Function at 0x4ef7dc
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, 1
test eax, eax
jl 0x4ef7fc
cmp eax, dword [ebp - 0xc]
jle 0x4ef801
call fcn.00403be4
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*4]
xor edx, edx
call fcn.00405790
je 0x4efc67
lea eax, [ebp - 0x138]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004035f8
xor eax, eax
test eax, eax
jl 0x4ef831
cmp eax, dword [ebp + 8]
jle 0x4ef836
call fcn.00403be4
mov edx, dword [ebp + 0xc]
lea eax, [edx + eax*8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4ef84f
call fcn.00403be4
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004e62e8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4efc67
mov ecx, 0x640
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004f2694
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x23], 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4ef8a5
mov dword [ebp - 0x18], 1
jmp 0x4ef8b9
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x4ef8b9
mov dword [ebp - 0x18], 2
mov eax, dword [ebp - 0xc]
inc eax
sub eax, 1
jno 0x4ef8c7
call fcn.00403bec
test eax, eax
jle 0x4ef948
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
test eax, eax
jl 0x4ef8e1
cmp eax, dword [ebp - 0xc]
jle 0x4ef8e6
call fcn.00403be4
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*4]
xor edx, edx
call fcn.00405790
je 0x4ef948
mov eax, dword [ebp - 0x10]
test eax, eax
jl 0x4ef901
cmp eax, dword [ebp + 8]
jle 0x4ef906
call fcn.00403be4
mov edx, dword [ebp + 0xc]
lea eax, [edx + eax*8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4ef91f
call fcn.00403be4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x12
je 0x4ef93a
cmp dword [ebp - 0x14], 0xa4
je 0x4ef93a
cmp dword [ebp - 0x14], 0xa5
jne 0x4ef940
mov byte [ebp - 0x22], 1
jmp 0x4ef948
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x4ef8d5
cmp byte [ebp - 0x22], 0
je 0x4ef95c
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004f2818
jmp 0x4ef99f
cmp dword [ebp - 0x18], 0
jle 0x4ef99f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x378], 0
jne 0x4ef99f
mov byte [ebp - 0x23], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x378], 1
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004f2818
push 0xb4
call sub.kernel32.dll_Sleep_2
mov edx, 0x14
mov eax, dword [ebp - 4]
call fcn.00520b78
cmp dword [ebp - 0x18], 0
jle 0x4ef9f7
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x18], 1
jne 0x4ef9be
push 9
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebp - 0x18], 2
jne 0x4ef9cf
push 5
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetWindowRect
push 1
push 0
push 0
push 0xf423f
push 0xf423f
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [0x550240]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
call fcn.0054033c
mov eax, dword [ebp - 0xc]
inc eax
sub eax, 1
jno 0x4efa14
call fcn.00403bec
test eax, eax
jle 0x4efb74
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
test eax, eax
jl 0x4efa32
cmp eax, dword [ebp - 0xc]
jle 0x4efa37
call fcn.00403be4
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*4]
xor edx, edx
call fcn.00405790
je 0x4efb74
mov ecx, 0x3e8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004f2694
push 4
call sub.kernel32.dll_Sleep_2
mov edx, 0x14
mov eax, dword [ebp - 4]
call fcn.00520b78
mov eax, dword [ebp - 0x10]
test eax, eax
jl 0x4efa7a
cmp eax, dword [ebp + 8]
jle 0x4efa7f
call fcn.00403be4
mov edx, dword [ebp + 0xc]
lea eax, [edx + eax*8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4efa98
call fcn.00403be4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x3f
jbe 0x4efaa8
call fcn.00403be4
mov edx, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x138], edx
mov byte [ebp - 0x21], 0
cmp dword [ebp - 0x14], 0x23
je 0x4efae6
cmp dword [ebp - 0x14], 0x24
je 0x4efae6
cmp dword [ebp - 0x14], 0x25
je 0x4efae6
cmp dword [ebp - 0x14], 0x27
je 0x4efae6
cmp dword [ebp - 0x14], 0x26
je 0x4efae6
cmp dword [ebp - 0x14], 0x28
je 0x4efae6
cmp dword [ebp - 0x14], 0x21
je 0x4efae6
cmp dword [ebp - 0x14], 0x22
jne 0x4efb09
push 0x90
call sub.user32.dll_GetKeyState
test al, 1
je 0x4efb09
push 0
xor ecx, ecx
mov edx, 0x90
mov eax, dword [ebp - 4]
call fcn.004f296c
mov byte [ebp - 0x21], 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004ef76c
test al, al
je 0x4efb2c
push 0
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004f296c
jmp 0x4efb51
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004f296c
mov eax, dword [ebp - 0x10]
cmp eax, 0x3f
jbe 0x4efb48
call fcn.00403be4
xor edx, edx
mov dword [ebp + eax*4 - 0x138], edx
cmp byte [ebp - 0x21], 0
je 0x4efb68
push 0
xor ecx, ecx
mov edx, 0x90
mov eax, dword [ebp - 4]
call fcn.004f296c
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x4efa26
mov eax, dword [ebp - 0xc]
inc eax
cmp eax, 1
jl 0x4efbc3
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x3f
jbe 0x4efb8d
call fcn.00403be4
cmp dword [ebp + eax*4 - 0x138], 0
jle 0x4efbba
push 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x3f
jbe 0x4efba6
call fcn.00403be4
mov edx, dword [ebp + eax*4 - 0x138]
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004f296c
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
jne 0x4efb80
push 4
call sub.kernel32.dll_Sleep_2
mov edx, 0x14
mov eax, dword [ebp - 4]
call fcn.00520b78
cmp dword [ebp - 0x18], 0
jle 0x4efbf6
push 1
push 0
push 0
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x38]
push eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_SetWindowPos
cmp dword [ebp - 0x18], 1
jne 0x4efc07
push 6
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebp - 0x18], 2
jne 0x4efc18
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebp - 0x20], 0
je 0x4efc2d
mov eax, dword [0x550240]
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
call fcn.0054033c
cmp byte [ebp - 0x22], 0
je 0x4efc41
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004f2818
jmp 0x4efc5d
cmp byte [ebp - 0x23], 0
je 0x4efc5d
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004f2818
mov eax, dword [ebp - 4]
mov byte [eax + 0x378], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x379], 1
mov esp, ebp
pop ebp
ret 8