Function at 0x4d20d0
Capabilities:
Create process on windows
Create thread
Log keystrokes via application hook
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4f8be6
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [sym.imp.MSVCR90.dll__beginthreadex]
xor ebp, ebp
cmp dword [esi + 0x324ac], ebp
jne 0x4d2122
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push 0x4a8780
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x324ac], eax
mov edi, 0x100000
cmp dword [0x10da074], ebp
jne 0x4d2161
test dword [0x103a364], edi
je 0x4d2161
cmp byte [0x1038f42], 0
jne 0x4d2161
test byte [0x104311c], 1
jne 0x4d2161
lea ecx, [esp + 0x14]
push ecx
push ebp
push esi
push 0x4a82a0
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [0x10da074], eax
test dword [0x1042d7c], edi
je 0x4d2181
lea edx, [esp + 0x14]
push edx
push ebp
push esi
push 0x496080
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [0x10d7c5c], eax
mov eax, dword [0x10430b0]
test eax, 0x800
je 0x4d219b
test eax, 0x400000
jne 0x4d219b
mov byte [0x10d7c6e], 1
test byte [0x104311c], 1
mov edi, 0x8000
je 0x4d21b2
mov byte [0x10d7c6f], 1
jmp 0x4d21cc
cmp byte [0x10d7c6f], 0
jne 0x4d21cc
cmp byte [0x10d7c6e], 0
jne 0x4d21cc
test dword [0x10430dc], edi
je 0x4d2224
cmp dword [0x10da0b4], ebp
jne 0x4d21ec
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push 0x4d0cf0
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [0x10da0b4], eax
mov byte [0x10da09b], 0
test dword [0x10430dc], edi
je 0x4d2224
test byte [0x104311c], 1
jne 0x4d2224
cmp dword [0x10da078], ebp
jne 0x4d2224
lea ecx, [esp + 0x14]
push ecx
push ebp
push esi
push 0x4992e0
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [0x10da078], eax
mov ecx, dword [esi + 0x80]
cmp ecx, ebp
je 0x4d223b
mov edx, dword [ecx]
mov eax, dword [edx + 0x68]
call eax
mov dword [esi + 0x80], ebp
mov ecx, dword [esi + 0x84]
cmp ecx, ebp
je 0x4d2252
mov edx, dword [ecx]
mov eax, dword [edx + 0x68]
call eax
mov dword [esi + 0x84], ebp
mov ecx, dword [esi + 0x88]
cmp ecx, ebp
je 0x4d2269
mov edx, dword [ecx]
mov eax, dword [edx + 0x68]
call eax
mov dword [esi + 0x88], ebp
test dword [0x10430b0], 0x800
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x4d22ea
test byte [0x10430dc], 4
je 0x4d22ea
test byte [0x104311c], 1
jne 0x4d22ea
cmp dword [esi + 0x80], ebp
jne 0x4d22ea
push 0x64
call edi
push 0x14c
call sub.mfc90.dll_Ordinal_798
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], ebp
cmp eax, ebp
je 0x4d22bc
push ebp
mov ecx, eax
call fcn.00499ff0
jmp 0x4d22be
xor eax, eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esi + 0x80], eax
mov edx, dword [eax]
push ebp
mov ecx, eax
mov eax, dword [edx + 0x144]
push 0x82
call eax
mov ecx, dword [esi + 0x80]
push ebp
call sub.mfc90.dll_Ordinal_6584
test dword [0x10430dc], 0x8000
je 0x4d2360
test byte [0x104311c], 1
jne 0x4d2360
cmp dword [esi + 0x84], ebp
jne 0x4d2360
push 0x64
call edi
push 0x14c
call sub.mfc90.dll_Ordinal_798
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 1
cmp eax, ebp
je 0x4d2332
push ebp
mov ecx, eax
call fcn.00499ff0
jmp 0x4d2334
xor eax, eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esi + 0x84], eax
mov edx, dword [eax]
push ebp
mov ecx, eax
mov eax, dword [edx + 0x144]
push 0x82
call eax
mov ecx, dword [esi + 0x84]
push ebp
call sub.mfc90.dll_Ordinal_6584
test dword [0x1038d14], 0x80000000
jne 0x4d23e2
test dword [0x10430dc], 0x1000000
je 0x4d23e2
test byte [0x104311c], 1
