Function at 0x41afb0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a298
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x469070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x14]
mov ebx, dword [ebp + 8]
push edx
push 0
push 0x44c5c0
lea edx, [ebp + 0x10]
mov dword [ebp - 4], 0
mov eax, dword [ecx]
push edx
push 1
push ebx
push ecx
call dword [eax + 0x28]
test eax, eax
jns 0x41b065
mov ecx, eax
call fcn.004024e0
push 0x208
push 0x46d350
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
push ebx
mov edi, eax
push 0x11b
push str.CShellMgrWin.cpp
call esi
push eax
push 0x10
push edi
push str.Failed_assertion_in__s_at_line__d_n_n_s
call fcn.00427590
add esp, 0x18
push 1
call fcn.004316e6
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edi, eax
test edi, edi
jne 0x41b0ab
call fcn.004273e0
push 0x208
push 0x46d350
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
push ebx
mov edi, eax
push 0x11e
jmp 0x41b046
mov ecx, str.ShellMgrContextMenuEncrypt
call fcn.0040fa50
mov esi, dword [sym.imp.USER32.dll_InsertMenuW]
push eax
push 1
push 0x400
push 0
push edi
call esi
mov ecx, str.ShellMgrContextMenuDecrypt
call fcn.0040fa50
push eax
push 2
push 0x400
push 1
push edi
call esi
push 0
push 0
push 0xc00
push 2
push edi
call esi
mov eax, dword [ebp - 0x14]
push 4
push 0x7fff
push 0x64
mov ecx, dword [eax]
push 3
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
jns 0x41b15b
mov eax, dword [ebp - 0x14]
push 4
push 0x7fff
push 0x64
mov ecx, dword [eax]
push 3
push edi
push eax
call dword [ecx + 0xc]
mov ecx, eax
call fcn.004024e0
push 0x208
push 0x46d350
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
push ebx
mov edi, eax
push 0x128
jmp 0x41b046
push 0
push ebx
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0x102
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov esi, eax
test esi, esi
je 0x41b1c8
cmp esi, 1
jne 0x41b186
mov dword [ebp - 0x28], 0x41a890
jmp 0x41b192
cmp esi, 2
jne 0x41b1fc
mov dword [ebp - 0x28], 0x41ab30
push dword [ebp + 0x18]
mov ecx, dword [ebp - 0x18]
push dword [ebp + 0x14]
mov dword [ebp - 0x24], 0
push dword [ebp + 0x10]
mov dword [ebp - 0x20], 0
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
movups xmm0, xmmword [ebp - 0x28]
push ebx
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.0041aeb0
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x41b1e3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x3c
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0042c5c0
add esp, 0xc
mov dword [ebp - 0x6c], 0x40
mov dword [ebp - 0x68], 0x20004000
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x41b22e
or dword [ebp - 0x68], 0x40000000
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x41b242
or dword [ebp - 0x68], 0x10000000
lea eax, [esi - 0x64]
mov dword [ebp - 0x64], ebx
movzx eax, ax
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
jns 0x41b1c8
mov ecx, eax
call fcn.004024e0
push 0x208
push 0x46d350
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
push ebx
mov edi, eax
push 0x148
jmp 0x41b046