Function at 0x4286a0
Capabilities:
Accept command line arguments
Identify system language via api
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44e934
push eax
mov dword fs:[0], esp
sub esp, 0x35c
push ebx
push ebp
push esi
push edi
call fcn.00441780
test eax, eax
jne 0x4286d0
or eax, 0xffffffff
jmp 0x428e92
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [esp + 0x10]
push eax
xor ebp, ebp
push 0xfffffffffffffff6
mov dword [esp + 0x18], ebp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push eax
call edi
test eax, eax
je 0x42871e
mov eax, dword [esp + 0x10]
test al, 0x40
je 0x42871e
and eax, 0xffffffbf
or eax, 0x80
push eax
push 0xfffffffffffffff6
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
je 0x42871e
lea ecx, [esp + 0x10]
push ecx
push 0xfffffffffffffff6
call esi
push eax
call edi
mov edi, dword [esp + 0x380]
mov edx, dword [edi]
push edx
lea ecx, [esp + 0x88]
call fcn.0041b940
lea ecx, [esp + 0x84]
mov dword [esp + 0x374], ebp
call fcn.0041b980
mov eax, dword [edi]
push eax
call fcn.00434390
or ebx, 0xffffffff
add esp, 4
cmp eax, ebx
je 0x428e59
cmp eax, ebp
je 0x42876e
cmp eax, 1
je 0x428780
mov al, byte [esp + 0x17]
test al, al
jne 0x428780
push 1
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
cmp eax, 1
jbe 0x4287d6
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push ebp
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x38]
push eax
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
mov dword [esp + 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push ebp
call fcn.0040fb10
add esp, 0x2c
lea ecx, [esp + 0x84]
mov dword [esp + 0x374], ebx
call fcn.00429050
xor eax, eax
jmp 0x428e92
push 0x8000
push 0x100
push 0x100
push 1
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push eax
call dword [0x45c4a8]
call fcn.00427d00
push eax
call fcn.00427cc0
mov cl, byte [0x5785e4]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x18], cl
call fcn.00427d90
add esp, 8
cmp eax, ebp
mov dword [0x57883c], eax
je 0x4288c0
mov eax, dword [esp + 0x10]
push eax
call fcn.00427cc0
mov ecx, dword [0x57883c]
lea eax, [ecx + 4]
mov dword [0x578840], eax
mov edx, dword [eax]
add esp, 4
mov dword [0x578814], edx
call fcn.00427e00
push 0x10
call fcn.0040b4c0
add esp, 4
call fcn.0040f7b0
cmp eax, ebp
je 0x4288f9
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x48]
mov ax, word [esi]
cmp ax, bp
je 0x4288f9
mov ebx, 0x57
mov ebp, 0x4c
mov edi, 0x3d
lea esp, [esp]
cmp ax, 0x4b
jne 0x4288a8
cmp word [esi + 2], bx
jne 0x4288a8
cmp word [esi + 4], bp
jne 0x4288a8
cmp word [esi + 6], di
je 0x4288d0
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
lea esi, [esi + eax*2 + 2]
mov ax, word [esi]
add esp, 4
test ax, ax
jne 0x428890
jmp 0x4288ed
mov dword [esp + 0x374], 2
jmp 0x428e71
push 0x91
mov byte [0x578844], 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
jne 0x4288ed
mov byte [0x578845], 1
mov edi, dword [esp + 0x380]
xor ebp, ebp
or ebx, 0xffffffff
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 1
push 1
mov ecx, 0x578850
call fcn.00429a40
cmp eax, ebp
