Function at 0x42b9a0
Capabilities:
Check for time delay via queryperformancecounter
Hide graphical window
Log keystrokes via polling
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x1b8
mov eax, dword [0x4e3040]
xor eax, esp
mov dword [esp + 0x1b4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push 0x7f00
push 0
mov dword [esp + 0x24], edi
movlpd qword [esp + 0x100], xmm0
mov dword [esp + 0x10c], 0
mov dword [esp + 0x118], 0
mov dword [esp + 0xfc], 0x4211a0
mov dword [esp + 0xf8], 3
mov dword [esp + 0x108], edi
mov dword [esp + 0x11c], str.wf_launcher_2014
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x108], eax
lea eax, [esp + 0xf0]
push eax
mov dword [esp + 0x110], 0xc
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x42ba5a
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1b4]
xor ecx, esp
call fcn.00438c87
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x148]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x154]
push 0
push edi
push 0
cdq
push 0
sub eax, edx
push 0x190
sar eax, 1
push 0x258
sub eax, 0x4b
push eax
mov eax, dword [esp + 0x16c]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x96
push eax
push accept
push str.Warface_2014_Launcher
push str.wf_launcher_2014
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4e5e2c], eax
test eax, eax
jne 0x42badd
mov eax, 2
pop edi
pop esi
mov ecx, dword [esp + 0x1b4]
xor ecx, esp
call fcn.00438c87
mov esp, ebp
pop ebp
ret 0x10
push 0x20
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
jne 0x42bafb
push edi
push str.wf_launcher_2014
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0x4e95ac
push 0x4e95b0
push 0x40
push dword [0x4e5e2c]
xorps xmm0, xmm0
mov dword [0x4e95c4], 0
push 1
movlpd qword [0x4e95b0], xmm0
movlpd qword [0x4e95bc], xmm0
mov dword [0x4e95cc], 0
movlpd qword [0x4e95dc], xmm0
mov dword [0x4e95d0], 1
mov dword [0x4e95c8], 1
mov dword [0x4e95b8], 0
mov dword [0x4e95d4], 1
mov dword [0x4e95d8], 0x50
mov dword [0x4e95e4], 1
mov eax, dword [esi]
push 0
push esi
call dword [eax + 0x40]
test eax, eax
jns 0x42bb97
mov eax, dword [esi]
push esi
call dword [eax + 8]
push edi
push str.wf_launcher_2014
jmp 0x42c10e
mov eax, dword [0x4e5e2c]
mov dword [0x4e9594], eax
mov eax, dword [0x4e95ac]
push 0x4e95a0
mov dword [0x4e958c], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42bc73
push 0x4e9598
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x42bc73
mov ecx, dword [0x4e3ef0]
mov eax, dword [0x4e9594]
mov dword [ecx + 0x28], 9
mov dword [ecx + 0x2c], 0x25
mov dword [ecx + 0x30], 0x27
mov dword [ecx + 0x34], 0x26
mov dword [ecx + 0x38], 0x28
mov dword [ecx + 0x3c], 0x21
mov dword [ecx + 0x40], 0x22
mov dword [ecx + 0x44], 0x24
mov dword [ecx + 0x48], 0x23
mov dword [ecx + 0x4c], 0x2e
mov dword [ecx + 0x50], 8
mov dword [ecx + 0x54], 0xd
mov dword [ecx + 0x58], 0x1b
mov dword [ecx + 0x5c], 0x41
mov dword [ecx + 0x60], 0x43
mov dword [ecx + 0x64], 0x56
mov dword [ecx + 0x68], 0x58
mov dword [ecx + 0x6c], 0x59
mov dword [ecx + 0x70], 0x5a
mov dword [ecx + 0xac], 0x420660
mov dword [ecx + 0xc8], eax
jmp 0x42bc79
mov ecx, dword [0x4e3ef0]
call fcn.00421260
mov eax, dword [ecx + 0x80]
mov edx, 0x4d7568
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov ecx, str.C:WindowsFonts_segoeui.ttf
mov dword [esp + 0xc], eax
call fcn.00402eb0
mov esi, eax
test esi, esi
je 0x42be0c
push 2
push 0
push esi
call fcn.00497883
add esp, 0xc
test eax, eax
jne 0x42be03
push esi
call fcn.00496bd4
mov edi, eax
add esp, 4
mov dword [esp + 0x118], edi
cmp edi, 0xffffffff
je 0x42be03
push 0
push 0
push esi
call fcn.00497883
add esp, 0xc
test eax, eax
jne 0x42be03
mov eax, dword [0x4e3ef0]
push edi
inc dword [eax + 0x310]
mov eax, dword [eax + 0xbc]
call eax
add esp, 4
mov dword [esp + 0x10], eax
push esi
test eax, eax
je 0x42be04
push edi
push 1
push eax
call fcn.0049ba91
add esp, 0x10
push esi
cmp eax, edi
je 0x42bd4e
call fcn.00497530
mov eax, dword [0x4e3ef0]
add esp, 4
mov ecx, dword [esp + 0x10]
dec dword [eax + 0x310]
mov eax, dword [eax + 0xc0]
push ecx
call eax
jmp 0x42be09
call fcn.00497530
add esp, 4
