Function at 0x438de2
Capabilities:
Log keystrokes
Resume thread
Terminate process
Terminate thread

Disassembly:
sub esp, 0x110
mov eax, dword [0x4755d0]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x128]
xor ebx, ebx
push 0x103
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1d]
push ebx
push eax
mov byte [esp + 0x24], bl
call fcn.00448090
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
cmp dword [0x477200], ebx
jne 0x438e3f
cmp dword [0x47aea8], ebx
je 0x438e80
push 0x3e8
call edi
mov eax, dword [0x477200]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp eax, ebx
je 0x438e5e
push eax
call esi
mov dword [0x477200], ebx
mov eax, dword [0x47aea8]
cmp eax, ebx
je 0x438e70
push eax
call esi
mov dword [0x47aea8], ebx
mov eax, dword [0x477340]
cmp eax, ebx
je 0x438e80
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x477204]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp eax, ebx
je 0x438e99
push ebx
push eax
call ebp
mov dword [0x477204], ebx
mov eax, dword [0x47b1e8]
cmp eax, ebx
je 0x438eaf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x47b1e8], ebx
mov eax, dword [0x47b1ec]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
cmp eax, ebx
je 0x438ed5
push eax
call esi
test eax, eax
je 0x438ed5
push ebx
push ebx
push 0x10
push dword [0x47b1ec]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x477340], ebx
je 0x438fa0
cmp dword [esp + 0x12c], ebx
jne 0x438f31
push str.Attempting_to_stop_run...
mov dword [0x477418], 1
call fcn.00421b06
mov dword [esp], str.Run_Failure
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x438f17
push ebx
push eax
call fcn.00442631
push ebx
push 0xdac
push 0x8069
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4391c6
mov eax, dword [esp + 0x14]
mov dword [eax*4 + 0x477374], ebx
mov eax, dword [0x4771f4]
cmp eax, ebx
je 0x438f86
push eax
call esi
test eax, eax
je 0x438f86
push ebx
push ebx
push 0x10
push dword [0x4771f4]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x64
call edi
mov eax, dword [0x4771f4]
cmp eax, ebx
je 0x438f7c
push eax
call esi
test eax, eax
je 0x438f7c
push dword [0x4771f4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x64
call edi
mov dword [0x4771f4], ebx
push ebx
push dword [0x477340]
call ebp
push str.Run_forcibly_terminated
mov dword [0x477340], ebx
call fcn.00421b06
pop ecx
push 0x8069
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [0x47c494]
call fcn.00440c1e
test eax, eax
je 0x438fd1
push ebx
push dword [0x47c494]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x47c494], ebx
cmp dword [0x47c470], ebx
je 0x438fe4
push str.WARNING___Key_was_pressed_with_the__Down_TYPE_command__but_not_released_with__Up
call fcn.00421b06
pop ecx
test byte [0x47c470], 1
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
je 0x439006
push ebx
push 3
push ebx
push 0x11
call edi
push eax
push 0x11
call esi
test byte [0x47c470], 2
je 0x43901c
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
test byte [0x47c470], 4
je 0x439032
push ebx
push 2
push ebx
push 0x12
call edi
push eax
push 0x12
call esi
mov dword [0x47c470], ebx
cmp byte [0x47b0e3], bl
je 0x43905b
push ebx
push ebx
push ebx
push ebx
push dword [0x475414]
call dword [sym.imp.USER32.dll_mouse_event]
push str.WARNING___Mouse_drag_was_started__but_the_mouse_button_was_not_let_up
call fcn.00421b06
pop ecx
cmp dword [esp + 0x134], ebx
jne 0x43911f
xor esi, esi
mov ebp, 0x47c260
cmp byte [esi + 0x47c268], bl
je 0x439087
lea eax, [esi + 1]
push eax
push str.WARNING___Excel_Workbook__d_was_modified__but_not_saved__use__Save_Workbook__action_
call fcn.00421b06
pop ecx
pop ecx
mov byte [esi + 0x47c268], bl
cmp byte [esi + 0x47c258], bl
je 0x4390a5
lea eax, [esi + 1]
push eax
push str.WARNING___Excel_Workbook__d_was_not_closed__use__Close_Workbook__action_
call fcn.00421b06
pop ecx
pop ecx
lea edi, [esi + 1]
mov byte [esi + 0x47c258], bl
cmp byte [edi + ebp - 1], bl
je 0x4390da
fldz
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
push ebx
push ebx
push ebx
push 4
call fcn.0040ba01
push edi
push str.WARNING___Excel_Workbook__d_was_opened_hidden__and_is_being_closed_automatically
call fcn.00421b06
pop ecx
pop ecx
mov esi, edi
mov byte [edi + ebp - 1], bl
cmp esi, 8
jl 0x43906f
mov eax, dword [0x47a3ec]
cmp eax, ebx
je 0x439100
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x47a3ec], ebx
call dword [sym.imp.ole32.dll_OleUninitialize]
mov esi, 0x47bdb8
mov eax, dword [esi]
cmp eax, ebx
je 0x439114
push eax
call fcn.00447ab6
pop ecx
mov dword [esi], ebx
add esi, 4
cmp esi, 0x47bdf8
jl 0x439105
push ebx
push ebx
push str.DisableScreenSaver
call fcn.0040225d
test eax, eax
je 0x439178
push str.ScreenSaverHolder
lea eax, [esp + 0x1c]
push 0xff
push eax
call fcn.004460ee
push str.SOFTWARE_vTaskScreenSaverHolder
push ebx
push ebx
push ebx
push 4
call fcn.00442f38
add esp, 0x20
push str.HKEY_CURRENT_USERControl_PanelDesktopScreenSaveActive
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [esp + 0x20]
push eax
push 1
push 2
call fcn.00442f38
add esp, 0x14
mov edx, dword [esp + 0x14]
lea eax, [edx*4 + 0x477374]
mov ecx, dword [eax]
cmp ecx, ebx
jle 0x4391af
cmp ecx, 0x77359400
je 0x439194
dec ecx
mov dword [eax], ecx
cmp dword [eax], ebx
jne 0x43919b
or dword [eax], 0xffffffff
push ebx
push ebx
push ebx
push 0x405
push dword [esp + 0x20]
push edx
call fcn.00438941
jmp 0x4391c6
test byte [0x477400], 4
je 0x4391c6
push ebx
push ebx
push 0x10
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00448080
add esp, 0x110
ret 0x14