eax, dword [0x448dd0]
mov dword [eax + 0x630], 8
mov eax, dword [0x448dd0]
mov dword [eax + 0x634], 1
jmp 0x41e73b
mov dword [eax + 0x630], 0x10
mov eax, dword [0x448dd0]
mov dword [eax + 0x634], 2
call fcn.004182e0
push 0x100
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [0x448d48]
push 0x4f
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [ebp - 0x244]
push ecx
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov dword [0x448de8], eax
call fcn.0041f430
mov dword [ebp - 0x10], eax
call fcn.00416090
mov ecx, dword [0x44ca20]
mov edx, dword [0x44ca1c]
push ecx
push edx
call fcn.00414400
test eax, eax
jne 0x41e79a
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x44ca1c]
sub eax, dword [0x44c338]
mov dword [ebp - 4], eax
jne 0x41e7b3
mov dword [ebp - 8], 0
jmp 0x41e7c4
mov eax, dword [0x44c338]
shl eax, 2
add eax, dword [0x44ca20]
mov dword [ebp - 8], eax
cmp dword [0x448e44], 0
je 0x41e7dc
cmp dword [ebp - 4], 0
jne 0x41e7dc
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
call fcn.00417ac0
cmp dword [0x448e40], 0
jne 0x41e80a
cmp dword [ebp - 0x10], 0
je 0x41e80a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push eax
push ecx
call fcn.00405f10
test eax, eax
je 0x41e80a
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x4488e8
call fcn.0043f508
add esp, 8
test eax, eax
je 0x41e826
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
call fcn.0043db20
mov eax, dword [0x448dd0]
cmp dword [eax + 0x634], 1
jne 0x41e84b
call fcn.0041eca0
test eax, eax
jne 0x41e85d
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
call fcn.0041efb0
test eax, eax
jne 0x41e85d
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
call fcn.0041f570
call fcn.0041fed0
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
push 0x14
mov cx, ax
mov eax, dword [0x448dd0]
and ecx, 1
mov dword [eax + 0xb5c], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
mov cx, ax
mov eax, dword [0x448dd0]
and ecx, 1
mov dword [eax + 0xb58], ecx
call fcn.0043de60
mov ecx, dword [0x448dd0]
mov dword [ecx + 0x694], eax
call fcn.004142a0
call fcn.00416040
mov ecx, dword [0x448dd0]
cmp dword [ecx + 0x834c], 0
je 0x41e8f7
mov eax, dword [0x448d48]
push eax
call fcn.00444660
test eax, eax
je 0x41e8e8
mov eax, dword [0x448d48]
push eax
call fcn.004447a0
test eax, eax
jne 0x41e8f7
mov eax, dword [0x448dd0]
mov dword [eax + 0x834c], 0
call fcn.0041a390
test eax, eax
jne 0x41e909
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
call fcn.0043a780
cmp dword [0x448e48], 0
jne 0x41e91c
call fcn.00405200
push str.commdlg_FindReplace
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov ecx, dword [0x448dd0]
push str.commdlg_help
mov dword [ecx + 0x343c], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov ecx, dword [0x448dd0]
mov dword [ecx + 0x3440], eax
call fcn.00420080
cmp dword [ebp - 0x10], 0
jne 0x41e9dd
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0x244]
push eax
push ecx
push 0x214
push 0
push 0x201
push 0
call fcn.00418080
cmp eax, 4
jne 0x41e9dd
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0xb0]
push eax
push ecx
call fcn.0043d300
test eax, eax
je 0x41e9dd
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0xac]
push eax
push ecx
call fcn.0043d300
test eax, eax
je 0x41e9dd
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0xa8]
push eax
push ecx
call fcn.0043d300
test eax, eax
je 0x41e9dd
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0xa4]
push eax
push ecx
call fcn.0043d300
test eax, eax
je 0x41e9dd
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x41e9ee
mov eax, 0x80000000
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, dword [0x448dd0]
xor ecx, ecx
mov dword [eax + 0x3480], ecx
mov dword [ebp - 0xc], ecx
cmp dword [0x448e44], ecx
jne 0x41ea91
lea eax, [ebp - 0xb0]
lea edx, [ebp - 0x244]
push eax
push edx
push 0x21a
push ecx
push 0x203
push ecx
call fcn.00418080
cmp eax, 1
jne 0x41ea58
mov eax, dword [ebp - 0xb0]
mov ecx, dword [0x448dd0]
mov al, byte [eax]
sub al, 0x31
cmp al, 1
sbb eax, eax
neg eax
mov dword [ecx + 0x3480], eax
mov ecx, dword [0x448dd0]
mov eax, dword [ecx + 0x3480]
jmp 0x41ea8e
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0x244]
push eax
push ecx
push 0x215
push 0
push 0x201
push 0
call fcn.00418080
cmp eax, 1
jne 0x41ea91
mov eax, dword [ebp - 0xb0]
mov al, byte [eax]
sub al, 0x31
cmp al, 1
sbb eax, eax
neg eax
mov dword [ebp - 0xc], eax
push 0x100
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [0x448d48]
push 0xa
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov ecx, dword [0x448dd0]
cmp dword [ecx + 0x634], 2
jne 0x41eb2d
push 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x80000000
add dword [ebp - 0x20], eax
add dword [ebp - 0x18], eax
add dword [ebp - 0x1c], ecx
add dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], edx
je 0x41eaed
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
mov ecx, 0x80000000
cmp dword [ebp - 0x18], ecx
je 0x41eafd
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x448d60]
push eax
push 0
push edx
push ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
push ecx
lea eax, [ebp - 0x244]
push edx
push 0x2cf0000
push 0x4488a8
push eax
push 0x300
jmp 0x41eb78
mov edx, 0x80000000
cmp dword [ebp - 0x14], edx
je 0x41eb3d
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
mov ecx, 0x80000000
cmp dword [ebp - 0x18], ecx
je 0x41eb4d
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x448d60]
push eax
push 0
push edx
push ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
push ecx
lea eax, [ebp - 0x244]
push edx
push 0x2cf0000
push 0x4488a8
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x448dc8], eax
cmp dword [0x448dc8], 0
jne 0x41eb95
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp - 0xc], 0
mov eax, 3
jne 0x41eba3
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [0x448dc8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x448dc8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.0041e320
push 1
mov eax, dword [0x448dc8]
push eax
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
call fcn.00435e90
call fcn.00431ac0
call fcn.0040e130
cmp dword [ebp - 4], 0
jle 0x41ebf3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push eax
push ecx
call fcn.0040f500
jmp 0x41ec27
mov eax, dword [0x448dd0]
xor ecx, ecx
mov cl, byte [eax + 0x346e]
cmp ecx, 1
je 0x41ec0c
cmp ecx, 2
je 0x41ec12
jmp 0x41ec27
push 0
push 0x64
jmp 0x41ec16
push 0
push 0x65
push 0x111
mov eax, dword [0x448dc8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x448e44], 0
je 0x41ec45
push 0
mov eax, dword [0x448dc8]
push 0
push 0x409
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
lea eax, [ebp - 0x4c]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x41ec76
lea eax, [ebp - 0x4c]
push eax
call fcn.0041f3d0
push 0
lea eax, [ebp - 0x4c]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x41ec59
call fcn.004052d0
mov eax, dword [0x448d4c]
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
call fcn.00420100
mov eax, dword [ebp - 0x44]
pop edi
mov esp, ebp
pop ebp
ret 0x10