Function at 0x140049b94
Capabilities:
Check for time delay via gettickcount
Get common file path
Log keystrokes via polling
Query environment variable
Set current directory

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x4270
call fcn.140127d30
sub rsp, rax
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov qword [rsp + 0x42c0], rbx
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x4260], rax
mov r13, rcx
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x30]
call fcn.140029d28
mov edi, 1
mov esi, edi
xor r12d, r12d
mov r15b, r12b
mov bpl, r12b
mov r14d, r12d
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x44], 0x3e8
lea r8d, [rdi + 3]
lea rdx, [rsp + 0x30]
lea rcx, str.sys
call fcn.140065780
mov bl, al
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x30]
lea rcx, str.sys0
call fcn.140065780
lea ecx, [rdi + 0x40]
cmp al, r12b
cmovne ebx, ecx
lea r8d, [rdi + 6]
lea rdx, [rsp + 0x30]
lea rcx, str.syscmd
call fcn.140065780
lea ecx, [rdi + 0xf]
cmp al, r12b
cmovne ebx, ecx
lea r8d, [rdi + 7]
lea rdx, [rsp + 0x30]
lea rcx, str.sys0cmd
call fcn.140065780
movzx r12d, bl
lea ecx, [rdi + 0x4f]
xor edx, edx
cmp al, dl
cmovne r12d, ecx
cmp r12b, dl
je 0x140049dec
lea r15, [0x14019cf50]
mov qword [rsp + 0xc8], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, str.GlobalPECMD:main:lock
call fcn.14002cb48
mov qword [rsp + 0xc0], rax
movzx esi, r12b
and esi, 0x40
mov ecx, esi
call fcn.14002cb04
mov rbx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
lea edx, [rax + 0x75]
lea rcx, [rsp + 0x50]
call fcn.140063580
nop
mov rax, qword [rsp + 0x50]
xor r14d, r14d
mov word [rax], r14w
test r12b, 0x10
jne 0x140049d19
mov r8d, dword [rsp + 0x60]
lea rdx, str.THREAD_WAIT__cur:_lu
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x50]
lea rcx, [rax + rcx*2]
lea r8d, [rbp + 0x11]
mov rdx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.HOTKEY9000000
lea rdx, str.SOFTWAREPELOGON
mov rcx, 0xffffffff80000002
call qword [0x14019c378]
cmp rbx, r14
jne 0x140049daa
mov edx, esi
mov rcx, r13
call fcn.140035548
mov rbx, rax
cmp rax, r14
jne 0x140049daa
lea rcx, [rsp + 0x50]
call fcn.14005b520
nop
lea rcx, [rsp + 0xc0]
call fcn.14002cb78
nop
jmp 0x140049ddc
xor r9d, r9d
mov edx, 0x312
mov r8d, 0x895440
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
lea rcx, [rsp + 0x50]
call fcn.14005b520
nop
lea rcx, [rsp + 0xc0]
call fcn.14002cb78
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
jmp 0x14004a861
mov eax, 0x2d
mov rcx, qword [rsp + 0x30]
cmp ax, word [rcx]
jne 0x140049f9f
xor r12d, r12d
lea ebx, [rax - 0x28]
mov r8d, ebx
lea rdx, [rsp + 0x30]
lea rcx, str._cont
call fcn.140065780
cmp al, r12b
je 0x140049e26
mov r14d, 0x10000
jmp 0x140049e9b
mov r8d, 8
lea rdx, [rsp + 0x30]
lea rcx, str._scanall
call fcn.140065780
cmp al, r12b
je 0x140049e47
mov bpl, dil
jmp 0x140049e9b
mov r8d, 4
lea rdx, [rsp + 0x30]
lea rcx, str._ncd
call fcn.140065780
cmp al, r12b
je 0x140049e6d
mov dword [rsp + 0x40], 0x40
jmp 0x140049e9b
mov r8d, ebx
mov rdx, qword [rsp + 0x30]
lea rcx, str._cur:
call fcn.14005c510
cmp al, r12b
je 0x140049eb0
add qword [rsp + 0x30], 0xa
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140066e40
mov rcx, qword [rsp + 0x30]
mov eax, 0x2d
cmp ax, word [rcx]
je 0x140049e05
jmp 0x140049eba
mov rcx, qword [rsp + 0x30]
mov eax, 0x2d
cmp bpl, r12b
je 0x140049fa2
lea rbx, str.PressKey
lea rcx, [rsp + 0x98]
call fcn.140063500
nop
mov rax, qword [rsp + 0x30]
cmp word [rax], r12w
je 0x140049f03
mov r8d, 0x2c
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.140066780
mov rbx, qword [rsp + 0x98]
