Function at 0x436f39
Capabilities:
Create thread
Delete file
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x11c]
sub esp, 0x19c
mov eax, dword [0x4705d0]
xor eax, ebp
mov dword [ebp + 0x118], eax
push ebx
push esi
mov esi, dword [ebp + 0x128]
push edi
xor eax, eax
mov word [ebp - 0x80], ax
lea edi, [ebp - 0x7e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
push 0x103
stosw word es:[edi], ax
lea eax, [ebp + 0x15]
push ebx
push eax
mov byte [ebp + 0x14], bl
call fcn.004464f0
push 0x3f
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.004464f0
push 0x3f
lea eax, [ebp - 0x2b]
push ebx
push eax
mov byte [ebp - 0x2c], bl
call fcn.004464f0
add esp, 0x24
mov dword [ebp - 0x70], ebx
cmp dword [ebp + 0x138], ebx
je 0x436fb7
push dword [ebp + 0x138]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp + 0x124]
cmp dword [ebp + 0x130], ebx
je 0x436fcc
mov dword [edi*4 + 0x4725f4], ebx
cmp dword [0x4725c0], ebx
je 0x436fdb
xor eax, eax
jmp 0x43746d
cmp dword [edi*4 + 0x4725d4], 1
jge 0x436ffd
push 0x12040
push str.System_Message
push str.The_file_is_empty._n_nPlease_add_commands_before_using_this_feature.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x436fd4
lea eax, [ebp + 0x14]
push eax
call fcn.0041f17e
push str.RestartLog
call fcn.0044426c
pop ecx
test eax, eax
je 0x43701f
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x405
cmp word [ebp + 0x12c], ax
je 0x437042
add eax, 2
cmp word [ebp + 0x12c], ax
jne 0x437318
jmp 0x4371cc
push str.ResetUserVariables
call fcn.0044426c
pop ecx
test eax, eax
je 0x4370b7
push str.vTaskClass
call fcn.00440eea
cmp eax, 1
jg 0x4370b7
test byte [0x472680], 2
jne 0x4370b7
push str.SOFTWARE_vTaskUserVariables
push ebx
push ebx
push ebx
push 4
call fcn.0044129f
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x14
push ebx
push ebx
push 0x1009
push 0x507
push dword [0x472450]
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x102f
push 0x507
push dword [0x472450]
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor edx, edx
cmp dword [edi*4 + 0x4725d4], ebx
jle 0x4370ed
lea eax, [edi*4 + 0x473bec]
xor ecx, ecx
mov esi, dword [eax]
mov dword [esi + ecx + 0xf28], ebx
mov esi, dword [eax]
mov byte [esi + ecx + 0xf24], bl
inc edx
add ecx, 0xf54
cmp edx, dword [edi*4 + 0x4725d4]
jl 0x4370cb
cmp dword [0x47268c], ebx
je 0x437114
push dword [0x472454]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x437114
push 1
push ebx
push dword [0x472454]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x40
push ebx
push 0x476fe8
mov dword [0x472468], ebx
mov dword [0x476fdc], ebx
mov dword [0x476fe0], ebx
mov dword [0x476fac], ebx
mov byte [0x476380], bl
call fcn.004464f0
push 0x100
push ebx
push 0x477028
call fcn.004464f0
mov esi, edi
push 0x40
shl esi, 6
lea eax, [esi + 0x476528]
push ebx
push eax
call fcn.004464f0
push 0x40
lea eax, [esi + 0x476728]
push ebx
push eax
call fcn.004464f0
push 0x40
lea eax, [esi + 0x476928]
push ebx
push eax
call fcn.004464f0
push 0x40
lea eax, [esi + 0x476b28]
push ebx
push eax
call fcn.004464f0
add esp, 0x48
push 0x40
lea eax, [esi + 0x476d28]
push ebx
push eax
call fcn.004464f0
push 8
push ebx
push 0x4773c8
call fcn.004464f0
push 8
push ebx
push 0x4773d0
call fcn.004464f0
push 8
push ebx
push 0x4773d8
call fcn.004464f0
add esp, 0x30
push str.SOFTWARE_vTaskFailStep
push ebx
push ebx
push ebx
push 4
call fcn.0044129f
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [ebp + 0x14]
push str.SOFTWARE_vTaskInterStepDelay__d
push eax
