Function at 0x442fb0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x4a89c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea eax, [esp + 0x18]
push 0xb
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x44], 0
call fcn.00487a7f
mov eax, dword [eax]
mov byte [esp + 0x3c], 1
mov esi, str.javascript:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44301a
test cl, cl
je 0x443016
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44301a
add eax, 2
add esi, 2
test cl, cl
jne 0x442ff2
xor eax, eax
jmp 0x44301f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4430d3
lea eax, [esp + 0x10]
push 9
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.vbscript:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443066
test cl, cl
je 0x443062
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443066
add eax, 2
add esi, 2
test cl, cl
jne 0x44303e
xor eax, eax
jmp 0x44306b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048f641
test bl, bl
jne 0x4430d3
lea eax, [esp + 0x14]
push 7
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.mailto:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4430bc
test cl, cl
je 0x4430b8
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4430bc
add eax, 2
add esi, 2
test cl, cl
jne 0x443094
xor eax, eax
jmp 0x4430c1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0048f641
test bl, bl
je 0x4430d5
mov bl, 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 0
call fcn.0048f641
test bl, bl
je 0x4430fd
push 0xffffffffffffffff
push 0
push 0xef96
call fcn.00411e30
add esp, 0xc
jmp 0x44359e
push 0x2e
lea ecx, [esp + 0x48]
call fcn.0048fb08
test eax, eax
jg 0x4431a9
push 0x2f
lea ecx, [esp + 0x48]
call fcn.0048fb08
test eax, eax
jg 0x4431a9
push 0x5c
lea ecx, [esp + 0x48]
call fcn.0048fb08
test eax, eax
jge 0x4431a9
lea eax, [esp + 0x18]
push 2
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, 0x4d4fd8
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443171
test cl, cl
je 0x44316d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443171
add eax, 2
add esi, 2
test cl, cl
jne 0x443149
xor eax, eax
jmp 0x443176
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.0048f641
test bl, bl
jne 0x4431a9
mov ecx, dword [esp + 0x44]
cmp byte [ecx + 1], 0x3a
jne 0x443502
mov al, byte [ecx + 2]
cmp al, 0x5c
je 0x4431a9
cmp al, 0x2f
je 0x4431a9
test al, al
jne 0x443502
push 0x40
lea ecx, [esp + 0x48]
call fcn.0048fb08
test eax, eax
jle 0x443569
lea eax, [esp + 0x2c]
push 7
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov byte [esp + 0x3c], 2
mov esi, str.http:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443200
test cl, cl
je 0x4431fc
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443200
add eax, 2
add esi, 2
test cl, cl
jne 0x4431d8
xor eax, eax
jmp 0x443205
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4434ea
lea eax, [esp + 0x18]
push 7
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.file:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44324c
test cl, cl
je 0x443248
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44324c
add eax, 2
add esi, 2
test cl, cl
jne 0x443224
xor eax, eax
jmp 0x443251
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.0048f641
test bl, bl
jne 0x4434ea
lea eax, [esp + 0x14]
push 8
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.https:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4432a6
test cl, cl
je 0x4432a2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4432a6
add eax, 2
add esi, 2
test cl, cl
jne 0x44327e
xor eax, eax
jmp 0x4432ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0048f641
test bl, bl
jne 0x4434ea
lea eax, [esp + 0x10]
push 7
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.file:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443300
test cl, cl
je 0x4432fc
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443300
add eax, 2
add esi, 2
test cl, cl
jne 0x4432d8
xor eax, eax
jmp 0x443305
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048f641
test bl, bl
jne 0x4434ea
lea eax, [esp + 0x1c]
push 4
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.www.
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44335a
test cl, cl
je 0x443356
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44335a
add eax, 2
add esi, 2
test cl, cl
jne 0x443332
xor eax, eax
jmp 0x44335f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x1c]
sete bl
call fcn.0048f641
test bl, bl
jne 0x4434ea
lea eax, [esp + 0x24]
push 6
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov byte [esp + 0x3c], 3
mov esi, str.ftp:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4433b9
test cl, cl
je 0x4433b5
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4433b9
add eax, 2
add esi, 2
test cl, cl
jne 0x443391
xor eax, eax
jmp 0x4433be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x443418
lea eax, [esp + 0x20]
push 4
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.ftp.
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443401
test cl, cl
je 0x4433fd
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443401
add eax, 2
add esi, 2
test cl, cl
jne 0x4433d9
xor eax, eax
jmp 0x443406
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x20]
sete bl
call fcn.0048f641
test bl, bl
je 0x44341a
mov bl, 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 2
call fcn.0048f641
test bl, bl
jne 0x4434ea
lea eax, [esp + 0x28]
push 6
push eax
lea ecx, [esp + 0x4c]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.res:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44346f
test cl, cl
je 0x44346b
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44346f
add eax, 2
add esi, 2
test cl, cl
jne 0x443447
xor eax, eax
jmp 0x443474
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x28]
sete bl
call fcn.0048f641
test bl, bl
jne 0x4434ea
mov edi, dword [esp + 0x44]
mov esi, str.about:blank
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4434b9
test cl, cl
je 0x4434b5
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4434b9
add eax, 2
add esi, 2
test cl, cl
jne 0x443491
xor eax, eax
jmp 0x4434be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x4434ea
cmp byte [edi + 1], 0x3a
jne 0x4434e6
mov al, byte [edi + 2]
cmp al, 0x5c
je 0x4434ea
cmp al, 0x2f
sete cl
test cl, cl
jne 0x4434ea
test al, al
sete al
test al, al
jne 0x4434ea
mov bl, 1
jmp 0x4434ec
xor bl, bl
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 0
call fcn.0048f641
test bl, bl
je 0x443569
mov ecx, dword [esp + 0x44]
mov eax, dword [ecx - 8]
test eax, eax
je 0x44359e
mov eax, dword [ebp + 0xba4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
mov eax, dword [eax + 0x1c]
push 0x407
push eax
call esi
push eax
call fcn.0048bd5a
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, eax
call fcn.0048ebfd
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
push 0
test ax, ax
mov eax, dword [ebp + 0x1c]
push 0xef1c
setge dl
dec edx
push 0x111
and edx, 3
push eax
inc edx
mov dword [ebp + 0x1ec], edx
call esi
jmp 0x44359e
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.0048f3b6
push 0
mov ecx, ebp
call fcn.00443a50
test eax, eax
jne 0x44359e
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push eax
push 0
push ecx
push 2
push 1
mov ecx, ebp
call fcn.00426350
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0048f641
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret 8