mov byte [rsp + 0x150], r12b
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0x151]
call fcn.14010c6c0
lea rcx, [rsp + 0x150]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov word [rsp + 0x250], r12w
lea rsi, [rsp + 0x150]
lea rbp, [rsp + 0x250]
mov r12d, 0x100
movzx r8d, byte [rsi]
lea rdx, [0x14014b2f0]
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfW]
add rbp, 0xa
add rsi, rdi
sub r12, rdi
jne 0x140049f4d
xor edi, edi
mov word [rsp + 0xc4e], di
lea r8, [rsp + 0x250]
mov rdx, rbx
mov rcx, r13
call fcn.140061290
nop
lea rcx, [rsp + 0x98]
call fcn.14005b520
mov esi, edi
jmp 0x14004a855
xor r12d, r12d
mov r8d, 0x80000000
mov dword [rsp + 0x38], r8d
mov r9d, 0x20
lea r10d, [r9 + 0x44]
cmp ax, word [rcx]
jne 0x140049fea
lea rdx, [rcx + 2]
movzx eax, word [rdx]
or ax, r9w
cmp ax, 0x63
je 0x140049fea
cmp ax, r10w
je 0x140049fea
mov qword [rsp + 0x30], rdx
mov r15b, dil
lea rcx, [rsp + 0x30]
call fcn.140029d28
mov rcx, qword [rsp + 0x30]
mov eax, 0x3d
cmp ax, word [rcx]
jne 0x14004a002
mov bpl, byte [rcx]
add rcx, 2
mov qword [rsp + 0x30], rcx
jmp 0x14004a005
mov bpl, r12b
movzx eax, word [rcx]
sub ax, 0x30
mov edx, 9
cmp ax, dx
ja 0x14004a02f
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.140066e40
mov r8d, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov eax, 0x2a
cmp ax, word [rcx]
je 0x14004a1bc
cmp r8d, 0x80000000
je 0x14004a1b7
mov word [rsp + 0x112], r12w
mov word [rsp + 0x110], r12w
lea rbx, str.PressKey
lea rcx, [rsp + 0x88]
call fcn.140063500
nop
mov r8d, 0x2c
mov rax, qword [rsp + 0x30]
cmp r8w, word [rax]
jne 0x14004a0ad
add rax, 2
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
call fcn.140066780
mov rax, qword [rsp + 0x88]
cmp word [rax], r12w
cmovne rbx, rax
mov ecx, dword [rsp + 0x38]
cmp r15b, r12b
jne 0x14004a11d
cmp ecx, r12d
je 0x14004a116
xor r14d, r14d
cmp ecx, r14d
jl 0x14004a189
cmp bpl, r14b
je 0x14004a100
mov esi, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x38], 0x80000000
mov rax, qword [rsp + 0x30]
cmp word [rax], r14w
jne 0x14004a189
lea rcx, [rsp + 0x88]
call fcn.14005b520
xor eax, eax
jmp 0x14004a861
mov edx, ecx
mov rcx, r13
call fcn.14002bb1c
mov esi, eax
mov dword [rsp + 0x38], 0x80000000
jmp 0x14004a189
mov edx, 2
jmp 0x14004a11f
mov edx, edi
or edx, r14d
call fcn.140039864
mov esi, eax
xor r14d, r14d
cmp eax, r14d
je 0x14004a16e
cmp eax, 0x41
jl 0x14004a13b
cmp eax, 0x5a
jle 0x14004a148
add eax, 0xffffffd0
mov ebp, 9
cmp ax, bp
ja 0x14004a156
movsx eax, sil
mov word [rsp + 0x110], ax
jmp 0x14004a16e
mov r8d, esi
lea rdx, str.0x_X
lea rcx, [rsp + 0x110]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x110]
mov rdx, rbx
mov rcx, r13
call fcn.140061290
mov dword [rsp + 0x38], 0x80000000
lea rcx, [rsp + 0x30]
call fcn.140029d28
mov dword [rsp + 0x38], 0x80000000
mov r15b, r14b
lea rcx, [rsp + 0x88]
call fcn.14005b520
mov rcx, qword [rsp + 0x30]
mov eax, 0x2a
jmp 0x14004a1bf
xor r14d, r14d
jmp 0x14004a1bf
xor r14d, r14d
cmp word [rcx], r14w
je 0x14004a855
mov r8d, r14d
mov dword [rsp + 0x3c], r14d
mov bpl, r14b
or ebx, 0xffffffff
cmp ax, word [rcx]
jne 0x14004a1f1
add rcx, 2
mov qword [rsp + 0x30], rcx
mov ebx, edi
mov r8d, dword [rsp + 0x60]
mov dword [rsp + 0x3c], r8d
cmp ax, word [rcx]
jne 0x14004a206
add ebx, edi
add rcx, 2
mov qword [rsp + 0x30], rcx
cmp ax, word [rcx]
je 0x14004a1f6
cmp ebx, r14d
jle 0x14004a280
mov eax, 0x2d
cmp ax, word [rcx]
jne 0x14004a22b
add rcx, 2
mov qword [rsp + 0x30], rcx
mov r8d, r14d
mov dword [rsp + 0x3c], r14d
lea esi, [rax + 0x10]
jmp 0x14004a285
mov esi, 0x3d
cmp si, word [rcx]