jne 0x4d23e2
cmp dword [esi + 0x88], ebp
jne 0x4d23e2
push 0x64
call edi
push 0x14c
call sub.mfc90.dll_Ordinal_798
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 2
cmp eax, ebp
je 0x4d23b4
push ebp
mov ecx, eax
call fcn.00499ff0
jmp 0x4d23b6
xor eax, eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esi + 0x88], eax
mov edx, dword [eax]
push ebp
mov ecx, eax
mov eax, dword [edx + 0x144]
push 0x82
call eax
mov ecx, dword [esi + 0x88]
push ebp
call sub.mfc90.dll_Ordinal_6584
test dword [0x10430b0], 0x800
mov edi, pe_nt_image_headers32
je 0x4d244b
test byte [0x104311c], 1
jne 0x4d244b
cmp dword [0x10da0a8], ebp
jne 0x4d2423
lea ecx, [esp + 0x14]
push ecx
push ebp
push esi
push 0x4d0720
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [0x10da0a8], eax
mov byte [0x10da09a], 0
cmp dword [0x10d7c3c], ebp
jne 0x4d244b
test dword [0x10430dc], edi
je 0x4d244b
lea edx, [esp + 0x14]
push edx
push ebp
push esi
push 0x4b3110
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [0x10d7c3c], eax
test dword [0x103a364], 0x30000
je 0x4d2481
test byte [0x104311c], 1
jne 0x4d2481
cmp dword [esi + 0x3247c], ebp
jne 0x4d2481
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push fcn.0047d550
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x3247c], eax
test dword [0x1039f54], 0x80000000
je 0x4d24c8
cmp dword [0x1043074], ebp
jne 0x4d24c8
test byte [0x104311c], 1
jne 0x4d24c8
cmp dword [esi + 0x32480], ebp
jne 0x4d2c20
lea ecx, [esp + 0x14]
push ecx
push ebp
push ebp
push 0x4a7bc0
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x32480], eax
jmp 0x4d2c20
mov edx, dword [0x1070778]
cmp dword [edx - 0xc], ebp
je 0x4d2536
cmp dword [0x1042d5c], ebp
jne 0x4d24eb
cmp dword [0x1042d7c], ebp
jne 0x4d24eb
cmp dword [0x1042d64], ebp
je 0x4d2536
mov byte [0x10da2c3], 0
cmp dword [esi + 0x324a8], ebp
jne 0x4d252c
cmp byte [0x103b0fc], 0
je 0x4d2513
cmp byte [0x571aec], 0
je 0x4d252c
lea eax, [esp + 0x14]
push eax
jmp 0x4d2518
lea ecx, [esp + 0x14]
push ecx
push ebp
push esi
push 0x461f60
push ebp
push ebp
call ebx
mov dword [esi + 0x324a8], eax
add esp, 0x18
or dword [0x103a360], 0x10000000
cmp dword [0x1043074], ebp
jne 0x4d260b
cmp dword [esi + 0x324e0], ebp
je 0x4d2571
cmp dword [0x10d7c40], ebp
jne 0x4d2571
lea edx, [esp + 0x14]
push edx
push ebp
push 1
push 0x458b20
push ebp
push ebp
mov dword [esi + 0x324e0], ebp
call ebx
add esp, 0x18
mov dword [0x10d7c40], eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x30], 3
push 0x10da2e0
lea eax, [esp + 0x20]
push str._sLog_fw.fw
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
push 0x4ff418
push 0x502d68
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
test dword [0x1042d7c], 0x2000
je 0x4d25e3
mov ecx, dword [esp + 0x1c]
push ebp
push 1
push ecx
call fcn.0046aae0
add esp, 0xc
test eax, eax
je 0x4d25e3
lea edx, [esp + 0x14]
push edx
push ebp
push 3
push 0x4351a0
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test dword [0x10430ec], 0x400
jne 0x4d2653
cmp byte [esi + 0xad], 0
jne 0x4d2653
cmp dword [esi + 0x32478], ebp
jne 0x4d2653
movzx ecx, word [0x103a970]
lea eax, [esp + 0x14]
push eax
push ebp
push ecx
push 0x44c2c0
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x32478], eax
cmp eax, ebp
je 0x4d25f5
or dword [0x103a360], 1
test byte [0x104311c], 1
jne 0x4d25f5
test dword [0x10430f8], 0x80000000
jne 0x4d2689
cmp dword [esi + 0x32484], ebp
jne 0x4d2689
lea edx, [esp + 0x14]
push edx
push ebp
push ebp