lea ecx, [esp + 0x80]
call fcn.0041d6c0
mov ecx, 0x17
lea edi, [esp + 0x158]
mov esi, eax
rep movsd dword es:[edi], dword [esi]
cmp byte [esp + 0x18d], 0
jne 0x42bdbe
mov eax, 0x4dba10
mov cl, byte [eax - 1]
cmp cl, 0x2f
je 0x42bd96
cmp cl, 0x5c
je 0x42bd96
dec eax
cmp eax, str.C:WindowsFonts_segoeui.ttf
ja 0x42bd81
movsd xmm0, qword [0x4dc6e0]
sub esp, 8
movsd qword [esp], xmm0
push eax
push str._s___.0fpx
lea eax, [esp + 0x19d]
push 0x20
push eax
call fcn.00413f70
add esp, 0x18
mov eax, dword [esp + 0x118]
lea esi, [esp + 0x158]
mov ecx, 0x17
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
push eax
mov dword [esp + 0x34], 0x41a00000
mov dword [esp + 0x54], 0x4dafa0
call fcn.0041dac0
jmp 0x42be0c
push esi
call fcn.00497530
add esp, 4
push 0xa
push dword [0x4e5e2c]
xorps xmm0, xmm0
mov dword [esp + 0x140], 0
movaps xmmword [esp + 0x128], xmm0
movq qword [esp + 0x138], xmm0
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4e5e2c]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esp + 0x124], 0x12
je 0x42c0cd
mov edi, dword [sym.imp.USER32.dll_SetCursor]
nop dword [eax]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x130]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42be9b
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x42c0bf
cmp dword [0x4e9584], 0
jne 0x42bea9
call fcn.00421010
mov esi, dword [0x4e3ef0]
lea eax, [esp + 0xe0]
push eax
push dword [0x4e9594]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0xe8]
sub eax, dword [esp + 0xe0]
movd xmm1, eax
mov eax, dword [esp + 0xec]
sub eax, dword [esp + 0xe4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x118]
cvtdq2ps xmm0, xmm0
push eax
movss dword [esi + 4], xmm1
movss dword [esi + 8], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x118]
sub ecx, dword [0x4e9598]
mov edx, dword [esp + 0x11c]
sbb edx, dword [0x4e959c]
call fcn.004b99d0
mov edx, dword [0x4e95a4]
mov ecx, dword [0x4e95a0]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0xc], xmm0
call fcn.004b99d0
movss xmm1, dword [esp + 0xc]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [esi + 0xc], xmm1
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x120]
mov dword [0x4e9598], eax
mov dword [0x4e959c], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
push 0x10
mov byte [esi + 0xe1], al
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
push 0x12
mov byte [esi + 0xe2], al
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [esi + 0xe4], 0
cmp byte [esi + 0xe0], 0
mov byte [esi + 0xe3], al
je 0x42bfb8
push 0
call edi
call fcn.00403e90
cmp byte [0x4e3f40], 0
je 0x42c12d
mov eax, dword [0x4e3ef0]
mov edx, 0x4e3f40
movss xmm3, dword [0x4dc768]
mov ecx, str.Warface_2014_Launcher
push 0x13e
mov dword [esp + 0x14], 0
mov dword [eax + 0x17c8], 0x44160000
mov dword [eax + 0x17cc], 0x43c80000
mov dword [eax + 0x17e0], 2
mov dword [eax + 0x17c0], 0
mov dword [eax + 0x17c4], 0
mov dword [eax + 0x17dc], 2
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 0
call fcn.00407b10
add esp, 8
call fcn.0042a340
call fcn.0042b280
call fcn.0040afb0
mov eax, dword [0x4e95ac]
push 0
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4e95ac]
push 0
push 0x1b
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4e95ac]
push 0
push 0xae
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4e95ac]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x42c0ac
call fcn.00405ba0
mov eax, dword [0x4e95ac]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov eax, dword [0x4e95ac]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x44]
cmp dword [esp + 0x124], 0x12
jne 0x42be60
call fcn.00421130
call fcn.00404ca0
mov ecx, dword [0x4e95ac]
mov dword [0x4e958c], 0
mov dword [0x4e9594], 0
test ecx, ecx
je 0x42c0fb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x18]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
push dword [esp + 0x1c]
push str.Warface_2014_Launcher
mov eax, dword [sym.imp.USER32.dll_UnregisterClassA]
call eax
mov ecx, dword [esp + 0x1bc]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00438c87
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]