jne 0x14004a241
add rcx, 2
mov qword [rsp + 0x30], rcx
mov bpl, dil
movzx eax, word [rcx]
sub ax, 0x30
mov ecx, 9
cmp ax, cx
ja 0x14004a268
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x30]
call fcn.140066e40
sub ebx, edi
mov r8d, dword [rsp + 0x3c]
cmp ebx, r14d
jle 0x14004a285
mov edx, ebx
mov ecx, r8d
call fcn.14002de88
mov r8d, eax
mov dword [rsp + 0x3c], eax
jmp 0x14004a285
mov esi, 0x3d
or dword [rsp + 0x68], 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140029d28
mov rax, qword [rsp + 0x30]
cmp si, word [rax]
jne 0x14004a2ac
mov r12b, byte [rax]
add rax, 2
mov qword [rsp + 0x30], rax
jmp 0x14004a2af
mov r12b, r14b
movzx eax, word [rax]
sub ax, 0x30
mov ecx, 9
cmp ax, cx
ja 0x14004a2d4
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.140066e40
mov r8d, dword [rsp + 0x3c]
mov qword [rsp + 0x48], r14
mov esi, r14d
cmp r8d, r14d
je 0x14004a319
cmp bpl, r14b
je 0x14004a2fa
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x48], rax
jmp 0x14004a30c
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
cmp rax, r14
jne 0x14004a319
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edx, 0x209
lea rcx, [rsp + 0x58]
call fcn.140063580
nop
mov rax, qword [rsp + 0x58]
mov word [rax], r14w
mov rdx, qword [rsp + 0x58]
mov ebx, 0x208
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x80]
call fcn.140071300
nop
mov edx, 0x5c
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rax, qword [rsp + 0x58]
mov word [rax], r14w
mov r8d, ebx
mov rdx, qword [rsp + 0x58]
lea rcx, [0x14013f8a8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x30]
call fcn.140029d28
lea rcx, [rsp + 0x70]
call fcn.140063950
nop
mov qword [rsp + 0xa8], r14
mov rax, qword [rsp + 0x30]
cmp word [rax], r14w
je 0x14004a59e
mov ebp, 9
mov al, byte [0x1401958af]
cmp al, r14b
jle 0x14004a59e
mov r8d, 7
lea rdx, [rsp + 0x30]
lea rcx, str._delms:
call fcn.140065780
cmp al, r14b
je 0x14004a416
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x30]
call fcn.140066e40
cmp dword [rsp + 0x44], r14d
jge 0x14004a580
mov dword [rsp + 0x44], r14d
jmp 0x14004a580
mov ebx, 4
mov r8d, ebx
lea rdx, [rsp + 0x30]
lea rcx, str._del
call fcn.140065780
cmp al, r14b
je 0x14004a528
mov dword [rsp + 0x64], r14d
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xb0], rax
mov r8d, edi
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0xb0]
call fcn.140036bcc
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x90]
call fcn.140063500
nop
lea rcx, [rsp + 0xa0]
call fcn.140063500
nop
mov ebx, dword [rsp + 0x64]
mov r8d, ebx
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0xa0]
call fcn.140063740
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0xa0]
call fcn.14002e730
nop
lea rcx, [rsp + 0xa0]
call fcn.14005b520
cmp ebx, r14d
jle 0x14004a50e
mov ecx, 8
call fcn.1400cf938
mov rbx, rax
cmp rax, r14
je 0x14004a4eb
mov rcx, qword [rsp + 0x90]
mov qword [rax], rcx
mov qword [rsp + 0x90], r14
jmp 0x14004a4ee
mov rbx, r14
mov r9d, 8
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x70]
mov ecx, dword [rsp + 0x7c]
call fcn.1400638f0
mov qword [rax], rbx
add dword [rsp + 0x7c], edi
lea rcx, [rsp + 0x30]
call fcn.140029d28
nop
lea rcx, [rsp + 0x90]
call fcn.14005b520
jmp 0x14004a580
mov r8d, ebx
lea rdx, [rsp + 0x30]
lea rcx, str._cmd
call fcn.140065780
cmp al, r14b
jne 0x14004a591
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx]
cmp ax, r14w
je 0x14004a576
mov edx, 0x20
cmp bp, ax
ja 0x14004a55f
cmp ax, 0xd
jbe 0x14004a576
cmp dx, ax
je 0x14004a576
add rcx, 2
mov qword [rsp + 0x30], rcx
mov ax, word [rcx]
cmp ax, r14w
jne 0x14004a554
