Function at 0x497c60
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edi, dword [esp + 0x64]
mov dword [esp + 0x10], eax
push edi
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov esi, eax
lea ebp, [esi - 2]
push ebp
push edi
call fcn.00486bc0
add esp, 8
add esi, 0xfffffffe
push 0x400
push esi
push edi
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0
push 0x499602d2
push 0xc00
push ebp
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
lea eax, [esp + 0x5c]
push 0x11170
push eax
call fcn.004bd990
mov ecx, dword [0x547570]
mov edx, 0x54daa4
add esp, 8
mov dword [esp + 0x1c], ecx
test edx, edx
je 0x497d1a
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call ebx
mov esi, eax
test esi, esi
je 0x497d20
push esi
lea ecx, [esp + 0x20]
call fcn.00405530
test eax, eax
je 0x497d20
mov eax, dword [esp + 0x1c]
inc esi
push esi
push 0x54daa4
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x1c]
push 0xffffffffffffffff
call fcn.00405bb0
jmp 0x497d20
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x547570]
mov edx, 0x54b2b8
test edx, edx
mov dword [esp + 0x18], ecx
je 0x497d69
push edx
call ebx
mov esi, eax
test esi, esi
je 0x497d69
push esi
lea ecx, [esp + 0x1c]
call fcn.00405530
test eax, eax
je 0x497d69
mov eax, dword [esp + 0x18]
inc esi
push esi
push 0x54b2b8
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x18]
push 0xffffffffffffffff
call fcn.00405bb0
mov ecx, dword [0x547570]
mov edx, 0x5491e4
test edx, edx
mov dword [esp + 0x64], ecx
je 0x497db2
push edx
call ebx
mov esi, eax
test esi, esi
je 0x497db2
push esi
lea ecx, [esp + 0x68]
call fcn.00405530
test eax, eax
je 0x497db2
mov eax, dword [esp + 0x64]
inc esi
push esi
push 0x5491e4
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x64]
push 0xffffffffffffffff
call fcn.00405bb0
lea ecx, [esp + 0x48]
push 0xca
push ecx
call fcn.004bd990
mov edx, dword [0x547570]
mov ecx, dword [esp + 0x6c]
mov eax, dword [eax]
add esp, 8
mov dword [esp + 0x24], edx
mov edx, dword [eax - 8]
push ecx
mov ecx, dword [ecx - 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x34]
call fcn.004059f0
lea eax, [esp + 0x24]
lea ecx, [esp + 0x44]
push eax
call fcn.00405440
lea ecx, [esp + 0x24]
call fcn.00405700
lea ecx, [esp + 0x4c]
push 0x14439
push ecx
call fcn.004bd990
mov edx, dword [0x547570]
mov eax, dword [eax]
add esp, 8
mov dword [esp + 0x28], edx
push eax
mov eax, dword [eax - 8]
push eax
mov eax, dword [esp + 0x4c]
push eax
mov ecx, dword [eax - 8]
push ecx
lea ecx, [esp + 0x38]
call fcn.004059f0
lea edx, [esp + 0x28]
lea ecx, [esp + 0x40]
push edx
call fcn.00405440
lea ecx, [esp + 0x28]
call fcn.00405700
mov eax, dword [0x547570]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax - 8]
mov eax, dword [esp + 0x44]
push ecx
push eax
mov edx, dword [eax - 8]
lea ecx, [esp + 0x38]
push edx
call fcn.004059f0
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push eax
call fcn.00405440
lea ecx, [esp + 0x2c]
call fcn.00405700
lea ecx, [esp + 0x50]
push 0x1443d
push ecx
call fcn.004bd990
mov edx, dword [0x547570]
mov eax, dword [eax]
add esp, 8
mov dword [esp + 0x30], edx
push eax
mov eax, dword [eax - 8]
push eax
mov eax, dword [esp + 0x44]
push eax
mov ecx, dword [eax - 8]
push ecx
lea ecx, [esp + 0x40]
call fcn.004059f0
lea edx, [esp + 0x30]
lea ecx, [esp + 0x38]
push edx
call fcn.00405440
lea ecx, [esp + 0x30]
call fcn.00405700
mov eax, dword [0x547570]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax - 8]
mov eax, dword [esp + 0x3c]
push ecx
push eax
mov edx, dword [eax - 8]
lea ecx, [esp + 0x40]
push edx
call fcn.004059f0
lea eax, [esp + 0x34]
lea ecx, [esp + 0x58]
push eax
call fcn.00405440
lea ecx, [esp + 0x34]
call fcn.00405700
mov eax, dword [esp + 0x38]
mov edx, dword [0x547574]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497f3d
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497f3d
mov edx, dword [esp + 0x38]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x3c]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497f68
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497f68
mov edx, dword [esp + 0x3c]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x40]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497f93
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497f93
mov edx, dword [esp + 0x40]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x44]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497fbe
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497fbe