mov dword [0x4775e0], ebx
call esi
lea eax, [ebp + 0x14]
push eax
push ebx
push ebx
push ebx
push 4
call fcn.0044129f
push str.__r_n
call fcn.0042036e
add esp, 0x38
push str._____START_OF_RUN
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + 0x14]
push eax
call edi
push 0x3c
pop ecx
sub ecx, eax
jns 0x437234
xor ecx, ecx
jmp 0x43723f
lea eax, [ebp + 0x14]
push eax
call edi
push 0x3c
pop ecx
sub ecx, eax
push ecx
push 0x2d
lea eax, [ebp + 0x14]
push eax
call edi
lea eax, [ebp + eax + 0x14]
push eax
call fcn.004464f0
lea eax, [ebp + 0x14]
push eax
mov byte [ebp + 0x50], bl
call fcn.0042036e
mov eax, dword [ebp + 0x124]
imul eax, eax, 0x104
add eax, 0x472858
push eax
lea eax, [ebp + 0x14]
push str.SCRIPT:___s_
push eax
call esi
lea eax, [ebp + 0x14]
push eax
call fcn.0042036e
add esp, 0x20
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x6c]
push eax
movzx eax, word [ebp - 0x7c]
push 1
push eax
call fcn.00416a2e
lea eax, [ebp - 0x2c]
push eax
movzx eax, word [ebp - 0x7e]
push 3
push eax
call fcn.00416a2e
movzx eax, word [ebp - 0x80]
push eax
lea eax, [ebp - 0x2c]
push eax
movzx eax, word [ebp - 0x7a]
push eax
lea eax, [ebp - 0x6c]
push eax
movzx eax, word [ebp - 0x74]
push eax
movzx eax, word [ebp - 0x76]
push eax
movzx eax, word [ebp - 0x78]
push eax
lea eax, [ebp + 0x14]
push str.TIME:____d:_02d:_02d_on__s___d__s__d
push eax
call esi
lea eax, [ebp + 0x14]
push eax
call fcn.0042036e
add esp, 0x40
cmp byte [0x476258], 2
jb 0x4372fd
push str.LOG_LEVEL_HIGH
call fcn.0042036e
pop ecx
lea eax, [ebp + 0x14]
push eax
push ebx
push 1
push dword [0x472434]
call fcn.0041f060
mov edi, dword [ebp + 0x124]
add esp, 0x10
push str.DisableScreenSaver
call fcn.0044426c
pop ecx
test eax, eax
je 0x43735e
mov esi, str.HKEY_CURRENT_USERControl_PanelDesktopScreenSaveActive
push esi
push 0xf
lea eax, [ebp + 0x14]
push eax
push ebx
push 3
call fcn.0044129f
push esi
push 2
push 0x45b754
push 1
push 2
call fcn.0044129f
push str.ScreenSaverHolder
lea eax, [ebp + 0x14]
push ebx
push eax
call fcn.00444117
add esp, 0x34
movzx eax, byte [0x47000c]
push eax
mov dword [0x472698], ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp dword [ebp + 0x134], ebx
jge 0x43737e
xor eax, eax
jmp 0x437394
mov eax, dword [edi*4 + 0x4725d4]
dec eax
cmp dword [ebp + 0x134], eax
jg 0x437394
mov eax, dword [ebp + 0x134]
shl edi, 0x1c
add edi, eax
push str.RunTrackingShow
mov dword [ebp - 0x70], edi
call fcn.0044426c
pop ecx
test eax, eax
je 0x437453
mov eax, 0x405
cmp word [ebp + 0x12c], ax
je 0x4373cd
add eax, 2
cmp word [ebp + 0x12c], ax
jne 0x437453
mov eax, dword [0x476364]
cmp eax, ebx
je 0x4373e1
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.SOFTWARE_vTaskColorsResultSuccessFill
mov dword [0x47714c], ebx
call fcn.0044426c
pop ecx
cmp eax, ebx
jne 0x4373fb
mov eax, 0xecffec
push eax
push str.RunTrackingAlpha
call fcn.0044426c
pop ecx
push eax
push str.RunTrackingTimeout
call fcn.0044426c
pop ecx
push eax
push ebx
call fcn.0043ec20
lea eax, [eax + eax + 0xa]
push eax
push str.RunTrackingWidth
call fcn.0044426c
pop ecx
push eax
push str.RunTrackingY
call fcn.0044426c
pop ecx
push eax
push str.RunTrackingX
call fcn.0044426c
pop ecx
push eax
push dword [0x472420]
call fcn.00440f71
mov dword [0x476364], eax
lea eax, [ebp - 0x70]
push eax
push ebx
push dword [ebp - 0x70]
push 0x4366cd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4725c0], eax
mov ecx, dword [ebp + 0x118]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464bf
add ebp, 0x11c
leave
ret 0x18