Function at 0x407490
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 0x419
mov ebx, ecx
jne 0x4074f5
cmp eax, 0x2b
jne 0x4074f5
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x28]
mov edx, dword [ecx + 0x24]
push 3
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ecx + 0x1c]
lea eax, [edx + eax - 0x23]
cdq
sub eax, edx
mov edx, dword [ecx + 0x28]
sar eax, 1
push eax
mov eax, dword [ecx + 0x20]
mov ecx, dword [ecx + 0x18]
lea eax, [edx + eax - 0x26]
cdq
sub eax, edx
sar eax, 1
push eax
push ecx
call dword [sym.imp.USER32.dll_DrawIconEx]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x133
push edi
jne 0x407575
mov edx, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3e9
push edx
call edi
cmp dword [ebp + 0x10], eax
jne 0x40753a
cmp dword [ebx + 0x14], 0
jne 0x4076d3
push 0x808080
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
push 0x3eb
push eax
call edi
cmp dword [ebp + 0x10], eax
jne 0x4076d3
cmp dword [ebx + 0x18], 0
jne 0x4076d3
push 0x808080
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x4e
jne 0x407677
cmp esi, 0x3f2
jne 0x4076d3
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 8]
cmp eax, 0xfffffffd
jne 0x407625
push 0x30
lea ecx, [ebp - 0x30]
push 0
push ecx
call sub.MSVCR80.dll_memset
mov ecx, dword [ebx + 4]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
add esp, 0xc
push 0x3f2
push ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], 4
call dword [sym.imp.USER32.dll_GetDlgItem]
lea edx, [ebp - 0x34]
push edx
push 0
push 0x104b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4076d3
push eax
lea ecx, [ebp + 0x10]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t__]
push 1
push 0
push 0
lea ecx, [ebp + 0x10]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
mov eax, dword [ebx + 4]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 0x10]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0xffffff65
jne 0x407661
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x43
call esi
movsx ecx, ax
test ecx, ecx
jns 0x4076d3
push 0x11
call esi
movsx edx, ax
test edx, edx
jns 0x4076d3
push ebx
call fcn.00407eb0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0xffffff93
jne 0x4076d3
push ebx
call fcn.00408290
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x7b
jne 0x4076af
mov eax, dword [ebx + 4]
push 0x3f2
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, esi
jne 0x4076d3
mov ecx, dword [ebp + 0x10]
mov edx, ecx
shr edx, 0x10
movzx ecx, cx
push edx
push ecx
push ebx
mov edi, eax
call fcn.004076e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x113
jne 0x4076d3
cmp esi, 0x64
jne 0x4076d3
call fcn.004010b0
mov esi, eax
call fcn.00403c10
mov edx, dword [ebx + 4]
push 0x64
push edx
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc