Function at 0x401000
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Get file attributes
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
xor ebx, ebx
mov dword [ebp - 4], eax
push ebx
push str.KHSubFolder
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x401041
cmp dword [ebp - 4], ebx
jge 0x401093
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4012d5
cmp dword [ebp - 4], ebx
jl 0x4012d5
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x401093
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessDPIAware
push edi
call esi
cmp eax, ebx
je 0x40106f
call eax
push str.ChangeWindowMessageFilter
push edi
call esi
mov esi, eax
cmp esi, ebx
je 0x40108c
push 1
push 0x8002
call esi
push 1
push 0x4a
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, bl
je 0x4012d5
inc esi
cmp al, 0x2e
jne 0x40109b
mov eax, dword [esi]
and eax, 0xdddfdfdf
cmp eax, 0x455845
jne 0x40109b
add esi, 3
cmp byte [esi], 0x22
jne 0x4010c1
inc esi
cmp byte [esi], 0x20
jne 0x4010c7
inc esi
cmp dword [ebp - 8], ebx
je 0x401125
cmp byte [esi], 0x40
je 0x4012d5
mov ecx, esi
mov dword [ebp - 0xc], ecx
cmp byte [esi], bl
je 0x4010e1
inc esi
jmp 0x4010da
sub esi, ecx
mov eax, 0x120
inc esi
cmp esi, eax
mov dword [ebp - 0x10], esi
jbe 0x4010f9
mov dword [ebp - 0x10], eax
mov byte [ecx + 0x11f], bl
lea eax, [ebp - 4]
push eax
push 0x7f
lea eax, [ebp - 0x14]
push 2
push eax
push ebx
push 0x4a
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x4012d5
push ebx
push ebx
push 0x10
push dword [ebp - 8]
jmp 0x401036
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ecx, dword [ebp - 4]
cmp eax, ebx
mov dword [ecx*4 + 0x406778], eax
je 0x4012b4
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jle 0x401128
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0x6b
push edi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [0x406864], eax
mov dword [ebp - 0x50], 0x30
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], fcn.004012df
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x28], str.KHSubFolder
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea eax, [ebp - 0x50]
push ebx
push eax
push 0x3c
push 0x1f
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
je 0x4011ce
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x4011d6
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push ebx
push edi
push ebx
push ebx
push 0x21
push 0x7f
push ebx
push ebx
push 0x80000000
push ebx
push str.KHSubFolder
push 0x88
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [0x406868], eax
je 0x4012b4
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [0x406808], eax
je 0x4012b4
push dword [0x406868]
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebp - 8]
mov dword [0x406814], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call edi
mov dword [ebp - 4], eax
mov dword [0x4062b4], 0xfffffffd
cmp byte [esi], 0x40
je 0x401277
push 0x80008000
push esi
push 0x8002
push dword [0x406868]
call dword [sym.imp.USER32.dll_PostMessageA]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x50]
push ebx
push eax
call esi
test eax, eax
je 0x40129d
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x50]
push ebx
push eax
jmp 0x401284
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [ebp - 4]
call edi
push dword [0x406808]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 4], 0x1f
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x406778]
cmp eax, ebx
je 0x4012d0
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
dec dword [ebp - 4]
jns 0x4012bb
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]