Function at 0x40aec0
Capabilities:
Capture screenshot
Log keystrokes

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x30]
push esi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x40aeda
xor eax, eax
pop esi
add esp, 0x28
ret
push ebx
push ebp
push edi
push 0
push 0
push 0
push 0x465350
call dword [sym.imp.GDI32.dll_CreateDCW]
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esi + 4]
mov edi, dword [esi + 8]
mov ebp, eax
mov eax, dword [esi]
mov esi, dword [esi + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], ecx
test eax, eax
je 0x40af21
push 0x50
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
jg 0x40af3b
push 8
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push ebx
mov dword [esp + 0x50], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
test eax, eax
jge 0x40af58
push 0x50
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
jg 0x40af58
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
test eax, eax
jge 0x40af68
mov dword [esp + 0x10], 0
cmp edi, dword [esp + 0x48]
jle 0x40af7f
push 0x50
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
jg 0x40af7f
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x1c]
cmp esi, eax
jle 0x40af89
mov esi, eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
sub esi, edx
sub edi, eax
push esi
push edi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
push 0xcc0020
push edx
push eax
push ebx
push esi
xor esi, esi
push edi
push esi
push esi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [esp + 0x40], esi
je 0x40b0db
mov dword [esp + 0x1c], esi
mov dword [esp + 0x40], esi
call dword [sym.imp.USER32.dll_GetCursor]
lea ecx, [esp + 0x14]
mov dword [esp + 0x48], eax
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
cmp esi, edi
je 0x40b036
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x40b036
call dword [sym.imp.USER32.dll_GetCursor]
push 0
push esi
push edi
mov dword [esp + 0x54], eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [esp + 0x48]
xor ecx, ecx
mov dword [esp + 0x24], ecx
lea edx, [esp + 0x24]
mov dword [esp + 0x28], ecx
push edx
mov dword [esp + 0x30], ecx
push edi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_GetIconInfo]
mov eax, dword [esp + 0x44]
test eax, eax
je 0x40b07c
push 0x20
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x21
mov esi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x40b084
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x18]
push 3
push 0
push 0
push 0
push 0
push edi
mov edi, dword [ecx + 4]
sub edx, edi
mov edi, dword [esp + 0x44]
sub edx, edi
sub edx, eax
mov eax, dword [esp + 0x2c]
push edx
mov edx, dword [ecx]
mov ecx, dword [esp + 0x44]
sub eax, edx
sub eax, ecx
sub eax, esi
push eax
push ebp
call dword [sym.imp.USER32.dll_DrawIconEx]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40b0cc
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40b0db
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [esp + 0x20]
push edi
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
mov esi, eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call edi
push ebp
call edi
pop edi
pop ebp
mov eax, esi
pop ebx
pop esi
add esp, 0x28
ret