mov dword [0x57858c], eax
jne 0x428948
mov edi, dword [0x578850]
xor ecx, ecx
cmp edi, 0xfffffffe
setne cl
push ebp
push ebp
push ebp
add ecx, 0x17
push ecx
call fcn.0042f770
add esp, 0x10
mov dword [esp + 0x374], 3
jmp 0x428e71
mov eax, dword [esp + 0x37c]
cmp eax, 1
jne 0x428a3c
push 0x5776b0
call fcn.00428320
add esp, 4
dec eax
je 0x4289f8
dec eax
jne 0x428a0b
mov eax, dword [0x578828]
push eax
mov ecx, 0x5785a8
call fcn.004279e0
test al, al
jne 0x428aa3
mov eax, dword [0x460904]
mov cx, word [0x460908]
mov dx, word [0x4608a0]
mov dword [esp + 0x20], eax
mov eax, dword [0x4608fc]
mov word [esp + 0x24], cx
mov cx, word [0x460900]
mov dword [esp + 0x18], eax
mov word [esp + 0x22], dx
mov dx, word [0x4608a2]
lea eax, [esp + 0x18]
push eax
mov word [esp + 0x20], cx
mov ecx, dword [0x578828]
mov word [esp + 0x1c], dx
push ecx
lea edx, [esp + 0x28]
push edx
push 9
call fcn.0042f770
add esp, 0x10
mov dword [esp + 0x374], 6
jmp 0x428ba8
mov edx, dword [0x5776b0]
mov eax, dword [edx + 0x3c]
push ebp
push eax
call fcn.00429e20
add esp, 8
lea ecx, [esp + 0x90]
mov dword [esp + 0x374], 4
call fcn.0040b740
lea ecx, [esp + 0x84]
mov dword [esp + 0x374], ebx
call fcn.0040b740
xor eax, eax
jmp 0x428e92
cmp eax, 2
je 0x428a5e
push ebp
push ebp
push ebp
push 1
call fcn.0042f770
add esp, 0x10
mov dword [esp + 0x374], 5
jmp 0x428e71
mov eax, dword [edi + 4]
push 0x578834
push 0x57882c
push 0x578800
push eax
call fcn.0040f710
add esp, 0x10
cmp eax, ebp
mov dword [0x578828], eax
je 0x428978
mov ecx, dword [0x57882c]
mov edx, dword [0x578834]
sub ecx, eax
sar ecx, 1
sub edx, ecx
mov dword [0x578830], edx
jmp 0x428978
push 0x5785a8
mov ecx, 0x578810
mov dword [0x5785a0], 0x4c4c574b
mov dword [0x5785a4], 1
call fcn.0042a530
cmp eax, ebp
jg 0x428b29
push ebp
jge 0x428ae9
push ebp
push ebp
push 0x11
call fcn.0042f770
add esp, 0x10
mov dword [esp + 0x374], 7
jmp 0x428bfd
push 0x5785a8
call fcn.00428440
add esp, 8
mov esi, eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x374], 8
call fcn.0040b740
lea ecx, [esp + 0x84]
mov dword [esp + 0x374], ebx
call fcn.0040b740
mov eax, esi
jmp 0x428e92
push 0x104
push 0x5785f0
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5785f0
mov dword [0x57880c], 0x5785f0
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [0x57880c]
lea eax, [ecx + eax*2]
push eax
push ecx
mov dword [0x5785e8], eax
call fcn.0040f5b0
mov dword [0x578818], eax
mov dword [edi], 0x5785f0
mov eax, dword [0x45d910]
add esp, 0xc
cmp eax, ebp
je 0x428b80
call fcn.0041ba90
cmp dword [0x576178], ebx
je 0x428b90
cmp dword [0x57617c], ebx
jne 0x428bd1
push ebp
push ebp
push ebp
push 7
call fcn.0042f770
add esp, 0x10
mov dword [esp + 0x374], 9
lea ecx, [esp + 0x90]
call fcn.0040b740
lea ecx, [esp + 0x84]
mov dword [esp + 0x374], ebx
call fcn.0040b740
mov eax, 0xfffffffe
jmp 0x428e92
lea eax, [esp + 0x84]
push eax
call fcn.0041b790
add esp, 4
test al, al
jne 0x428c26
push ebp
push ebp
push ebp
push 8
call fcn.0042f770
add esp, 0x10
mov dword [esp + 0x374], 0xa
lea ecx, [esp + 0x90]
call fcn.0040b740
lea ecx, [esp + 0x84]
