Function at 0x41ba30
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a61a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x818
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
push 4
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00487fa3
mov eax, dword [eax]
mov esi, str..lnk
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41baa1
test cl, cl
je 0x41ba9d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41baa1
add eax, 2
add esi, 2
test cl, cl
jne 0x41ba79
xor eax, eax
jmp 0x41baa6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x14]
sete bl
call fcn.0048fb71
test bl, bl
je 0x41be46
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x824]
push eax
push ecx
mov ecx, edi
call fcn.00426f80
test eax, eax
je 0x41be39
lea edi, [ebp - 0x824]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x41bb55
push 0x2e
lea ecx, [ebp + 0xc]
call fcn.00488097
push 0x5c
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.00488097
push 0x5c
lea ecx, [ebp + 0xc]
mov edi, eax
call fcn.00488097
sub esi, edi
lea edx, [ebp - 0x18]
dec esi
inc eax
push esi
push eax
push edx
lea ecx, [ebp + 0xc]
call fcn.00487f0d
push eax
lea eax, [ebp - 0x14]
push 0x4d6188
push eax
mov byte [ebp - 4], 2
call fcn.0048fe7a
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.0048fcaa
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0048fb71
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0048fb71
jmp 0x41bb64
lea ecx, [ebp - 0x824]
push ecx
lea ecx, [ebp + 0xc]
call fcn.0048fcfa
lea edx, [ebp - 0x14]
push 4
push edx
lea ecx, [ebp + 0xc]
call fcn.00487fa3
mov eax, dword [eax]
mov byte [ebp - 4], 4
mov esi, str..EXE
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41bba5
test cl, cl
je 0x41bba1
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41bba5
add eax, 2
add esi, 2
test cl, cl
jne 0x41bb7d
xor eax, eax
jmp 0x41bbaa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41bc01
lea eax, [ebp - 0x18]
push 4
push eax
lea ecx, [ebp + 0xc]
call fcn.00487fa3
mov eax, dword [eax]
mov esi, 0x4d61d8
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41bbeb
test cl, cl
je 0x41bbe7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41bbeb
add eax, 2
add esi, 2
test cl, cl
jne 0x41bbc3
xor eax, eax
jmp 0x41bbf0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x18]
sete bl
call fcn.0048fb71
test bl, bl
je 0x41bc03
mov bl, 1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0048fb71
test bl, bl
jne 0x41bdfd
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 0x1c8]
test eax, eax
je 0x41be46
push 0x2e
lea ecx, [ebp + 0xc]
call fcn.00488097
push 0x5c
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.00488097
cmp esi, eax
jle 0x41bcd1
push 0x2e
lea ecx, [ebp + 0xc]
call fcn.00488097
push 0x2f
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.00488097
cmp esi, eax
jle 0x41bcd1
push 1
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.00487bd9
lea edx, [ebp - 0x18]
push 1
push edx
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 5
call fcn.00487fa3
mov esi, dword [ebp - 0x14]
mov eax, dword [eax]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41bcab
test cl, cl
je 0x41bca7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41bcab
add eax, 2
add esi, 2
test cl, cl
jne 0x41bc83
xor eax, eax
jmp 0x41bcb0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x18]
sete bl
call fcn.0048fb71
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0048fb71
test bl, bl
je 0x41be46
lea eax, [ebp - 0x20]
push 5
push eax
lea ecx, [ebp + 0xc]
call fcn.0048801f
mov eax, dword [eax]
mov byte [ebp - 4], 6
mov esi, 0x4d6180
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41bd12
test cl, cl
je 0x41bd0e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41bd12
add eax, 2
add esi, 2
test cl, cl
jne 0x41bcea
xor eax, eax
jmp 0x41bd17
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41bdeb
lea eax, [ebp - 0x18]
push 2
push eax
lea ecx, [ebp + 0xc]
call fcn.0048801f
mov eax, dword [eax]
mov esi, 0x4d6188
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41bd5c
test cl, cl
je 0x41bd58
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41bd5c
add eax, 2
add esi, 2
test cl, cl
jne 0x41bd34
xor eax, eax
jmp 0x41bd61
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x18]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x41bdeb
lea eax, [ebp - 0x14]
push 6
push eax
lea ecx, [ebp + 0xc]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.shell:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41bdaf
test cl, cl
je 0x41bdab
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41bdaf
add eax, 2
add esi, 2
test cl, cl
jne 0x41bd87
xor eax, eax
jmp 0x41bdb4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x14]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x41bdeb
mov eax, dword [ebp + 0xc]
cmp byte [eax + 1], 0x3a
jne 0x41bde7
mov al, byte [eax + 2]
cmp al, 0x5c
je 0x41bdeb
cmp al, 0x2f
sete cl
test cl, cl
jne 0x41bdeb
test al, al
sete al
test al, al
jne 0x41bdeb
xor bl, bl
jmp 0x41bded
mov bl, 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0048fb71
test bl, bl
je 0x41be46
mov eax, dword [ebp + 0xc]
push 5
push 0
push 0x4db730
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.0048fb71
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.about:blank
lea ecx, [ebp + 0xc]
call fcn.0048fcfa
push ecx
lea edx, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x24], esp
push edx
call fcn.0048f8e6
mov edi, dword [ebp - 0x1c]
mov ecx, edi
call fcn.00444aa0
test eax, eax
jne 0x41be17
push eax
mov ecx, edi
call fcn.0049ca17
mov esi, eax
test esi, esi
je 0x41beb1
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x41beb1
mov eax, dword [0x4dd8c8]
test eax, eax
jne 0x41beb1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x41beb1
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0xf8]
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call fcn.004571b0
jmp 0x41be17
push 0
push 0
push 0
push 1
push 0
mov ecx, edi
call fcn.00427110
mov esi, eax
test esi, esi
je 0x41be17
mov ecx, dword [esi + 0xf8]
test ecx, ecx
je 0x41be17
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
je 0x41bee8
push eax
call fcn.00453190
mov ecx, dword [ebp + 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [esi + 0xf8]
call fcn.004571b0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x3b4]
test ecx, ecx
jne 0x41bf1d
cmp dword [eax + 0x47c], 1
jne 0x41be17
mov eax, dword [eax + 0xbb0]
push 0
push 0
push 0x407
mov edx, dword [eax + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call fcn.0048c2a9
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.0048f12d
jmp 0x41be17