Function at 0x424de0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check for unmoving mouse cursor
Log keystrokes via polling
Suspend thread

Disassembly:
push ebp
lea ebp, [esp - 0x4b8]
sub esp, 0x534
mov eax, dword [0x4705d0]
xor eax, ebp
mov dword [ebp + 0x4b4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x207
lea eax, [ebp + 0x2ad]
push ebx
push eax
mov byte [ebp - 0x5d], bl
mov byte [ebp + 0x2ac], bl
call fcn.004464f0
mov esi, 0x103
push esi
lea eax, [ebp + 0x1a9]
push ebx
push eax
mov byte [ebp + 0x1a8], bl
call fcn.004464f0
push esi
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], bl
call fcn.004464f0
mov esi, dword [ebp + 0x4c0]
xor eax, eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x7c], ebx
lea edi, [ebp - 0x70]
stosd dword es:[edi], eax
mov dword [0x472684], ebx
mov ebx, dword [ebp + 0x4c4]
add esp, 0x24
imul ebx, ebx, 0xf54
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push dword [ebp + 0x4c4]
lea esi, [esi*4 + 0x473bec]
mov eax, dword [esi]
push dword [ebp + 0x4c0]
lea eax, [eax + ebx + 0x15c]
push eax
call fcn.00439ea7
push edi
push edi
push dword [0x4775e4]
call fcn.00418a96
fmul qword [0x45ec20]
add esp, 0xc
call fcn.00448380
mov dword [ebp - 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x68], eax
mov eax, dword [esi]
add eax, ebx
push str.Freeze
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x424ef2
push dword [0x4775e4]
push str.____Duration:__s_second_s_
call fcn.0042036e
pop ecx
pop ecx
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
jmp 0x4259b1
mov eax, dword [esi]
add eax, ebx
push 0x45ebf0
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x424f78
push dword [0x4775e4]
push str.____Duration:__s_second_s_
call fcn.0042036e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
pop ecx
call edi
sub eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x6c]
jae 0x424eea
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 0xfa
push 0
call esi
cmp dword [ebp - 0x6c], ebx
mov eax, dword [ebp - 0x6c]
jl 0x424f42
mov eax, ebx
push eax
call esi
movzx eax, byte [0x47000c]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x425216
cmp dword [0x472698], 0
jne 0x425216
call edi
sub eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x6c]
jb 0x424f34
jmp 0x424eea
mov eax, dword [esi]
add eax, ebx
push str.Keypress
push eax
call fcn.004010ff
pop ecx
pop ecx
mov edi, str.Mouse
test eax, eax
jne 0x4256ee
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4256ee
mov eax, dword [esi]
add eax, ebx
push str.Restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42521e
mov eax, dword [ebp + 0x4c0]
imul eax, eax, 0x104
push 0xc
lea ecx, [ebp + 0x2ac]
lea eax, [eax + 0x472858]
push ecx
push eax
mov dword [ebp - 0x64], eax
call fcn.0040dac4
lea eax, [ebp + 0x2ac]
push eax
lea eax, [ebp + 0x1a8]
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x1a8]
push eax
xor edi, edi
push edi
push edi
push edi
push 1
call fcn.0044129f
mov dword [ebp - 0x68], eax
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Remove
push eax
call fcn.004010ff
add esp, 0x28
test eax, eax
je 0x425059
lea eax, [ebp + 0x1a8]
push eax
push edi
push edi
push edi
push 4
call fcn.0044129f
lea eax, [ebp + 0x2ac]
push eax
push str.____Successfully_removed_restart_entry_for___s_
call fcn.0042036e
add esp, 0x1c
jmp 0x424eea
push 0x103
lea eax, [ebp + 0x2ac]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x45aca0
push edi
push 0
lea eax, [ebp + 0x2ac]
push eax
call fcn.0043feaa
push edi
lea eax, [ebp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x2ac]
push str.vTask.exe
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4250c0
push str..VXM
push dword [ebp - 0x64]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4250f0
push str.__r__
lea eax, [ebp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x64]
lea eax, [ebp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea eax, [ebp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__s
lea eax, [ebp + 0x2ac]
push eax
call edi
mov eax, dword [ebp + 0x4c4]
inc eax
push eax
lea eax, [ebp - 0x5c]
push 0x45aac0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x2ac]
push eax
call edi
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
cmp byte [eax], 0
mov edi, str.Temp
je 0x425165
push str.Perm
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x425165
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42517d
cmp dword [ebp - 0x68], 0
jne 0x42517d
lea eax, [ebp + 0x1a8]
push eax
lea eax, [ebp + 0x2ac]
push 0
push eax
call fcn.00444117
add esp, 0xc
push 0x103
lea eax, [ebp - 0x5c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [ebp - 0x68], 0
je 0x4251f8
push 0x45af40
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4251c6
lea eax, [ebp - 0x5c]
push str.vTask.EXE