push 0x4baf70
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x32484], eax
test byte [0x1038f44], 0xc
je 0x4d26b3
cmp dword [esi + 0x32488], ebp
jne 0x4d26b3
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push 0x494980
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x32488], eax
test dword [0x1042d7c], 0x4000
je 0x4d26e0
cmp dword [esi + 0x32494], ebp
jne 0x4d26e0
lea ecx, [esp + 0x14]
push ecx
push ebp
push ebp
push 0x47c340
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x32494], eax
test dword [0x1042d7c], 0x8000
je 0x4d270d
cmp dword [esi + 0x32490], ebp
jne 0x4d270d
lea edx, [esp + 0x14]
push edx
push ebp
push ebp
push 0x4690a0
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x32490], eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x30], 4
push 0x10da2e0
lea eax, [esp + 0x1c]
push str._sLog_fw.fw
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
push 0x4ff418
push 0x502d68
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
test dword [0x1042d7c], 0x2000
jne 0x4d277f
mov ecx, dword [esp + 0x18]
push ebp
push 1
push ecx
call fcn.0046aae0
add esp, 0xc
test eax, eax
je 0x4d277f
lea edx, [esp + 0x14]
push edx
push ebp
push 3
push 0x4351a0
push ebp
push ebp
call ebx
add esp, 0x18
test dword [0x10430e4], 0x1800000
jne 0x4d27f2
mov eax, 0x2000000
test dword [0x10430f8], eax
jne 0x4d27a0
test dword [0x10430f4], eax
je 0x4d27f2
mov eax, dword [0x10da2d0]
cmp eax, ebp
je 0x4d28a1
cmp dword [0x10dca00], ebp
je 0x4d28a1
push str.UnInstallRecord
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10dca04], eax
cmp eax, ebp
je 0x4d28a1
call eax
push ebp
mov dword [0x10dca00], ebp
mov dword [0x10dca04], ebp
mov dword [0x10da2d0], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4d28a1
cmp dword [0x10da2d0], ebp
jne 0x4d28a1
lea eax, [esp + 0x24]
push eax
call fcn.00465390
mov byte [esp + 0x34], 5
push 0x4ff418
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00402a60
mov bl, 6
mov byte [esp + 0x40], bl
push str.tc_prih.dll
push eax
lea edx, [esp + 0x34]
push edx
call fcn.00402a60
add esp, 0x1c
mov byte [esp + 0x30], 7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10da2d0], eax
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x30], 5
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x30], 4
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [0x10da2d0]
push str.InstallRecord
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10dca00], eax
cmp eax, ebp
je 0x4d289b
call eax
or dword [0x103a360], 0x100000
mov ebx, dword [sym.imp.MSVCR90.dll__beginthreadex]
test byte [0x1043044], 1
mov byte [0x10da2c5], 0
je 0x4d290f
test dword [0x10430f0], edi
je 0x4d28da
cmp dword [esi + 0x324b4], ebp
jne 0x4d28da
lea ecx, [esp + 0x14]
push ecx
push ebp
push esi
push 0x45a530
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x324b4], eax
test byte [0x1043044], 1
je 0x4d290f
test dword [0x10430f4], 0x25989094
je 0x4d290f
cmp dword [esi + 0x324e0], ebp
jne 0x4d293e
lea edx, [esp + 0x14]
push edx
push ebp
push ebp
push 0x458b20
push ebp
push ebp
call ebx
mov dword [esi + 0x324e0], eax
jmp 0x4d293b
cmp dword [esi + 0x324e0], ebp
je 0x4d293e
cmp dword [0x10d7c44], ebp
jne 0x4d293e
lea eax, [esp + 0x14]
push eax
push ebp
push 1
push 0x458b20
push ebp
push ebp
mov dword [esi + 0x324e0], ebp
call ebx
mov dword [0x10d7c44], eax
add esp, 0x18
test byte [0x1043044], 1
mov byte [0x10da2c0], 0
je 0x4d298a
test dword [0x10430f4], edi
jne 0x4d298a
