Function at 0x422e80
Capabilities:
Log keystrokes via application hook
Query environment variable
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4d2987
mov eax, dword fs:[0]
push eax
sub esp, 0x398
mov eax, dword [0x4fa36c]
xor eax, esp
mov dword [esp + 0x390], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fa36c]
xor eax, esp
push eax
lea eax, [esp + 0x3ac]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3bc]
lea esi, [ebp + 0x24]
push 0x80
mov eax, esi
mov dword [esp + 0x3b8], 1
call fcn.0046b7d0
xor ebx, ebx
cmp eax, ebx
je 0x422f14
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
push 9
call eax
cmp eax, ebx
je 0x422f14
cmp byte [eax + 0x614], bl
je 0x422f14
mov edi, 0x4fd8c8
call fcn.00413770
mov eax, dword [ebp + 4]
push ebx
push ebx
push 0x404
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x6e
mov eax, esi
call fcn.0046b7d0
cmp eax, ebx
je 0x422f30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
push 9
call eax
cmp eax, ebx
jne 0x422f88
mov esi, 8
cmp dword [esp + 0x3d8], esi
jb 0x422f4e
mov ecx, dword [esp + 0x3c4]
push ecx
call fcn.004a93cc
add esp, 4
cmp dword [esp + 0x3f4], esi
mov dword [esp + 0x3d8], 7
mov dword [esp + 0x3d4], ebx
mov word [esp + 0x3c4], bx
jb 0x422f81
mov edx, dword [esp + 0x3e0]
push edx
call fcn.004a93cc
add esp, 4
xor al, al
jmp 0x4235cd
mov al, byte [eax + 0x614]
cmp al, bl
mov byte [0x4fd5dc], al
je 0x422fba
cmp dword [0x4fd5d8], ebx
jne 0x422fba
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x421a30
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4fd5d8], eax
push 0x44
lea eax, [esp + 0x68]
push ebx
push eax
call fcn.004aef60
or dword [esp + 0x9c], 1
add esp, 0xc
lea ecx, [esp + 0x1c]
mov dword [0x4fd078], ebx
mov dword [0x4fd07c], ebx
mov dword [0x4fd080], ebx
mov dword [0x4fd084], ebx
mov edx, dword [ebp + 0x2b8]
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x6c], 0x44
mov word [esp + 0x9c], 5
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x38], ebx
call fcn.00422b00
test al, al
je 0x423505
lea esi, [esp + 0x154]
call fcn.0041e890
lea edi, [esp + 0x1c]
call fcn.00423600
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
lea ecx, [ebp + 0x30c]
push ebx
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push ecx
mov word [eax + 4], bx
call fcn.004017c0
lea edi, [esp + 0xe4]
call fcn.0041e450
add esp, 0x1c
mov ecx, edi
lea esi, [esp + 0xe4]
mov byte [esp + 0x3b4], 2
call fcn.00433840
mov eax, edi
push eax
mov byte [esp + 0x3b8], 3
call fcn.0042b1c0
add esp, 4
test al, al
jne 0x423179
cmp dword [esp + 0xfc], 0x10
jb 0x4230d4
mov ecx, dword [esp + 0xe8]
push ecx
call fcn.004a93cc
add esp, 4
mov esi, 8
cmp dword [esp + 0xe0], esi
mov dword [esp + 0xfc], 0xf
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
jb 0x42310b
mov edx, dword [esp + 0xcc]
push edx
call fcn.004a93cc
add esp, 4
cmp dword [esp + 0x3d8], esi
mov edi, 7
mov dword [esp + 0xe0], edi
mov dword [esp + 0xdc], ebx
mov word [esp + 0xcc], bx
jb 0x42313f
mov eax, dword [esp + 0x3c4]
push eax
call fcn.004a93cc
add esp, 4
cmp dword [esp + 0x3f4], esi
mov dword [esp + 0x3d8], edi
mov dword [esp + 0x3d4], ebx
mov word [esp + 0x3c4], bx
jb 0x422f81
mov ecx, dword [esp + 0x3e0]
push ecx
call fcn.004a93cc
add esp, 4
xor al, al
jmp 0x4235cd
mov edx, dword [0x4fd5d4]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x3c0]
push eax
lea edi, [esp + 0x20]
call fcn.00426a90
add esp, 4
push 0x4da9dc
push eax
lea esi, [esp + 0x50]
mov byte [esp + 0x3bc], 4
call fcn.0041a6d0
lea ecx, [ebp + 0x248]
push ecx
push eax
lea edi, [esp + 0x148]
mov byte [esp + 0x3c4], 5
call fcn.0041a790
add esp, 0x10
mov edi, 8
cmp dword [esp + 0x60], edi
jb 0x4231ea
mov edx, dword [esp + 0x4c]
push edx
call fcn.004a93cc
add esp, 4
mov esi, 7
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov word [esp + 0x4c], bx
cmp dword [esp + 0x34], edi
jb 0x42320f
mov eax, dword [esp + 0x20]
push eax
call fcn.004a93cc
add esp, 4
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc0], ebx
mov word [esp + 0xb0], bx
mov dword [esp + 0x118], esi