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x4251f8
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x424eea
lea eax, [ebp + 0x1a8]
push eax
xor eax, eax
push eax
push eax
push eax
push 4
call fcn.0044129f
add esp, 0x14
jmp 0x424eea
push str.____Successfully_saved_restart_configuration
call fcn.0042036e
lea eax, [ebp + 0x2ac]
push eax
push str.____Script_will_be_launched_next_time_Windows_is_started___s_
call fcn.0042036e
add esp, 0xc
or eax, 0xffffffff
jmp 0x4259b1
mov eax, dword [esi]
add eax, ebx
push str.Window
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4252c0
mov eax, dword [esi]
lea eax, [eax + ebx + 0x364]
push 0x45a7f8
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4252c0
mov eax, dword [esi]
xor edi, edi
push edi
push edi
push dword [ebp + 0x4c4]
push dword [ebp + 0x4c0]
push dword [eax + ebx + 0x50]
call fcn.00439ea7
push edi
push dword [0x472420]
push dword [0x4775e4]
push dword [ebp + 0x4c4]
push dword [ebp + 0x4c0]
call fcn.0041f203
or eax, 0x4000
push eax
call fcn.0044498e
mov dword [ebp - 0x68], eax
cmp eax, edi
je 0x4252c0
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4252c0
cmp dword [0x472468], edi
jne 0x424eea
mov eax, dword [ebp - 0x68]
mov dword [0x472468], eax
jmp 0x424eea
mov eax, dword [ebp + 0x4c0]
mov dword [section..data], eax
mov eax, dword [ebp + 0x4c4]
mov dword [0x470004], eax
mov eax, dword [esi]
and dword [eax + ebx + 0xf28], 0
xor eax, eax
mov edi, 0x472824
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, 0x473b18
stosd dword es:[edi], eax
mov byte [ecx], 0
add ecx, 0x20
cmp ecx, 0x473bb8
jl 0x4252f1
mov eax, dword [esi]
add eax, ebx
push str.Idle
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425377
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0xff
push edi
lea eax, [ebp + 0xa9]
push 0
push eax
mov byte [ebp + 0xa8], 0
call fcn.004464f0
push 0x100
lea eax, [ebp + 0xa8]
push 0
push eax
call fcn.004464f0
add esp, 0x18
lea eax, [ebp + 0xa8]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
and dword [ebp - 0x64], 0
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], edi
jl 0x425361
jmp 0x4255f8
mov eax, dword [esi]
add eax, ebx
push str.Type
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42547c
push 0x100
push 0
push 0x476260
call fcn.004464f0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0xc
push 0x90
call edi
test al, 1
je 0x4253bc
mov byte [0x4762f0], 1
push 0x14
call edi
test al, 1
je 0x4253cb
mov byte [0x476274], 1
push 0x91
call edi
test al, 1
je 0x4253dd
mov byte [0x4762f1], 1
mov eax, dword [esi]
push 0
push 0
push dword [ebp + 0x4c4]
push dword [ebp + 0x4c0]
push dword [eax + ebx + 0x50]
call fcn.00439ea7
push dword [0x4775e4]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
mov ecx, eax
push 0x1f
inc ecx
pop eax
cmp ecx, eax
jg 0x425419
push dword [0x4775e4]
call edi
inc eax
push eax
push dword [0x4775e4]
push 0x473b18
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
and dword [ebp - 0x64], 0
push 0x473b18
call edi
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx + 0x473b18]
mov dl, byte [ecx]
dec eax
mov byte [ebp - 0x5e], dl
test dl, dl
je 0x425464
cmp dword [ebp - 0x64], eax
jge 0x425464
mov dl, byte [eax + 0x473b18]
inc dword [ebp - 0x64]
mov byte [ecx], dl
mov cl, byte [ebp - 0x5e]
mov byte [eax + 0x473b18], cl
jmp 0x425436
push 0x473b18
call edi
mov byte [0x473b38], al
mov byte [0x4764c8], 0
jmp 0x4255f8
mov eax, dword [esi]
add eax, ebx
push str.Date_Time
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4255dc
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4255dc
mov eax, dword [ebp + 0x4c0]
imul eax, eax, 0x104
push 0xc
lea ecx, [ebp + 0x2ac]
lea eax, [eax + 0x472858]
push ecx
push eax
mov dword [ebp - 0x64], eax
call fcn.0040dac4
lea eax, [ebp + 0x2ac]
push eax
lea eax, [ebp + 0x1a8]
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x103
lea eax, [ebp + 0x2ac]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x45aca0
push edi
push 0
lea eax, [ebp + 0x2ac]
push eax
call fcn.0043feaa
push edi
lea eax, [ebp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x2ac]
push str.vTask.exe
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x425557
push str..VXM
push dword [ebp - 0x64]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425587
push str.__r__
lea eax, [ebp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x64]
lea eax, [ebp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea eax, [ebp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__s
lea eax, [ebp + 0x2ac]
push eax
call edi
mov eax, dword [ebp + 0x4c4]
inc eax
push eax
lea eax, [ebp - 0x5c]
push 0x45aac0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x2ac]
push eax
call edi
lea eax, [ebp + 0x1a8]
push eax
lea eax, [ebp + 0x2ac]