lea rcx, [rsp + 0x30]
call fcn.140029d28
mov rax, qword [rsp + 0x30]
cmp word [rax], r14w
jne 0x14004a3c7
jmp 0x14004a59e
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xa8], rax
cmp r15b, r14b
je 0x14004a5a7
neg dword [rsp + 0x38]
mov ebx, dword [rsp + 0x40]
cmp ebx, r14d
jne 0x14004a5c2
cmp qword [rsp + 0x48], r14
je 0x14004a5c2
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
add ebp, dword [rsp + 0x38]
cmp qword [rsp + 0x48], r14
je 0x14004a6b8
mov cl, byte [0x1401958af]
cmp cl, r14b
jle 0x14004a6b8
mov r15d, 0x3e8
mov eax, dword [rsp + 0x38]
cmp eax, r14d
je 0x14004a6b4
mov ebx, r15d
cmp eax, r14d
jle 0x14004a61d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, ebp
sub ecx, eax
mov dword [rsp + 0x38], ecx
js 0x14004a6b4
cmp ecx, r15d
cmovl ebx, ecx
mov dword [rsp + 0x28], 0x4ff
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [rsp + 0x48]
mov edx, edi
mov rcx, r13
call fcn.14002dfd4
cmp eax, r14d
je 0x14004a6b4
mov ebx, 0x64
mov al, byte [0x1401958af]
cmp al, r14b
jle 0x14004a6a5
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xd8]
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r14d
je 0x14004a6a5
sub ebx, edi
je 0x14004a6a5
cmp dword [rsp + 0xe0], 0x12
je 0x14004a6a5
lea rcx, [rsp + 0xd8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov r11b, byte [0x1401958af]
cmp r11b, r14b
jg 0x14004a650
mov al, byte [0x1401958af]
cmp al, r14b
jg 0x14004a5ee
mov ebx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x68]
cmp edx, r14d
jl 0x14004a6d8
cmp r12b, r14b
je 0x14004a6d0
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004a6d8
mov rcx, r13
call fcn.14002bb1c
cmp dword [rsp + 0x7c], r14d
jle 0x14004a7d1
mov al, byte [0x1401958af]
cmp al, r14b
jle 0x14004a7d1
cmp ebx, r14d
jne 0x14004a702
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rbp, qword [rsp + 0x70]
cmp dword [rsp + 0x7c], r14d
jle 0x14004a7d1
mov al, byte [0x1401958af]
cmp al, r14b
jle 0x14004a7cd
mov r12d, r14d
mov rbx, r14
movsxd rax, dword [rsp + 0x7c]
cmp eax, r14d
jle 0x14004a7cd
mov r15, rax
mov r14d, edi
xor edx, edx
mov al, byte [0x1401958af]
cmp al, dl
jle 0x14004a79f
mov rcx, qword [rbp + rbx*8]
cmp rcx, rdx
je 0x14004a794
xor edx, edx
mov rcx, qword [rcx]
call fcn.140048940
mov r11, qword [rbp + rbx*8]
mov rcx, qword [r11]
call fcn.1400cf380
xor edx, edx
cmp eax, edx
jne 0x14004a791
mov r13, qword [rbp + rbx*8]
cmp r13, rdx
je 0x14004a78a
mov rcx, r13
call fcn.14005b520
mov rcx, r13
call fcn.1400cf984
xor edx, edx
mov qword [rbp + rbx*8], rdx
jmp 0x14004a794
mov r12d, r14d
add r14d, edi
add rbx, rdi
cmp rbx, r15
jl 0x14004a73d
xor r14d, r14d
cmp r12d, r14d
jle 0x14004a7c5
mov edx, dword [rsp + 0x44]
mov r13, qword [rsp + 0xb8]
mov rcx, r13
call fcn.14002bb1c
mov dword [rsp + 0x7c], r12d
jmp 0x14004a712
mov r13, qword [rsp + 0xb8]
mov ebx, dword [rsp + 0x40]
cmp ebx, r14d
jne 0x14004a7eb
cmp qword [rsp + 0x48], r14
je 0x14004a7eb
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, qword [rsp + 0xa8]
cmp rax, r14
je 0x14004a816
cmp word [rax], r14w
je 0x14004a816
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, r13
call fcn.14004d38c
mov esi, eax
lea rcx, [rsp + 0x70]
call fcn.14003aef4
nop
lea rcx, [rsp + 0x80]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x14004a850
cmp rcx, 0xffffffffffffffff
je 0x14004a850
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], r14
xor edx, edx
mov rcx, r13
call fcn.14009aae0
mov eax, esi
mov rcx, qword [rsp + 0x4260]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x42c0]
add rsp, 0x4270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret