Function at 0x41297f
Capabilities:
Compare security identifiers
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, 0x61928c17
mov dword [esp + 0x108], eax
push ebx
mov dword [esp + 0x110], eax
xor ebx, ebx
mov dword [esp + 0x114], eax
push esi
mov dword [esp + 0x11c], eax
push edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0x50], ebx
jmp 0x4129ed
mov byte [esp + 0x3f], bl
cmp byte [esp + 0x3f], bl
je 0x4129e9
push 0xf7f
push 0x1565
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
inc dword [esp + 0x50]
cmp dword [esp + 0x50], 3
jle 0x4129c5
mov byte [esp + 0x3e], bl
cmp byte [esp + 0x3e], bl
je 0x412a08
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call fcn.004128fd
mov dword [esp + 0x20], ebx
mov dword [esp + 0x44], 0x8cff0ea7
mov dword [esp + 0x84], 2
mov dword [esp + 0x7c], 0x52e4a6b2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x412a48
push ebx
push 0x1136
push 0x1646
push ebx
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov dword [esp + 0x44], 0x1a
jmp 0x412a98
mov dword [esp + 0x90], 0x3ee76373
mov byte [esp + 0x3c], bl
cmp byte [esp + 0x3c], bl
je 0x412a72
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x48]
push eax
lea edx, [esp + 0x98]
lea ecx, [esp + 0x84]
call fcn.004126c7
dec dword [esp + 0x4c]
pop ecx
pop ecx
cmp dword [esp + 0x44], 0xffffffeb
jl 0x412a52
mov dword [esp + 0x88], 0xb21a35ca
mov dword [esp + 0x20], 0xfffffff0
cmp dword [esp + 0x20], 0xe
push 1
pop esi
jne 0x412d2e
mov dword [esp + 0x1c], 0xb2c2
mov dword [esp + 0x1c], 0xffffffff
push 3
mov dword [esp + 0x70], 0x88d9
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x412af4
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x130], 0x27689351
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x412ae1
mov dword [esp + 0x14], ebx
jmp 0x412b13
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x13c], 0xac46ddcd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x412b00
dec dword [esp + 0x6c]
mov dword [esp + 0xa4], 0x33992443
mov dword [esp + 0x18], 0x313dd33a
mov dword [esp + 0x1c], 0xfffffff7
mov dword [esp + 0x18], ebx
jmp 0x412b6c
mov dword [esp + 0xc], ebx
jmp 0x412b57
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x124], 0xfffffffb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x412b44
mov eax, dword [esp + 0x12c]
mov dword [esp + 0x1c], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xc
jge 0x412b3e
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xb4]
mov dword [esp + 0xa4], eax
mov dword [esp + 0x5c], esi
push 2
call fcn.0040f233
mov dword [esp + 0x54], 6
lea ecx, [esp + 0xec]
mov dword [esp + 0x60], 0xfffffffa
mov dword [esp + 0xc8], 0x2955d482
mov dword [esp + 0xc0], 0xdef05de0
mov dword [esp + 0x94], 0xfffffffc
push esi
call fcn.0040f233
mov dword [esp + 0xa0], 0xcf2842c5
mov dword [esp + 0xb0], 0xd1892f88
mov dword [esp + 0xac], ebx
mov dword [esp + 0x8c], 0x826cce71
mov dword [esp + 0xa8], 0x37d796e9
mov dword [esp + 0xc4], 0x4084f7cb
mov dword [esp + 0x2c], ebx
jmp 0x412c24
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 2
jl 0x412c12
mov dword [esp + 0x2c], ebx
jmp 0x412c43
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], esi
jl 0x412c31
mov ecx, dword [esp + 0x60]
xor edx, edx
mov eax, dword [esp + 0x5c]
cmp ecx, eax
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0xb4]
setg dl
sub ecx, edx
lea edx, [esp + 0x54]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [esi + 4]
setg al
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [esp + 0x54]
setg cl
sub eax, ecx
mov ecx, dword [esp + 0x5c]
imul ecx, eax
mov eax, dword [esp + 0xb4]
add ecx, dword [esi + 4]
mov dword [eax], ecx
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x90]
dec dword [esp + 0x58]
push eax
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0xd4]
push eax
lea ecx, [esp + 0xf4]
call fcn.00412765
add esp, 0x30
lea ecx, [esp + 0xec]
call fcn.0040f305
lea ecx, [esp + 0xb4]
call fcn.0040f305
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0xe
push 1
pop esi
je 0x412ac0
mov dword [esp + 0x20], ebx
jmp 0x4130da
mov dword [esp + 0x9c], 0xe53e58bf
lea ecx, [esp + 0x108]
push 2
call fcn.0040f233
push esi
lea ecx, [esp + 0xd0]
call fcn.0040f233
mov dword [esp + 0x24], ebx
jmp 0x412d75
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x412d63
mov dword [esp + 0x24], ebx
jmp 0x412d98
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x412d82
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x412db8
push ebx
push ebx
push 0x1df0
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0xcc]
mov dword [eax], ebx
mov byte [esp + 0x3d], bl
cmp byte [esp + 0x3d], bl
je 0x412dd5
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov eax, dword [esp + 0xcc]
inc dword [eax]
cmp dword [eax], esi
jle 0x412dc1
lea ecx, [esp + 0xcc]
call fcn.0040f305
lea ecx, [esp + 0x108]
call fcn.0040f305
mov dword [esp + 0x80], 0xd2703d9b
mov dword [esp + 0x34], esi
mov dword [esp + 0x70], 0x746a1c17
mov dword [esp + 0x98], 0x3dc0e3e7
mov dword [esp + 0x34], 0xffffffe3
jmp 0x412eba
mov dword [esp + 0xc], 0x111738ab
mov dword [esp + 0xc], ebx
jmp 0x412e4a
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xd8], 0xa473eb90
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x412e37
mov dword [esp + 0xc], ebx
jmp 0x412e9e
mov dword [esp + 0x18], 0xfffffff7
mov dword [esp + 0x18], ebx
jmp 0x412e94
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x412e7a
push 0x2309
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0xd8]
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xd8], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x412e65
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x412e57
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x412eb6
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
inc dword [esp + 0x34]
cmp dword [esp + 0x34], 0xfffffff0
jg 0x412e29
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0xe0]
imul eax, dword [esp + 0x34]
push 2
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x74]
sub eax, 0x747bb7ab
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x84], eax
mov dword [esp + 0x2c], esi
call fcn.0040f233
mov dword [esp + 0xc], ebx
jmp 0x412f2b
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], 0xffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x412f15
mov dword [esp + 0x28], ebx
jmp 0x41300f
mov dword [esp + 0x18], 0xfda0e60f
mov dword [esp + 0xf8], 0xffffffff
mov dword [esp + 0xfc], 0xffffffff
mov dword [esp + 0x100], 0xffffffff
mov dword [esp + 0x104], 0xffffffff
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0xfffffffb
je 0x41300b
push 3
pop ecx
mov dword [esp + 0xc], 0xfffffff8
mov dword [esp + 0x48], 0x71dfd947
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], ebx
jl 0x412ffc
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0xf8]
mov dword [esp + 0x48], eax
mov dword [esp + 0x48], ebx
jmp 0x412ff0
mov dword [esp + 0x4c], 0x896e6a37
mov dword [esp + 0x4c], ebx
jmp 0x412fe6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x412fe2
push 0x21d9
push 0x1939
push ebx
push ebx
push 0x85
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 3
pop ecx
inc dword [esp + 0x4c]
cmp dword [esp + 0x4c], ecx
jle 0x412fbe
inc dword [esp + 0x48]
cmp dword [esp + 0x48], ecx
jle 0x412fb0
dec dword [esp + 0xc]
jns 0x412f9b
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffb
jne 0x412f81
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xfffffffa
je 0x412f3b
mov dword [esp + 0x28], ebx
jmp 0x413036
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], 0xf3e7
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jl 0x413020
lea ecx, [esp + 0xe0]
call fcn.0040f305
mov dword [esp + 0x30], 2
xor edx, edx
mov dword [esp + 0x58], 9
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x68], esi
mov eax, dword [esp + 0x30]
mov dword [esp + 0x58], 0xd2f
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x30]
cmp ecx, eax
mov eax, dword [esp + 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x30]
sete cl
xor edx, edx
add eax, ecx
mov dword [esp + 0x64], eax
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x30]
cmp ecx, eax
setg dl
cmp edx, dword [esp + 0x30]
jne 0x4130b2
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x68]
mov dword [esp + 0x68], 0xfffffffd
lea ecx, [esp + 0x30]
call fcn.0041287b
mov dword [esp + 0x88], 4
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffffc
jne 0x412d37
mov dword [esp + 0x14], ebx
jmp 0x4130fb
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x74], 0x713b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x4130eb
mov dword [esp + 0x14], ebx
jmp 0x413118
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x40], 0xd4081c29
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x413108
mov dword [esp + 0x40], esi
cmp dword [esp + 0x40], ebx
jl 0x41325b
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], ebx
jmp 0x413247
mov dword [esp + 0x14], 0x59b8bc58
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0x70feea3
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], ebx
jl 0x413239
mov dword [esp + 0x18], 0xe8f21009
mov byte [esp + 0x3b], bl
cmp byte [esp + 0x3b], 0
je 0x41318d
push ebx
push 0xe85
push 0x12f9
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov dword [esp + 0x18], ebx
jmp 0x413225
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov eax, dword [esp + 0x40]
cmp ecx, 0xb91300d
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [esp + 0x14]
setl bl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x74]
cmp eax, ebx
mov eax, dword [esp + 0xc]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
xor ebx, ebx
imul edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add edx, dword [esp + eax*4 + 0x74]
cmp edx, 0x1597618d
je 0x41321b
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x74], ebx
mov eax, esi
jne 0x41321d
mov eax, ebx
mov dword [esp + 0x1c], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x413196
dec dword [esp + 0x14]
jns 0x41315f
mov eax, dword [esp + 0x40]
cmp dword [esp + eax*4 + 0x74], ebx
jne 0x413251
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x413139
dec dword [esp + 0x40]
jns 0x41312c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret