Function at 0x41ac10
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5a30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x818
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
push 4
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00487a03
mov eax, dword [eax]
mov esi, str..lnk
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41ac81
test cl, cl
je 0x41ac7d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41ac81
add eax, 2
add esi, 2
test cl, cl
jne 0x41ac59
xor eax, eax
jmp 0x41ac86
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x14]
sete bl
call fcn.0048f641
test bl, bl
je 0x41b026
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x824]
push eax
push ecx
mov ecx, edi
call fcn.004261c0
test eax, eax
je 0x41b019
lea edi, [ebp - 0x824]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x41ad35
push 0x2e
lea ecx, [ebp + 0xc]
call fcn.00487af7
push 0x5c
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.00487af7
push 0x5c
lea ecx, [ebp + 0xc]
mov edi, eax
call fcn.00487af7
sub esi, edi
lea edx, [ebp - 0x18]
dec esi
inc eax
push esi
push eax
push edx
lea ecx, [ebp + 0xc]
call fcn.0048796d
push eax
lea eax, [ebp - 0x14]
push 0x4d4fd8
push eax
mov byte [ebp - 4], 2
call fcn.0048f94a
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.0048f77a
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0048f641
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0048f641
jmp 0x41ad44
lea ecx, [ebp - 0x824]
push ecx
lea ecx, [ebp + 0xc]
call fcn.0048f7ca
lea edx, [ebp - 0x14]
push 4
push edx
lea ecx, [ebp + 0xc]
call fcn.00487a03
mov eax, dword [eax]
mov byte [ebp - 4], 4
mov esi, str..EXE
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41ad85
test cl, cl
je 0x41ad81
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41ad85
add eax, 2
add esi, 2
test cl, cl
jne 0x41ad5d
xor eax, eax
jmp 0x41ad8a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41ade1
lea eax, [ebp - 0x18]
push 4
push eax
lea ecx, [ebp + 0xc]
call fcn.00487a03
mov eax, dword [eax]
mov esi, str..exe
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41adcb
test cl, cl
je 0x41adc7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41adcb
add eax, 2
add esi, 2
test cl, cl
jne 0x41ada3
xor eax, eax
jmp 0x41add0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x18]
sete bl
call fcn.0048f641
test bl, bl
je 0x41ade3
mov bl, 1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0048f641
test bl, bl
jne 0x41afdd
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 0x1c8]
test eax, eax
je 0x41b026
push 0x2e
lea ecx, [ebp + 0xc]
call fcn.00487af7
push 0x5c
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.00487af7
cmp esi, eax
jle 0x41aeb1
push 0x2e
lea ecx, [ebp + 0xc]
call fcn.00487af7
push 0x2f
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.00487af7
cmp esi, eax
jle 0x41aeb1
push 1
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.00487639
lea edx, [ebp - 0x18]
push 1
push edx
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 5
call fcn.00487a03
mov esi, dword [ebp - 0x14]
mov eax, dword [eax]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41ae8b
test cl, cl
je 0x41ae87
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41ae8b
add eax, 2
add esi, 2
test cl, cl
jne 0x41ae63
xor eax, eax
jmp 0x41ae90
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x18]
sete bl
call fcn.0048f641
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0048f641
test bl, bl
je 0x41b026
lea eax, [ebp - 0x20]
push 5
push eax
lea ecx, [ebp + 0xc]
call fcn.00487a7f
mov eax, dword [eax]
mov byte [ebp - 4], 6
mov esi, str.file:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41aef2
test cl, cl
je 0x41aeee
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41aef2
add eax, 2
add esi, 2
test cl, cl
jne 0x41aeca
xor eax, eax
jmp 0x41aef7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41afcb
lea eax, [ebp - 0x18]
push 2
push eax
lea ecx, [ebp + 0xc]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, 0x4d4fd8
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41af3c
test cl, cl
je 0x41af38
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41af3c
add eax, 2
add esi, 2
test cl, cl
jne 0x41af14
xor eax, eax
jmp 0x41af41
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x18]
sete bl
call fcn.0048f641
test bl, bl
jne 0x41afcb
lea eax, [ebp - 0x14]
push 6
push eax
lea ecx, [ebp + 0xc]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.shell:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41af8f
test cl, cl
je 0x41af8b
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41af8f
add eax, 2
add esi, 2
test cl, cl
jne 0x41af67
xor eax, eax
jmp 0x41af94
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x14]
sete bl
call fcn.0048f641
test bl, bl
jne 0x41afcb
mov eax, dword [ebp + 0xc]
cmp byte [eax + 1], 0x3a
jne 0x41afc7
mov al, byte [eax + 2]
cmp al, 0x5c
je 0x41afcb
cmp al, 0x2f
sete cl
test cl, cl
jne 0x41afcb
test al, al
sete al
test al, al
jne 0x41afcb
xor bl, bl
jmp 0x41afcd
mov bl, 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0048f641
test bl, bl
je 0x41b026
mov eax, dword [ebp + 0xc]
push 5
push 0
push 0x4dc430
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.0048f641
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.about:blank
lea ecx, [ebp + 0xc]
call fcn.0048f7ca
push ecx
lea edx, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x24], esp
push edx
call fcn.0048f3b6
mov edi, dword [ebp - 0x1c]
mov ecx, edi
call fcn.00443d60
test eax, eax
jne 0x41aff7
push eax
mov ecx, edi
call fcn.0049c4d4
mov esi, eax
test esi, esi
je 0x41b091
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x41b091
mov eax, dword [0x4de5c8]
test eax, eax
jne 0x41b091
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x41b091
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0xf8]
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call fcn.00455ef0
jmp 0x41aff7
push 0
push 0
push 0
push 1
push 0
mov ecx, edi
call fcn.00426350
mov esi, eax
test esi, esi
je 0x41aff7
mov ecx, dword [esi + 0xf8]
test ecx, ecx
je 0x41aff7
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
je 0x41b0c8
push eax
call fcn.00451f60
mov ecx, dword [ebp + 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [esi + 0xf8]
call fcn.00455ef0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x3b4]
test ecx, ecx
jne 0x41b0fd
cmp dword [eax + 0x47c], 1
jne 0x41aff7
mov eax, dword [eax + 0xba0]
push 0
push 0
push 0x407
mov edx, dword [eax + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call fcn.0048bd5a
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.0048ebfd
jmp 0x41aff7