Function at 0x402190
Capabilities:
Create thread
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440590
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x44a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [0x44a4e8], 0x30
mov dword [0x44a4ec], 0x40
mov dword [0x44a4f0], 0x401020
mov dword [0x44a4f4], 0
mov dword [0x44a4f8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov dword [0x44a4fc], eax
push 0x44a4e8
movups xmmword [0x44a500], xmm0
mov dword [0x44a510], 0x44141c
mov dword [0x44a514], 0
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x44a4fc]
push 0
push 0
push 0xd2
push 0x186
push 0x64
push 0x64
push 0x80000000
push str.HelpWare_Menu
push str.class001
push 0x80000
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
mov dword [0x44a4d4], eax
call esi
push 2
push pe_nt_image_headers32
push 0
push dword [0x44a4d4]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0xa
push dword [0x44a4d4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x44a4d4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x20
mov dword [ebp - 4], 0
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov ecx, eax
mov dword [0x44a4e4], ecx
test ecx, ecx
je 0x40238f
push 0x44a4e0
push 0x44a498
push 0x40
push dword [0x44a4d4]
xorps xmm0, xmm0
mov dword [0x44a4b4], 0
movlpd qword [0x44a4c4], xmm0
or dword [0x44a4c4], 2
push 1
movlpd qword [0x44a498], xmm0
mov dword [0x44a4b8], 1
mov dword [0x44a4b0], 1
mov dword [0x44a4a0], 0
mov dword [0x44a4bc], 1
mov dword [0x44a4c0], 0x50
mov dword [0x44a4cc], 1
mov dword [0x44a4a4], 1
mov dword [0x44a4ac], 0
mov dword [0x44a4a8], 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x40]
mov ecx, dword [0x44a4e0]
push 1
push 0x1b
push ecx
mov eax, dword [ecx]
call dword [eax + 0xe4]
mov ecx, dword [0x44a4e0]
push 5
push 0x13
push ecx
mov eax, dword [ecx]
call dword [eax + 0xe4]
mov ecx, dword [0x44a4e0]
push 6
push 0x14
push ecx
mov eax, dword [ecx]
call dword [eax + 0xe4]
call fcn.00401540
cmp byte [0x44a0a0], 0
je 0x4026db
mov ebx, dword [sym.imp.MSVCP140.dll__Mtx_lock]
mov edi, dword [sym.imp.USER32.dll_keybd_event]
nop dword [eax]
call fcn.00401940
mov dword [ebp - 4], 1
cmp byte [0x44a0a1], 0
je 0x4024ed
cmp byte [0x44a4df], 0
push 3
push 0
push 0
push 0
push 0
je 0x4023e0
push 0xffffffffffffffff
jmp 0x4023e2
push 0xfffffffffffffffe
push dword [0x44a4d4]
call esi
mov eax, dword [0x44a520]
mov edx, 0x44a0a0
push 0x122
mov ecx, str.___________________botnet.win__BETA
or dword [eax + 0x4954], 0x43
mov dword [eax + 0x49ac], 0x3f000000
mov dword [eax + 0x4964], 0
mov dword [eax + 0x4968], 0
mov dword [eax + 0x496c], 0
mov dword [eax + 0x4970], 0
mov dword [eax + 0x4958], 1
mov dword [eax + 0x4974], 0x43c30000
mov dword [eax + 0x4978], 0x43520000
mov dword [eax + 0x495c], 1
call fcn.0040f520
add esp, 4
call fcn.0043bf40
call fcn.00401250
push ecx
mov ecx, str.Misc
mov byte [ebp - 4], 2
call fcn.0043d910
add esp, 4
test al, al
je 0x4024df
mov byte [ebp - 4], 3
mov al, byte [0x44a4dd]
lea edx, [ebp - 0xd]
mov byte [ebp - 0xd], al
mov ecx, str.BunnyHop__TESTING_
call fcn.004337e0
mov al, byte [ebp - 0xd]
mov ecx, 0x44a4dd
xchg byte [ecx], al
mov ecx, dword [0x44a520]
mov edx, dword [ecx + 0x3f8c]
cmp byte [edx + 0xb3], 0
jne 0x4024df
mov ecx, dword [ecx + 0x4d30]
test ecx, ecx
je 0x4024df
movsx eax, word [ecx + 0x74]
imul eax, eax, 0x2c
add eax, dword [ecx + 8]
test byte [eax + 4], 8
jne 0x4024df
dec dword [edx + 0xec]
mov byte [ebp - 4], 1
call fcn.0043c420
call fcn.004120c0
push 0x44a528
mov dword [ebp - 4], 0xffffffff
call ebx
add esp, 4
test eax, eax
jne 0x402778
cmp dword [0x44a554], 0x7fffffff
je 0x402766
cmp byte [0x44a0a2], al
je 0x40258a
cmp byte [0x44a518], al
push 4
sete byte [0x44a518]
mov byte [0x44a0a2], al
call fcn.0043f469
add esp, 4
lea ecx, [ebp - 0x14]
mov dword [eax], 0x402110
push ecx
push 0
push eax
push 0x402c40
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x402757
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40274f
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
jne 0x40274f
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
push 0x44a528
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov al, byte [0x44a4dc]
add esp, 4
test al, al
je 0x4025af
cmp byte [0x44a518], 0
je 0x4025af
call fcn.00401e10
mov al, byte [0x44a4dd]
test al, al
je 0x4025d9
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4025d9
push 0
push 0
push 0
push 0x20
call edi
push 0
push 2
push 0
push 0x20
call edi
mov dword [ebp - 4], 4
call fcn.0040bbe0
mov ecx, dword [0x44a4e0]
push 0
push 7
push ecx
mov eax, dword [ecx]
call dword [eax + 0xe4]
mov ecx, dword [0x44a4e0]
push 0
push 0x1b
push ecx
mov eax, dword [ecx]
call dword [eax + 0xe4]
mov ecx, dword [0x44a4e0]
push 0
push 0xae
push ecx
mov eax, dword [ecx]
call dword [eax + 0xe4]
mov ecx, dword [0x44a4e0]
push 0
push ecx
mov dword [esp], 0x3f800000
mov eax, dword [ecx]
push 0xff000000
push 3
push 0
push 0
push ecx
call dword [eax + 0xac]
mov eax, dword [0x44a4e0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x402686
call fcn.0040bfb0
mov eax, dword [0x44a520]
xor ecx, ecx
mov eax, dword [eax + 0x4a34]
mov eax, dword [eax]
add eax, 0x3c
cmp byte [eax], cl
cmovne ecx, eax
call fcn.0042e2c0
mov eax, dword [0x44a4e0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov ecx, dword [0x44a4e0]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x44]
cmp eax, 0x88760868
jne 0x4026b8
mov eax, dword [0x44a4e0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x4026b8
call fcn.00401470
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0
call fcn.00402a30
cmp byte [0x44a0a0], 0
jne 0x4023b0
call fcn.00401700
mov dword [ebp - 4], 5
mov ecx, dword [0x44a4e0]
test ecx, ecx
je 0x402701
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x44a4e0], 0
mov ecx, dword [0x44a4e4]
test ecx, ecx
je 0x40271b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x44a4e4], 0
push dword [0x44a4d4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x44a4fc]
push dword [0x44a510]
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x14], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [0x44a554], 0x7ffffffe
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3