Function at 0x100040d0
Capabilities:
Connect pipe
Get system information on windows
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64GetThreadSelectorEntry]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileBandwidthReservation]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PeekMessageW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_TabbedTextOutW]
xor eax, eax
lock inc dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
push str.7cm8Cm1NHYGLUZvnr
push 0
call dword [sym.imp.USER32.dll_CharNextExA]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolIoCallbacks]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetRegisteredRawInputDevices]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push 0
push 0
push str.gsE2U6bCiDaik9K4Sc4
call dword [sym.imp.KERNEL32.dll_FindFirstFileNameTransactedW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push str.x1VNQi16ba75Ob9zTIolfk6
push 0
call dword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateIconFromResource]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0
call dword [sym.imp.USER32.dll_MessageBoxIndirectW]
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
push 0
push 0
call dword [sym.imp.USER32.dll_CharToOemW]
push 0
push dword [ebp - 4]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_SetRectEmpty]
call dword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
push str.bx1yZuEWt49ACKIuGLI1VEZyM5
call dword [sym.imp.KERNEL32.dll_AddDllDirectory]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpool]
push 0
push 0
call dword [sym.imp.USER32.dll_GetScrollPos]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
call dword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TrySubmitThreadpoolCallback]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
push 0
push 0
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowRgnBox]
push 0
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockShared]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esp, ebp
pop ebp
ret