Function at 0x40fc60
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bbd8d
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4e5a68]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e5a68]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov eax, dword [esp + 0xac]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, ecx
lea ecx, [esp + 0x18]
push ecx
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwarePdaNetAndroid
push connect
mov dword [0x4f0c58], eax
call edi
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x40fd08
mov eax, 4
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
lea eax, [esi + 0x128]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.InterceptSMS
push edx
call ebp
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push str.SoftwarePdaNetAndroid
push connect
call edi
test eax, eax
jne 0x40fd57
mov ecx, dword [esp + 0x18]
mov eax, 4
lea edx, [esp + 0x14]
push edx
push 0x4f1b08
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
push ebx
push str.HideTetherUsage
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3e
lea eax, [esp + 0x5e]
push ebx
push eax
mov dword [esi + 0x118], ebx
mov word [esp + 0x64], bx
call fcn.00432df0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetEnumRootPNETMDM0000
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40fdc4
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push str.HardwareID
push edx
mov dword [esp + 0x34], 1
mov dword [esp + 0x2c], pe_nt_image_headers32
call ebp
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x58]
lea edx, [eax + 1]
jmp 0x40fdd0
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40fdd0
sub eax, edx
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esi + 0xf0], eax
je 0x40fe19
push ebx
push 0x40000080
push 3
push ebx
push ebx
push 0x2000000
push str..PNet
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40fe12
mov dword [esi + 0xf0], ebx
jmp 0x40fe19
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 0x13c], bl
cmp dword [0x4f109c], ebx
je 0x40fe41
mov edx, dword [esi + 4]
push ebx
push str.Dial_up_error
push str.We_are_sorry__it_seems_like_the_previous_connection_hasnt_been_cleaned_up_properly.__n_nRestarting_your_computer_should_clear_it_up__err24_.
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4101f7
mov edi, 0xf
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
mov ebp, dword [esp + 0xac]
cmp ebp, ebx
mov dword [esp + 0xa4], ebx
jne 0x40feb0
mov eax, dword [esi + 0x80]
push ebx
lea ecx, [esi + 0x6c]
push 0x4bed68
push eax
push ebx
call fcn.00402f30
test eax, eax
jne 0x40feb0
mov ecx, dword [esi + 4]
push ebx
push str.PdaNet_error
push str.Please_make_sure_your_phone_is_attached_to_the_computer_and_USB_Debugging_is_enabled_on_the_phone.
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x38], 0x10
jb 0x4101f7
mov edx, dword [esp + 0x24]
push edx
call fcn.00431ad1
add esp, 4
jmp 0x4101f7
mov eax, str.Connecting_to_your_phone__USB_...
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40fec4
sub eax, edx
push eax
push str.Connecting_to_your_phone__USB_...
lea ecx, [esp + 0x44]
call fcn.00405200
cmp ebp, ebx
mov byte [esp + 0xa4], 1
je 0x40ff14
cmp dword [esi + 0xc4], 0x10
jb 0x40fefb
mov eax, dword [esi + 0xb0]
jmp 0x40ff01
lea eax, [esi + 0xb0]
push eax
lea eax, [esp + 0x40]
push str.Connecting_to__s__Bluetooth_...