push 0
push eax
call fcn.00444117
add esp, 0xc
jmp 0x4255f8
mov eax, dword [esi]
add eax, ebx
push str.File
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4255f8
or dword [0x472824], 0xffffffff
cmp dword [ebp - 0x6c], 0
mov edi, dword [sym.imp.USER32.dll_SetTimer]
jle 0x425616
push 0
push dword [ebp - 0x6c]
push 0x806e
push dword [0x472420]
call edi
mov eax, dword [esi]
push 0
add eax, ebx
push str.Type
push eax
call fcn.004010ff
neg eax
pop ecx
sbb eax, eax
pop ecx
and eax, 0xfffffd12
add eax, 0x3e8
push eax
push 0x806c
push dword [0x472420]
call edi
push dword [0x472420]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
push dword [0x472420]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x4725c0]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [esi]
add eax, ebx
push str.Date_Time
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4256e4
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4256e4
push 0xc
lea eax, [ebp + 0x2ac]
push eax
mov eax, dword [ebp + 0x4c0]
imul eax, eax, 0x104
add eax, 0x472858
push eax
call fcn.0040dac4
lea eax, [ebp + 0x2ac]
push eax
lea eax, [ebp + 0x1a8]
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x1a8]
push eax
xor eax, eax
push eax
push eax
push eax
push 4
call fcn.0044129f
add esp, 0x20
mov eax, dword [0x472684]
jmp 0x4259b1
mov eax, dword [esi]
push 0
push 0
push dword [ebp + 0x4c4]
push dword [ebp + 0x4c0]
push dword [eax + ebx + 0x50]
call fcn.00439ea7
mov eax, dword [0x4775e4]
cmp byte [eax], 0
je 0x425746
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
call fcn.00437877
mov ecx, dword [esi]
cmp dword [ecx + ebx + 0xf28], 1
mov byte [ebp - 0x5e], al
jg 0x42574a
movzx eax, al
push eax
push dword [0x4775e4]
push str.____Waiting_for_keypress__s___d_
call fcn.0042036e
add esp, 0xc
jmp 0x42574a
mov byte [ebp - 0x5e], 0
push 0x15e
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xff
lea eax, [ebp + 0xa9]
push 0
push eax
mov byte [ebp + 0xa8], 0
call fcn.004464f0
push 0x100
lea eax, [ebp + 0xa8]
push 0
push eax
call fcn.004464f0
add esp, 0x18
lea eax, [ebp + 0xa8]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
and dword [ebp - 0x64], 0
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], 0xff
jl 0x425796
mov eax, dword [esi]
add eax, ebx
push str.Keypress
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4257c9
mov byte [ebp - 0x5d], 1
jmp 0x4258bd
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425804
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Move
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425804
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov byte [ebp - 0x5d], 2
jmp 0x4258bd
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425835
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Left
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425835
mov byte [ebp - 0x5d], 4
jmp 0x4258bd
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425863
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Right
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425863
mov byte [ebp - 0x5d], 8
jmp 0x4258bd
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425891
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Middle
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x425891
mov byte [ebp - 0x5d], 0x10
jmp 0x4258bd
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4258bd
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push 0x45aaa4
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4258bd
mov byte [ebp - 0x5d], 0x20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x6c]
jae 0x4259af
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
inc edi
cmp byte [ebp - 0x5d], 0
je 0x4259af
movzx eax, byte [0x47000c]
push eax
call esi
test ax, ax
jne 0x425216
cmp dword [0x472698], 0
jne 0x425216
push 0
call ebx
push 0xfa
call ebx
movzx eax, byte [ebp - 0x5d]
dec eax
je 0x425966
dec eax
je 0x42594c
dec eax
dec eax
je 0x425949
sub eax, 4
je 0x425945
sub eax, 8
je 0x425941
sub eax, 0x10
jne 0x42599d
push edi
call esi
test ax, ax
jne 0x425978
push 2
call esi
test ax, ax
jne 0x425978
push 4
jmp 0x425971
push 2
jmp 0x425971
push edi
jmp 0x425971
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x7c]
jne 0x425978
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x78]
jmp 0x425976
cmp byte [ebp - 0x5e], 0
je 0x42597c
movzx eax, byte [ebp - 0x5e]
push eax
call esi
test ax, ax
je 0x42599d
mov eax, edi
jmp 0x4259b1
xor edi, edi
lea eax, [edi - 8]
cmp eax, 0x97
ja 0x425994
push edi
call esi
test ax, ax
jne 0x424eea
inc edi
cmp edi, 0xff
jl 0x42597e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x6c]
jb 0x4258db
xor eax, eax
mov ecx, dword [ebp + 0x4b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464bf
add ebp, 0x4b8
leave
ret 8