mov dword [esp + 0x114], ebx
mov word [esp + 0x104], bx
mov dword [esp + 0x134], esi
mov dword [esp + 0x130], ebx
mov word [esp + 0x120], bx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3b4], 0xb
call fcn.0043e9f0
push 0xffffffffffffffff
push ebx
push eax
lea eax, [esp + 0xb8]
mov byte [esp + 0x3c0], 0xc
call fcn.004017c0
mov byte [esp + 0x3b4], 0xb
cmp dword [esp + 0x34], edi
jb 0x423295
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004a93cc
add esp, 4
lea esi, [esp + 0x11c]
lea edi, [esp + 0xc8]
call fcn.0043cbc0
mov edx, esi
push 0x4dab0c
push edx
lea esi, [esp + 0x24]
call fcn.0041a6d0
lea ecx, [esp + 0xb4]
push ecx
push eax
lea edi, [esp + 0x58]
mov byte [esp + 0x3c4], 0xd
call fcn.0041a790
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea eax, [esp + 0x10c]
mov byte [esp + 0x3c0], 0xe
call fcn.004017c0
mov edi, 8
cmp dword [esp + 0x60], edi
jb 0x423306
mov edx, dword [esp + 0x4c]
push edx
call fcn.004a93cc
add esp, 4
mov byte [esp + 0x3b4], 0xb
cmp dword [esp + 0x34], edi
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], ebx
mov word [esp + 0x4c], bx
jb 0x423332
mov eax, dword [esp + 0x20]
push eax
call fcn.004a93cc
add esp, 4
cmp dword [esp + 0x118], edi
mov eax, dword [esp + 0x104]
jae 0x423349
lea eax, [esp + 0x104]
push eax
push str.path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [esp + 0xfc], 0x10
mov esi, dword [esp + 0xe8]
mov dword [esp + 0x18], eax
jae 0x423377
lea esi, [esp + 0xe8]
cmp dword [esp + 0x3f4], edi
mov edx, dword [esp + 0x3e0]
jae 0x42338e
lea edx, [esp + 0x3e0]
cmp dword [esp + 0x150], edi
mov ecx, dword [esp + 0x13c]
jae 0x4233a5
lea ecx, [esp + 0x13c]
push edx
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessW]
push ecx
mov edi, 0x4fd078
lea edx, [esp + 0x70]
call fcn.0043e670
test eax, eax
jne 0x423466
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x4233e6
lea eax, [esp + 0xb0]
push eax
push str.path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edx, dword [0x4fd5d4]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea esi, [esp + 0x11c]
call fcn.0046b6e0
lea esi, [esp + 0x100]
call fcn.0046b6e0
lea esi, [esp + 0xac]
call fcn.0046b6e0
lea esi, [esp + 0x138]
call fcn.0046b6e0
lea ecx, [esp + 0xe4]
call fcn.00413d80
lea esi, [esp + 0xc8]
call fcn.0046b6e0
lea esi, [esp + 0x3c0]
call fcn.0046b6e0
lea esi, [esp + 0x3dc]
call fcn.0046b6e0
xor al, al
jmp 0x4235cd
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x423489
lea eax, [esp + 0xb0]
push eax
push str.path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edx, dword [0x4fd080]
lea ecx, [esp + 0x154]
push ecx
push edx
call fcn.0041e660
mov eax, dword [0x4fd5d4]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea esi, [esp + 0x11c]
call fcn.0046b6e0
lea esi, [esp + 0x100]
call fcn.0046b6e0
lea esi, [esp + 0xac]
call fcn.0046b6e0
lea esi, [esp + 0x138]
call fcn.0046b6e0
lea ecx, [esp + 0xe4]
call fcn.00413d80
lea esi, [esp + 0xc8]
mov byte [esp + 0x3b4], 1
call fcn.0046b6e0
mov esi, dword [ebp + 0x390]
cmp esi, ebx
je 0x423544
mov eax, dword [esi]
cmp eax, ebx
je 0x423535
mov eax, dword [eax + 0x10]
cmp eax, 0xffffffff
je 0x423535
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x423535
mov esi, dword [esi]
cmp esi, ebx
je 0x423535
call fcn.0042bc60
mov edi, dword [ebp + 0x390]
cmp edi, ebx
je 0x423544
call fcn.00402130
push 4
call fcn.004a9a85
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x3b4], 0xf
je 0x42356d
push ebp
push 0x424dd0
mov esi, eax
call fcn.0042bc80
jmp 0x42356f
xor eax, eax
mov dword [ebp + 0x390], eax
call fcn.0042bcd0
mov esi, 8
cmp dword [esp + 0x3d8], esi
jb 0x423598
mov ecx, dword [esp + 0x3c4]
push ecx
call fcn.004a93cc
add esp, 4
cmp dword [esp + 0x3f4], esi
mov dword [esp + 0x3d8], 7
mov dword [esp + 0x3d4], ebx
mov word [esp + 0x3c4], bx
jb 0x4235cb
mov edx, dword [esp + 0x3e0]
push edx
call fcn.004a93cc
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x3ac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x390]
xor ecx, esp
call fcn.004a9ce9
add esp, 0x3a4
ret 0x3c