mov dword [esp + 0x374], ebx
call fcn.0040b740
mov eax, 0xfffffffd
jmp 0x428e92
mov ecx, dword [edi]
cmp dword [0x45d910], ebp
mov edx, dword [0x578828]
mov dword [0x578820], ecx
mov dword [0x578824], edx
je 0x428c47
call fcn.0041ba90
mov eax, dword [0x57617c]
push eax
mov ecx, 0x576150
call fcn.00404010
cmp dword [0x45d910], ebp
je 0x428c64
call fcn.0041ba90
mov eax, dword [0x57617c]
push 0x18
push eax
call fcn.0041bfd0
add esp, 8
push 1
push 0x36
mov byte [0x578838], 1
call fcn.00427dd0
add esp, 4
push eax
call fcn.0041ba50
mov eax, dword [0x578828]
add esp, 8
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], ebp
mov byte [esp + 0x50], 0
push ebp
push 0x428eb0
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x380], 0xb
call fcn.0041ded0
mov esi, eax
mov al, byte [esp + 0x50]
test al, al
mov byte [esp + 0x374], 0
je 0x428ce1
lea ecx, [esp + 0x40]
call fcn.00411260
cmp dword [0x45dcfc], ebp
je 0x428cee
call fcn.0041c9c0
mov ecx, 0x5771d0
call fcn.0041c780
mov al, byte [0x57881c]
test al, al
je 0x428d16
push 1
push 0x37
call fcn.00427dd0
add esp, 4
push eax
call fcn.0041ba50
add esp, 8
cmp esi, ebp
je 0x428e14
cmp esi, 2
jne 0x428d7b
push 0x5785b4
push ebp
call fcn.00428440
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov al, byte [esp + 0x9c]
add esp, 8
test al, al
jne 0x428d4d
mov dword [esp + 0x90], ebp
jmp 0x428d5b
mov eax, dword [esp + 0x90]
cmp eax, ebp
je 0x428d5b
push eax
call esi
mov al, byte [esp + 0x88]
test al, al
je 0x428d74
mov eax, dword [esp + 0x84]
cmp eax, ebp
je 0x428d74
push eax
call esi
mov eax, edi
jmp 0x428e92
push 1
push 0x38
call fcn.00427dd0
add esp, 4
push eax
call fcn.0041ba50
add esp, 8
push 1
push 0x3a
call fcn.00427dd0
add esp, 4
push eax
call fcn.0041ba50
add esp, 8
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [esp + 0x10]
mov esi, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x428dff
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
and eax, 0xfffffff9
push eax
push esi
call edi
test eax, eax
je 0x428dff
push ebp
lea ecx, [esp + 0x2c]
push ecx
push 1
push 0x5787fc
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edx, dword [esp + 0x10]
push edx
push esi
call edi
cmp dword [esp + 0x28], ebp
jne 0x428e14
mov word [0x5787fc], bp
jmp 0x428e14
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push eax
call dword [sym.imp.MSVCRT.dll_fgetwc]
add esp, 4
mov word [0x5787fc], ax
mov al, byte [esp + 0x94]
test al, al
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x428e2e
mov dword [esp + 0x90], ebp
jmp 0x428e3c
mov eax, dword [esp + 0x90]
cmp eax, ebp
je 0x428e3c
push eax
call esi
mov al, byte [esp + 0x88]
test al, al
je 0x428e55
mov eax, dword [esp + 0x84]
cmp eax, ebp
je 0x428e55
push eax
call esi
xor eax, eax
jmp 0x428e92
push ebp
push ebp
push ebp
push 0x18
call fcn.0042f770
add esp, 0x10
mov dword [esp + 0x374], 1
lea ecx, [esp + 0x90]
call fcn.0040b740
lea ecx, [esp + 0x84]
mov dword [esp + 0x374], ebx
call fcn.0040b740
mov eax, ebx
mov ecx, dword [esp + 0x36c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x368
ret