push eax
call fcn.00405ab0
add esp, 0xc
cmp dword [esp + 0x54], 0x10
mov ecx, dword [esp + 0x40]
jae 0x40ff23
lea ecx, [esp + 0x40]
mov eax, dword [0x4f0eac]
cmp eax, ebx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x40ff42
push ebx
push ecx
push 0x8066
push eax
mov dword [0x4f0f30], ebx
call edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
and ax, 0x8000
xor cx, cx
cmp cx, ax
sbb edx, edx
neg edx
cmp ebp, ebx
mov dword [0x4f0ccc], edx
je 0x40ff91
mov ebp, 0x10
cmp dword [esi + 0xe0], ebp
jb 0x40ff77
mov eax, dword [esi + 0xcc]
jmp 0x40ff7d
lea eax, [esi + 0xcc]
push ebx
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esi + 0xa0]
call fcn.00408ba0
jmp 0x40ffa4
push ebx
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esi + 0x2c]
call fcn.0041e790
mov ebp, 0x10
cmp eax, 1
je 0x41004b
mov edx, dword [esp + 0x34]
push 1
push 0x4c0bd8
push edx
push ebx
lea ecx, [esp + 0x30]
call fcn.00402f30
test eax, eax
jne 0x40ffe3
mov eax, dword [0x4f0eac]
cmp eax, ebx
je 0x41000b
push 1
mov dword [0x4f0f30], 0x885b
push str.PdaNet_fail_to_connect_due_to_USB_error__please_click_here_to_reinstall_the_Android_USB_driver
jmp 0x410003
cmp dword [esp + 0x38], ebp
mov ecx, dword [esp + 0x24]
jae 0x40fff1
lea ecx, [esp + 0x24]
mov eax, dword [0x4f0eac]
cmp eax, ebx
je 0x41000b
push 1
mov dword [0x4f0f30], ebx
push ecx
push 0x8066
push eax
call edi
mov eax, dword [0x4f0e68]
push ebx
push 1
push 0x8065
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [esp + 0x54], ebp
jb 0x410032
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00431ad1
add esp, 4
cmp dword [esp + 0x38], ebp
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
jmp 0x40fe98
mov ecx, dword [esi + 0x24]
cmp ecx, ebx
je 0x410059
push 1
call fcn.00419400
mov dword [esi + 0xec], 1
mov eax, dword [0x4f0eac]
cmp eax, ebx
je 0x410080
push ebx
push str.Setting_up_broadband...
push 0x8066
push eax
mov dword [0x4f0f30], ebx
call edi
mov eax, dword [0x4f0e68]
push ebx
push ebx
push 0x8065
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [esi + 0xf0], ebx
jne 0x4100ad
mov ecx, dword [esi + 4]
push ebx
push 0x1f40
push 0x64
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, esi
call fcn.0040d1d0
mov edx, dword [0x4f10a0]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x4f10a4]
push 0x9c4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x410115
cmp dword [esi + 0xf0], ebx
push ebx
mov ecx, 0x4f0e58
push 1
je 0x4100ff
push str.PdaNet_Modem_Driver_Error__14
call fcn.0040d5a0
mov ecx, esi
call fcn.0040e890
jmp 0x4101e5
push str.PdaNet_Broadband_Driver_Error__13
call fcn.0040d5a0
mov ecx, esi
call fcn.0040e890
jmp 0x4101e5
push 0x30
call fcn.004321b4
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0xa4], 2
je 0x410138
mov ecx, eax
call fcn.0040b610
jmp 0x41013a
xor eax, eax
cmp dword [esi + 0xf0], ebx
mov byte [esp + 0xa4], 1
mov dword [esi + 0x12c], eax
je 0x410182
push ebp
call fcn.004321b4
add esp, 4
cmp eax, ebx
je 0x410175
push 1
mov ecx, eax
mov dword [eax + 8], ebx
mov byte [eax + 0xc], 1
mov dword [eax], vtable.CDialThread.0
call fcn.00402dd0
jmp 0x4101e5
xor eax, eax
push 1
mov ecx, eax
call fcn.00402dd0
jmp 0x4101e5
push 0x4c
call fcn.004321b4
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0xa4], 3
je 0x4101a7
mov ecx, eax
call fcn.0040d200
mov edi, eax
jmp 0x4101a9
xor edi, edi
push 1
mov ecx, edi
mov byte [esp + 0xa8], 1
call fcn.00402dd0
push ebp
call fcn.004321b4
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0xa4], 4
je 0x4101dd
push edi
mov ecx, eax
call fcn.00426a70
jmp 0x4101df
xor eax, eax
mov dword [esi + 0xe4], eax
lea ecx, [esp + 0x3c]
call fcn.00405010
lea ecx, [esp + 0x20]
call fcn.00405010
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0043236c
add esp, 0x94
ret 4