test dword [0x10430f8], edi
jne 0x4d298a
test dword [0x10430f0], edi
jne 0x4d298a
cmp dword [esi + 0x78], ebp
jne 0x4d2a27
lea ecx, [esp + 0x14]
push ecx
push ebp
push esi
push 0x45ba10
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x78], eax
jmp 0x4d2a27
call fcn.00497660
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x30], 8
push 0x6d1
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_4431]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push str.__set__subcategory:_
push eax
call fcn.00410070
mov bl, 9
mov byte [esp + 0x3c], bl
push str.___success:disable
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.00402a60
add esp, 0x18
mov byte [esp + 0x30], 0xa
mov eax, dword [eax]
push ebp
push ebp
push eax
push str.auditpol
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x30], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x30], 4
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ebx, dword [sym.imp.MSVCR90.dll__beginthreadex]
test byte [0x1043044], 1
mov byte [0x10da2c2], 0
je 0x4d2a43
test dword [0x10430f4], 0x400000
jne 0x4d2a4f
test dword [0x1038d14], 0x400000
jne 0x4d2a6d
cmp dword [0x10d7c48], ebp
jne 0x4d2a80
push ebp
push ebp
push 0x499620
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x10d7c48], eax
jmp 0x4d2a80
mov edx, dword [0x10dc9f4]
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x10d7c48], ebp
test byte [0x1043044], 1
je 0x4d2ab6
test dword [0x10430f4], 0x91f0
je 0x4d2ab6
cmp dword [esi + 0x3249c], ebp
jne 0x4d2ab6
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push 0x4400b0
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x3249c], eax
cmp dword [0x103b100], ebp
je 0x4d2af3
cmp dword [0x10da2dc], ebp
je 0x4d2af3
test dword [0x103a364], 0x4000000
jne 0x4d2af3
cmp dword [esi + 0x324a0], ebp
jne 0x4d2af3
lea ecx, [esp + 0x14]
push ecx
push ebp
push esi
push 0x494f70
push ebp
push ebp
call ebx
add esp, 0x18
mov dword [esi + 0x324a0], eax
mov eax, dword [0x103a97c]
cmp eax, 0x88
je 0x4d2b04
cmp eax, 0x77
jne 0x4d2b75
movzx edx, byte [0x571aec]
movzx eax, byte [0x103b0fc]
mov ecx, dword [esi + 0x324a8]
push edx
mov edx, dword [0x1042d64]
push eax
mov eax, dword [0x1042d7c]
push ecx
mov ecx, dword [0x1042d5c]
push edx
mov edx, dword [0x10707ac]
push eax
push ecx
mov ecx, dword [0x10707b0]
sub esp, 0x14
mov eax, esp
mov dword [eax], edx
mov edx, dword [0x10707b4]
mov dword [eax + 4], ecx
mov ecx, dword [0x10707b8]
mov dword [eax + 8], edx
mov edx, dword [0x10707bc]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
mov eax, dword [0x1070778]
push eax
push str.StatusSendThread_begin_xxx__s___s___d___d___d___d___d___d_
push 8
call fcn.0043d500
add esp, 0x38
mov ecx, dword [0x1070778]
cmp dword [ecx - 0xc], ebp
jne 0x4d2b8d
cmp dword [0x10707b4], ebp
jne 0x4d2b95
jmp 0x4d2c0e
cmp dword [0x10707b4], ebp
je 0x4d2bc7
cmp dword [esi + 0x324b0], ebp
jne 0x4d2bbd
lea edx, [esp + 0x14]
push edx
push ebp
push esi
push 0x4621d0
push ebp
push ebp
mov byte [0x10da2c4], 0
call ebx
add esp, 0x18
mov dword [esi + 0x324b0], eax
or dword [0x103a360], 0x20000000
test byte [0x1043044], 1
je 0x4d2c0e
test dword [0x1042d84], 0x1000
je 0x4d2c0e
cmp dword [esi + 0x32498], ebp
jne 0x4d2c04
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push 0x431e20
push ebp
push ebp
mov byte [0x10da2bb], 0
call ebx
add esp, 0x18
mov dword [esi + 0x32498], eax
or dword [0x103a360], 0x40000000
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret