Function at 0x452fb8
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
push ebx
push esi
lea esi, [ebp + 8]
push edi
mov edi, ecx
lea eax, [ebp + 0xc]
neg esi
sbb esi, esi
lea ebx, [edi + 0x1c8]
and esi, eax
mov eax, ebx
neg eax
push dword [esi]
lea ecx, [edi + 0x1cc]
sbb eax, eax
and eax, ecx
lea ecx, [ebp - 0x28]
push dword [eax]
call fcn.00489980
cmp dword [0x4c5fbc], 0
jne 0x4532c3
mov eax, dword [0x4af550]
mov esi, dword [esi]
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x1bc]
push ecx
push esi
push eax
call fcn.004683c4
add esp, 0xc
test eax, eax
je 0x4532bb
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.00489a02
push 0
push 0x4af810
lea ecx, [ebp - 4]
call fcn.00403d34
mov esi, 0x4b0254
lea ecx, [ebp - 0xc]
push esi
mov ebx, eax
call fcn.00403927
push esi
lea ecx, [ebp - 0x10]
call fcn.00403927
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00489a02
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00403b20
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
cmp ebx, 0xffffffff
je 0x45311a
lea eax, [ebp - 0xc]
push ebx
push eax
lea ecx, [ebp - 4]
call fcn.00419ba2
mov ecx, dword [ebp - 4]
lea eax, [ebx + 1]
mov ecx, dword [ecx - 8]
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x10]
lea ecx, [ebp - 4]
push eax
call fcn.0040acf3
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00453814
lea eax, [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00403a8c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push 0x4b02d8
push eax
call fcn.0040a9a2
mov eax, dword [eax]
lea ecx, [ebp - 0x1c]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push ecx
mov ecx, esp
push eax
call fcn.004038b5
lea eax, [ebp - 8]
push eax
call fcn.004711da
add esp, 0xc
lea ecx, [ebp - 4]
push eax
call fcn.00403a8c
lea ecx, [ebp - 8]
call fcn.004038fb
push ebx
push 0x4b5960
lea ecx, [ebp - 4]
call fcn.00403d34
test eax, eax
jge 0x45316a
push ebx
push 0x4b1a7c
lea ecx, [ebp - 4]
call fcn.00403d34
test eax, eax
jl 0x4531b5
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push 0x4afefc
push eax
call fcn.0045f431
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040a956
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00403b20
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea eax, [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00403a8c
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea eax, [ebp - 4]
push eax
call fcn.0045fecc
pop ecx
lea ecx, [ebp - 0x48c]
call fcn.004532dc
push dword [ebp - 4]
lea ecx, [ebp - 0x48c]
call fcn.0040b114
mov esi, eax
cmp esi, ebx
je 0x4531fb
lea eax, [ebp - 8]
lea ecx, [ebp - 0x48c]
push eax
call fcn.0040aff0
push eax
lea ecx, [ebp - 4]
call fcn.00403a8c
lea ecx, [ebp - 8]
jmp 0x45323e
push ecx
lea eax, [ebp - 4]
mov ebx, esp
push eax
push 0x4b5958
lea eax, [ebp - 0x14]
push 0xe6
push eax
call fcn.00461337
pop ecx
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040a956
push eax
push ebx
call fcn.00403b20
mov ecx, dword [edi + 0xdc]
call fcn.00475d80
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
mov eax, dword [0x4af550]
push 0x11
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x453265
push str.runas
lea ecx, [ebp - 0x18]
call fcn.00403adc
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 4]
push dword [ebp - 0x18]
push dword [edi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.004038fb
lea ecx, [ebp - 0x48c]
call fcn.0040b1e1
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x28]
call fcn.004893ad
lea ecx, [ebp + 8]
call fcn.004893ad
mov eax, esi
jmp 0x4532d5
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x28]
call fcn.004893ad
lea ecx, [ebp + 8]
call fcn.004893ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8