Function at 0x41e440
Capabilities:
Delete file
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438c86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xe0]
mov ecx, 0x35
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x64]
call sub.MFC42D.DLL_Ordinal_3024
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x41e491
jmp 0x41e7ec
lea ecx, [ebp - 0x18]
call sub.MFC42D.DLL_Ordinal_492
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041c9f0
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0041a500
mov byte [ebp - 4], 1
push 0x43eb48
lea eax, [ebp - 0x1c]
push eax
call sub.MFC42D.DLL_Ordinal_824
and eax, 0xff
test eax, eax
je 0x41e54e
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
lea edx, [ebp - 0x18]
push edx
call sub.MFC42D.DLL_Ordinal_485
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
lea edx, [ebp - 0x1c]
push edx
call sub.MFC42D.DLL_Ordinal_485
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x60]
call sub.MFC42D.DLL_Ordinal_3025
push eax
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00423320
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call sub.MFC42D.DLL_Ordinal_684
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42D.DLL_Ordinal_684
jmp 0x41e7ec
push 0x1e
push 0
lea edx, [ebp - 0x3c]
push edx
call sub.MSVCRTD.dll_memset
add esp, 0xc
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call sub.MSVCRTD.dll__chkesp
movsx eax, ax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffff8001
je 0x41e587
mov dword [ebp - 0x40], 0x40
jmp 0x41e58e
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 3
lea ecx, [ebp - 0x18]
call sub.MFC42D.DLL_Ordinal_880
mov dword [ebp - 0x34], eax
mov cx, word [ebp - 0x40]
mov word [ebp - 0x2c], cx
mov esi, esp
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
cmp esi, esp
call sub.MSVCRTD.dll__chkesp
test eax, eax
jne 0x41e7d1
cmp dword [ebp - 0x2a], 0
jne 0x41e7d1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x64]
call sub.MFC42D.DLL_Ordinal_2593
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], 0
mov ecx, dword [ebp - 0x48]
sub ecx, 2
mov dword [ebp - 0x50], ecx
push 0x202
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x64]
call sub.MFC42D.DLL_Ordinal_2747
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffff
je 0x41e61f
mov dword [ebp - 0x4c], 1
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x48]
sub edx, 1
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], 0
jmp 0x41e63a
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x14]
jge 0x41e6ee
push 0x102
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x64]
call sub.MFC42D.DLL_Ordinal_2747
mov dword [ebp - 0x50], eax
push 0x43d0e0
push 1
mov ecx, dword [ebp - 0x50]
push ecx
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x64]
call sub.MFC42D.DLL_Ordinal_2619
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x90]
push edx
call sub.MFC42D.DLL_Ordinal_813
mov byte [ebp - 0x64], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x68]
call sub.MFC42D.DLL_Ordinal_684
mov eax, dword [ebp - 0x64]
and eax, 0xff
test eax, eax
je 0x41e6da
push ecx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push 0
mov edx, dword [ebp - 0x50]
push edx
push ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x64]
call sub.MFC42D.DLL_Ordinal_2619
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x10]
call fcn.0041e0b0
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x64]
call sub.MFC42D.DLL_Ordinal_1805
jmp 0x41e631
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x4c], 0
je 0x41e79c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x64]
call sub.MFC42D.DLL_Ordinal_2593
sub eax, 1
mov dword [ebp - 0x50], eax
push 0x43d0e0
push 1
mov edx, dword [ebp - 0x50]
push edx
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x64]
call sub.MFC42D.DLL_Ordinal_2619
mov dword [ebp - 0x98], eax
mov edx, dword [ebp - 0x98]
mov dword [ebp - 0x9c], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x9c]
push eax
call sub.MFC42D.DLL_Ordinal_813
mov byte [ebp - 0x70], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call sub.MFC42D.DLL_Ordinal_684
mov ecx, dword [ebp - 0x70]
and ecx, 0xff
test ecx, ecx
je 0x41e78d
push ecx
mov edx, esp
mov dword [ebp - 0x78], esp
push 0
mov eax, dword [ebp - 0x50]
push eax
push edx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x64]
call sub.MFC42D.DLL_Ordinal_2619
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0x10]
call fcn.0041e0b0
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x64]
call sub.MFC42D.DLL_Ordinal_1805
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x64]
call sub.MFC42D.DLL_Ordinal_2593
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
sub edx, 1
cmp dword [ebp - 0x58], edx
jle 0x41e7be
mov eax, dword [ebp - 0x48]
sub eax, 1
mov dword [ebp - 0x58], eax
push 3
push 3
mov ecx, dword [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x64]
call sub.MFC42D.DLL_Ordinal_4716
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call sub.MFC42D.DLL_Ordinal_684
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42D.DLL_Ordinal_684
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xe0
cmp ebp, esp
call sub.MSVCRTD.dll__chkesp
mov esp, ebp
pop ebp
ret