Function at 0x4b3964
Capabilities:
Delete registry value
Log keystrokes via polling
Set registry value

Disassembly:
push 0xf0
mov eax, 0x51173d
call fcn.004f41e2
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xf4], edx
xor edx, edx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xd8], edx
test ecx, ecx
je 0x4b39a5
cmp word [ecx], dx
jne 0x4b39af
mov dword [ebp - 0xe0], 0x5242d0
test eax, eax
je 0x4b39b8
cmp word [eax], dx
jne 0x4b39bd
mov eax, str.cmd__cur_console:n
push eax
call fcn.004e5a9d
pop ecx
push 0x10
mov dword [ebp - 0xdc], eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
lea ecx, [ebp - 0xc8]
and eax, 0xffffff01
mov dword [ebp - 0xfc], eax
call fcn.004e25a1
mov ecx, dword [0x5a22a0]
lea eax, [ebp - 0xc8]
push esi
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.0041129d
mov edx, dword [0x5a22a0]
mov esi, eax
add edx, 0xa90
mov dword [ebp - 0xf0], esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x4b3a1a
sub edx, ecx
sar edx, 1
test ebx, ebx
je 0x4b3a4e
mov ecx, ebx
xor ebx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4b3a34
sub ecx, esi
mov esi, dword [ebp - 0xf0]
sar ecx, 1
lea edi, [ecx + 0x23]
jmp 0x4b3a53
push 0x20
pop edi
xor ebx, ebx
test esi, esi
je 0x4b3a70
mov ecx, esi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4b3a5c
sub ecx, esi
sar ecx, 1
lea esi, [ecx + 1]
jmp 0x4b3a72
mov esi, ebx
mov ecx, dword [ebp - 0xdc]
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xd8]
jne 0x4b3a7b
sub ecx, ebx
add edi, edx
sar ecx, 1
add edi, ecx
add edi, esi
lea eax, [edi + edi]
push eax
call fcn.004e1c0a
mov esi, eax
pop ecx
test esi, esi
je 0x4b3e1d
mov eax, dword [ebp - 0xdc]
xor edx, edx
mov bl, dl
movzx ecx, word [eax]
cmp ecx, 0x2f
je 0x4b3ac3
cmp ecx, 0x2d
je 0x4b3ac3
mov bl, 1
jmp 0x4b3b14
lea ecx, [ebp - 0x6c]
call fcn.004e25a1
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xd8], eax
xor eax, eax
push eax
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.004e55bb
add esp, 0xc
test eax, eax
jne 0x4b3b05
lea ecx, [ebp - 0x6c]
call fcn.004e2942
mov bl, al
neg bl
sbb bl, bl
inc bl
xor eax, eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], al
call fcn.004e25e0
xor edx, edx
cmp dword [0x5a22cc], 6
ja 0x4b3b30
jne 0x4b3b28
cmp dword [0x5a22d0], 0
ja 0x4b3b30
mov byte [ebp - 0xc9], dl
jmp 0x4b3b37
mov byte [ebp - 0xc9], 1
mov dword [ebp - 0xe8], 1
push 0x524d9c
push edi
push esi
call fcn.00401a0b
mov eax, dword [0x5a22a0]
add eax, 0xa90
push eax
push edi
push esi
call fcn.004019cd
push 0x524d94
push edi
push esi
call fcn.004019cd
mov eax, dword [ebp - 0xec]
xor ecx, ecx
test eax, eax
je 0x4b3bbb
cmp word [eax], cx
je 0x4b3bbb
push eax
call fcn.004e53f3
mov bh, al
pop ecx
test bh, bh
je 0x4b3b95
push 0x524d9c
push edi
push esi
call fcn.004019cd
push dword [ebp - 0xec]
push edi
push esi
call fcn.004019cd
test bh, bh
mov ecx, 0x5225e4
mov eax, 0x524d94
cmove eax, ecx
push eax
push edi
push esi
call fcn.004019cd
xor ecx, ecx
mov eax, dword [ebp - 0xf0]
test eax, eax
je 0x4b3bdf
cmp word [eax], cx
je 0x4b3bdf
push eax
push edi
push esi
call fcn.004019cd
mov eax, 0x5225e4
push eax
push edi
push esi
call fcn.004019cd
xor eax, eax
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xe8]
sub eax, 1
je 0x4b3c5a
sub eax, 1
je 0x4b3c4e
sub eax, 1
je 0x4b3c35
sub eax, 1
je 0x4b3c1d
sub eax, 1
je 0x4b3c11
sub eax, 1
je 0x4b3e00
jmp 0x4b3c64
mov dword [ebp - 0xd4], str.SoftwareClassesDrive_shell
jmp 0x4b3c27
mov dword [ebp - 0xd4], str.SoftwareClassesDirectory_shell
push str._dir___1_
push edi
push esi
call fcn.004019cd
jmp 0x4b3c64
cmp byte [ebp - 0xc9], 0
je 0x4b3e00
mov dword [ebp - 0xd4], str.SoftwareClassesLibraryFolderBackground_shell
jmp 0x4b3c64
mov dword [ebp - 0xd4], str.SoftwareClassesDirectoryBackground_shell
jmp 0x4b3c64
mov dword [ebp - 0xd4], str.SoftwareClasses_shell
test bl, bl
je 0x4b3c74
push 0x5260ec
push edi
push esi
call fcn.004019cd
push dword [ebp - 0xdc]
push edi
push esi
call fcn.004019cd
xor ecx, ecx
lea eax, [ebp - 0xd8]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push dword [ebp - 0xd4]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4b3e00
xor ecx, ecx
lea eax, [ebp - 0xd0]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push dword [ebp - 0xe0]
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4b3df4
push dword [ebp - 0xe0]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0xe0]
xor eax, eax
push 1
push eax
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xf4]
test eax, eax
je 0x4b3d3e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0xf4]
lea eax, [eax*2 + 2]
push eax
push edx
push 1
xor eax, eax
push eax
push str.Icon
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4b3d4f
push str.Icon
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
lea eax, [ebp - 0xf8]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x55ef94
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4b3da5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
xor eax, eax
push eax
push eax
push dword [ebp - 0xf8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xf8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov word [ebp - 0xe4], ax
cmp byte [ebp - 0xfc], al
je 0x4b3dd7
push 2
lea eax, [ebp - 0xe4]
push eax
push 1
xor eax, eax
push eax
push str.Extended
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4b3de8
push str.Extended
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp eax, 6
jle 0x4b3b41
push esi
call fcn.004e1bea
pop ecx
lea ecx, [ebp - 0xc8]
call fcn.004e25e0
call fcn.004f418c
ret