Function at 0x442930
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x4a8990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea eax, [esp + 0x18]
push 0xb
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x40], 0
call fcn.00487a7f
mov eax, dword [eax]
mov byte [esp + 0x38], 1
mov esi, str.javascript:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44299a
test cl, cl
je 0x442996
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44299a
add eax, 2
add esi, 2
test cl, cl
jne 0x442972
xor eax, eax
jmp 0x44299f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x442a53
lea eax, [esp + 0x10]
push 9
push eax
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.vbscript:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4429e6
test cl, cl
je 0x4429e2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4429e6
add eax, 2
add esi, 2
test cl, cl
jne 0x4429be
xor eax, eax
jmp 0x4429eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048f641
test bl, bl
jne 0x442a53
lea eax, [esp + 0x14]
push 7
push eax
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.mailto:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442a3c
test cl, cl
je 0x442a38
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442a3c
add eax, 2
add esi, 2
test cl, cl
jne 0x442a14
xor eax, eax
jmp 0x442a41
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0048f641
test bl, bl
je 0x442a55
mov bl, 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0
call fcn.0048f641
test bl, bl
je 0x442a71
mov eax, dword [esp + 0x44]
push eax
jmp 0x442f79
push 0x2e
lea ecx, [esp + 0x44]
call fcn.0048fb08
test eax, eax
jg 0x442b1d
push 0x2f
lea ecx, [esp + 0x44]
call fcn.0048fb08
test eax, eax
jg 0x442b1d
push 0x5c
lea ecx, [esp + 0x44]
call fcn.0048fb08
test eax, eax
jge 0x442b1d
lea ecx, [esp + 0x18]
push 2
push ecx
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, 0x4d4fd8
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442ae5
test cl, cl
je 0x442ae1
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442ae5
add eax, 2
add esi, 2
test cl, cl
jne 0x442abd
xor eax, eax
jmp 0x442aea
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.0048f641
test bl, bl
jne 0x442b1d
mov ecx, dword [esp + 0x40]
cmp byte [ecx + 1], 0x3a
jne 0x442e76
mov al, byte [ecx + 2]
cmp al, 0x5c
je 0x442b1d
cmp al, 0x2f
je 0x442b1d
test al, al
jne 0x442e76
push 0x40
lea ecx, [esp + 0x44]
call fcn.0048fb08
test eax, eax
jle 0x442edc
lea eax, [esp + 0x2c]
push 7
push eax
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov byte [esp + 0x38], 2
mov esi, str.http:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442b74
test cl, cl
je 0x442b70
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442b74
add eax, 2
add esi, 2
test cl, cl
jne 0x442b4c
xor eax, eax
jmp 0x442b79
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x442e5e
lea eax, [esp + 0x18]
push 7
push eax
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.file:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442bc0
test cl, cl
je 0x442bbc
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442bc0
add eax, 2
add esi, 2
test cl, cl
jne 0x442b98
xor eax, eax
jmp 0x442bc5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.0048f641
test bl, bl
jne 0x442e5e
lea eax, [esp + 0x14]
push 8
push eax
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.https:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442c1a
test cl, cl
je 0x442c16
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442c1a
add eax, 2
add esi, 2
test cl, cl
jne 0x442bf2
xor eax, eax
jmp 0x442c1f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0048f641
test bl, bl
jne 0x442e5e
lea eax, [esp + 0x10]
push 7
push eax
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.file:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442c74
test cl, cl
je 0x442c70
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442c74
add eax, 2
add esi, 2
test cl, cl
jne 0x442c4c
xor eax, eax
jmp 0x442c79
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048f641
test bl, bl
jne 0x442e5e
lea eax, [esp + 0x1c]
push 4
push eax
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.www.
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442cce
test cl, cl
je 0x442cca
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442cce
add eax, 2
add esi, 2
test cl, cl
jne 0x442ca6
xor eax, eax
jmp 0x442cd3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x1c]
sete bl
call fcn.0048f641
test bl, bl
jne 0x442e5e
lea eax, [esp + 0x24]
push 6
push eax
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov byte [esp + 0x38], 3
mov esi, str.ftp:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442d2d
test cl, cl
je 0x442d29
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442d2d
add eax, 2
add esi, 2
test cl, cl
jne 0x442d05
xor eax, eax
jmp 0x442d32
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x442d8c
lea eax, [esp + 0x20]
push 4
push eax
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.ftp.
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442d75
test cl, cl
je 0x442d71
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442d75
add eax, 2
add esi, 2
test cl, cl
jne 0x442d4d
xor eax, eax
jmp 0x442d7a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x20]
sete bl
call fcn.0048f641
test bl, bl
je 0x442d8e
mov bl, 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 2
call fcn.0048f641
test bl, bl
jne 0x442e5e
lea eax, [esp + 0x28]
push 6
push eax
lea ecx, [esp + 0x48]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.res:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442de3
test cl, cl
je 0x442ddf
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442de3
add eax, 2
add esi, 2
test cl, cl
jne 0x442dbb
xor eax, eax
jmp 0x442de8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x28]
sete bl
call fcn.0048f641
test bl, bl
jne 0x442e5e
mov edi, dword [esp + 0x40]
mov esi, str.about:blank
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442e2d
test cl, cl
je 0x442e29
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442e2d
add eax, 2
add esi, 2
test cl, cl
jne 0x442e05
xor eax, eax
jmp 0x442e32
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x442e5e
cmp byte [edi + 1], 0x3a
jne 0x442e5a
mov al, byte [edi + 2]
cmp al, 0x5c
je 0x442e5e
cmp al, 0x2f
sete cl
test cl, cl
jne 0x442e5e
test al, al
sete al
test al, al
jne 0x442e5e
mov bl, 1
jmp 0x442e60
xor bl, bl
lea ecx, [esp + 0x2c]
mov byte [esp + 0x38], 0
call fcn.0048f641
test bl, bl
je 0x442edc
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx - 8]
test eax, eax
je 0x442edc
mov eax, dword [ebp + 0xba4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
mov eax, dword [eax + 0x1c]
push 0x407
push eax
call esi
push eax
call fcn.0048bd5a
mov ecx, dword [esp + 0x40]
push ecx
mov ecx, eax
call fcn.0048ebfd
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
push 0
test ax, ax
mov eax, dword [ebp + 0x1c]
push 0xef1c
setge dl
dec edx
push 0x111
and edx, 3
push eax
inc edx
mov dword [ebp + 0x1ec], edx
call esi
jmp 0x442f80
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.0048f3b6
push 0
mov ecx, ebp
call fcn.00443a50
test eax, eax
jne 0x442f80
mov eax, dword [ebp + 0xd4]
test eax, eax
jne 0x442f74
lea eax, [esp + 0x2c]
push 1
push eax
lea ecx, [esp + 0x48]
call fcn.00487a03
mov eax, dword [eax]
mov esi, 0x4d5b14
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x442f47
test cl, cl
je 0x442f43
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x442f47
add eax, 2
add esi, 2
test cl, cl
jne 0x442f1f
xor eax, eax
jmp 0x442f4c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x2c]
sete bl
call fcn.0048f641
test bl, bl
jne 0x442f74
mov eax, dword [esp + 0x40]
push 0
push 0
push eax
push 2
push 1
mov ecx, ebp
call fcn.00426350
jmp 0x442f80
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, ebp
call fcn.0043e1e0
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048f641
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 8