Function at 0x43fcd7
Capabilities:
Create thread
Delete file
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x124]
sub esp, 0x1a4
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp + 0x120], eax
mov eax, dword [ebp + 0x130]
push ebx
push esi
mov esi, dword [ebp + 0x12c]
push edi
mov dword [ebp - 0x80], eax
xor eax, eax
mov word [ebp - 0x74], ax
lea edi, [ebp - 0x72]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
push 0x103
stosw word es:[edi], ax
lea eax, [ebp + 0x1d]
push ebx
push eax
mov dword [ebp - 0x7c], esi
mov byte [ebp + 0x1c], bl
call fcn.00452e00
push 0x3f
lea eax, [ebp - 0x63]
push ebx
push eax
mov byte [ebp - 0x64], bl
call fcn.00452e00
push 0x3f
lea eax, [ebp - 0x23]
push ebx
push eax
mov byte [ebp - 0x24], bl
call fcn.00452e00
add esp, 0x24
mov dword [ebp - 0x78], ebx
cmp dword [ebp + 0x140], ebx
je 0x43fd61
push dword [ebp + 0x140]
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 0x138], ebx
je 0x43fd70
mov dword [esi*4 + 0x480294], ebx
cmp dword [0x480260], ebx
je 0x43fd7f
xor eax, eax
jmp 0x44021f
mov eax, dword [esi*4 + 0x480274]
cmp eax, 1
jge 0x43fda5
push 0x12040
push str.System_Message
push str.The_file_is_empty._n_nPlease_add_commands_before_using_this_feature.
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x43fd78
dec eax
cmp dword [ebp + 0x13c], eax
jg 0x43fd78
lea eax, [ebp + 0x1c]
push eax
call fcn.00424df8
push ebx
push ebx
push str.RestartLog
call fcn.0040225d
test eax, eax
je 0x43fdd1
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x405
cmp word [ebp + 0x134], ax
je 0x43fdf4
add eax, 2
cmp word [ebp + 0x134], ax
jne 0x4400c2
jmp 0x43ff7f
push ebx
push ebx
push str.ResetUserVariables
call fcn.0040225d
test eax, eax
je 0x43fe6a
push str.vTaskClass
call fcn.0044a84a
cmp eax, 1
jg 0x43fe6a
test byte [0x480320], 2
jne 0x43fe6a
push str.SOFTWARE_vTaskUserVariables
push ebx
push ebx
push ebx
push 4
call fcn.0044ad45
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x14
push ebx
push ebx
push 0x1009
push 0x508
push dword [0x4800f0]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x102f
push 0x508
push dword [0x4800f0]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor edx, edx
cmp dword [esi*4 + 0x480274], ebx
jle 0x43fea0
lea eax, [esi*4 + 0x481990]
xor ecx, ecx
mov edi, dword [eax]
mov dword [ecx + edi + 0xf28], ebx
mov edi, dword [eax]
mov byte [ecx + edi + 0xf24], bl
inc edx
add ecx, 0xf54
cmp edx, dword [esi*4 + 0x480274]
jl 0x43fe7e
cmp dword [0x48032c], ebx
je 0x43fec7
push dword [0x4800f4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x43fec7
push 1
push ebx
push dword [0x4800f4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x40
push ebx
push 0x484e30
mov dword [0x480108], ebx
mov dword [0x484e28], ebx
mov dword [0x484e2c], ebx
mov dword [0x484df8], ebx
mov byte [0x4841c8], bl
call fcn.00452e00
push 0x100
push ebx
push 0x484e70
call fcn.00452e00
mov edi, esi
push 0x40
shl edi, 6
lea eax, [edi + 0x484378]
push ebx
push eax
call fcn.00452e00
push 0x40
lea eax, [edi + 0x484578]
push ebx
push eax
call fcn.00452e00
push 0x40
lea eax, [edi + 0x484778]
push ebx
push eax
call fcn.00452e00
push 0x40
lea eax, [edi + 0x484978]
push ebx
push eax
call fcn.00452e00
add esp, 0x48
push 0x40
lea eax, [edi + 0x484b78]
push ebx
push eax
call fcn.00452e00
push 8
push ebx
push 0x485218
call fcn.00452e00
push 8
push ebx
push 0x485220
call fcn.00452e00
push 8
push ebx
push 0x485228
call fcn.00452e00
add esp, 0x30
push str.SOFTWARE_vTaskFailStep
push ebx
push ebx
push ebx
push 4
call fcn.0044ad45
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
lea eax, [ebp + 0x1c]
push str.SOFTWARE_vTaskInterStepDelay__d
push eax
mov dword [0x485430], ebx
call edi
add esp, 0x20
lea eax, [ebp + 0x1c]
push eax
call fcn.0040676e
push str.__r_n
call fcn.0042604a
lea eax, [ebp + 0x1c]
mov dword [esp], str._____START_OF_RUN
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + 0x1c]
push eax
call esi
push 0x3c
pop ecx
sub ecx, eax
jns 0x43ffe4
xor ecx, ecx
jmp 0x43ffef
lea eax, [ebp + 0x1c]
push eax
call esi
push 0x3c
pop ecx
sub ecx, eax
push ecx
push 0x2d
lea eax, [ebp + 0x1c]
push eax
call esi
lea eax, [ebp + eax + 0x1c]
push eax
call fcn.00452e00
lea eax, [ebp + 0x1c]
push eax
mov byte [ebp + 0x58], bl
call fcn.0042604a
mov eax, dword [ebp - 0x7c]
imul eax, eax, 0x104
add eax, 0x4804f8
push eax
lea eax, [ebp + 0x1c]
push str.SCRIPT:___s_
push eax
call edi
lea eax, [ebp + 0x1c]
push eax
call fcn.0042604a
add esp, 0x20
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x64]
push eax
movzx eax, word [ebp - 0x70]
push 1
push eax
call fcn.0041c2d7
lea eax, [ebp - 0x24]
push eax
movzx eax, word [ebp - 0x72]
push 3
push eax
call fcn.0041c2d7
movzx eax, word [ebp - 0x74]
push eax
lea eax, [ebp - 0x24]
push eax
movzx eax, word [ebp - 0x6e]
push eax
lea eax, [ebp - 0x64]
push eax
movzx eax, word [ebp - 0x68]
push eax
movzx eax, word [ebp - 0x6a]
push eax
movzx eax, word [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1c]
push str.TIME:____d:_02d:_02d_on__s___d__s__d
push eax
call edi
lea eax, [ebp + 0x1c]
push eax
call fcn.0042604a
add esp, 0x40
cmp byte [0x4840a0], 2
jb 0x4400aa
push str.LOG_LEVEL_HIGH
call fcn.0042604a
pop ecx
lea eax, [ebp + 0x1c]
push eax
push ebx
push 1
push dword [0x4800d4]
call fcn.00424cda
mov esi, dword [ebp - 0x7c]
add esp, 0x10
push ebx
push ebx
push str.DisableScreenSaver
call fcn.0040225d
test eax, eax
je 0x440109
mov edi, str.HKEY_CURRENT_USERControl_PanelDesktopScreenSaveActive
push edi
push 0xf
lea eax, [ebp + 0x1c]
push eax
push ebx
push 3
call fcn.0044ad45
push edi
push 2
push 0x466c54
push 1
push 2
call fcn.0044ad45
push str.ScreenSaverHolder
lea eax, [ebp + 0x1c]
push ebx
push eax
call fcn.0044dba4
add esp, 0x34
movzx eax, byte [0x47e00c]
push eax
mov dword [0x480338], ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp dword [ebp + 0x13c], ebx
jge 0x440129
xor eax, eax
jmp 0x44013f
mov eax, dword [esi*4 + 0x480274]
dec eax
cmp dword [ebp + 0x13c], eax
jg 0x44013f
mov eax, dword [ebp + 0x13c]
push ebx
shl esi, 0x1c
push ebx
add esi, eax
push str.RunTrackingShow
mov dword [ebp - 0x78], esi
call fcn.0040225d
test eax, eax
je 0x440205
mov eax, 0x405
cmp word [ebp + 0x134], ax
je 0x440179
add eax, 2
cmp word [ebp + 0x134], ax
jne 0x440205
mov eax, dword [0x4841ac]
cmp eax, ebx
je 0x44018d
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push str.SOFTWARE_vTaskColorsResultSuccessFill
mov dword [0x484f98], ebx
call fcn.0040225d
cmp eax, ebx
jne 0x4401a8
mov eax, 0xecffec
push eax
push ebx
push ebx
push str.RunTrackingAlpha
call fcn.0040225d
push eax
push ebx
push ebx
push str.RunTrackingTimeout
call fcn.0040225d
push eax
push ebx
call fcn.004482a1
lea eax, [eax + eax + 0xa]
push eax
push ebx
push ebx
push str.RunTrackingWidth
call fcn.0040225d
push eax
push ebx
push ebx
push str.RunTrackingY
call fcn.0040225d
push eax
push ebx
push ebx
push str.RunTrackingX
call fcn.0040225d
push eax
push dword [0x4800c0]
call fcn.0044a8d1
mov dword [0x4841ac], eax
lea eax, [ebp - 0x78]
push eax
push ebx
push dword [ebp - 0x78]
push 0x43f40f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x480260], eax
mov ecx, dword [ebp + 0x120]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
add ebp, 0x124
leave
ret 0x18