mov edx, dword [esp + 0x44]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x48]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497fe9
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497fe9
mov edx, dword [esp + 0x48]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x4c]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x498014
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x498014
mov edx, dword [esp + 0x4c]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x50]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49803f
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x49803f
mov edx, dword [esp + 0x50]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x64]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49806a
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x49806a
mov edx, dword [esp + 0x64]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x498095
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x498095
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x1c]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4980c0
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4980c0
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [0x547570]
mov ecx, 0x54daa0
test ecx, ecx
mov dword [esp + 0x64], eax
je 0x49810c
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x49810c
push esi
lea ecx, [esp + 0x68]
call fcn.00405530
test eax, eax
je 0x49810c
mov edx, dword [esp + 0x64]
inc esi
push esi
push 0x54daa0
push edx
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x64]
push 0xffffffffffffffff
call fcn.00405bb0
lea eax, [esp + 0x50]
push 0xca
push eax
call fcn.004bd990
mov ecx, dword [0x547570]
mov eax, dword [eax]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x6c]
add esp, 8
mov edx, dword [ecx - 8]
push ecx
push edx
push eax
mov eax, dword [eax - 8]
push eax
lea ecx, [esp + 0x54]
call fcn.004059f0
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x58]
call fcn.00405440
lea ecx, [esp + 0x44]
call fcn.00405700
mov eax, dword [esp + 0x50]
mov ecx, dword [0x547574]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x498183
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x498183
mov eax, dword [esp + 0x50]
add eax, 0xfffffff4
push eax
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x64]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4981ae
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4981ae
mov edx, dword [esp + 0x64]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [0x547570]
push 0x49960278
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
push 0x1b207
lea eax, [esp + 0x1c]
push 0x54da94
push eax
call fcn.00405cb0
mov ecx, dword [0x547570]
mov edx, 0x5491e4
add esp, 0x10
mov dword [esp + 0x64], ecx
test edx, edx
je 0x498224
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x498224
push esi
lea ecx, [esp + 0x68]
call fcn.00405530
test eax, eax
je 0x498224
mov eax, dword [esp + 0x64]
inc esi
push esi
push 0x5491e4
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x64]
push 0xffffffffffffffff
call fcn.00405bb0
mov ecx, dword [0x547570]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x44], ecx
push eax
mov edx, dword [eax - 8]
mov eax, dword [esp + 0x18]
push edx
push eax
mov eax, dword [eax - 8]
lea ecx, [esp + 0x50]
push eax
call fcn.004059f0
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x44]
call fcn.00405440
lea ecx, [esp + 0x44]
call fcn.00405700
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
mov edx, dword [eax - 8]
push edx
call fcn.00405a90
mov eax, dword [esp + 0x40]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49829d
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x49829d
mov edx, dword [esp + 0x40]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x64]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4982c8
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4982c8
mov edx, dword [esp + 0x64]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
push 0x49960278
push 0x1b209
lea eax, [esp + 0x1c]
push 0x54da94
push eax
call fcn.00405cb0
mov ecx, dword [0x547570]
mov edx, 0x5491e4
add esp, 0x10
mov dword [esp + 0x64], ecx
test edx, edx
je 0x498331
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x498331
push esi
lea ecx, [esp + 0x68]
call fcn.00405530
test eax, eax
je 0x498331
mov eax, dword [esp + 0x64]
inc esi
push esi
push 0x5491e4
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x64]
push 0xffffffffffffffff
call fcn.00405bb0
mov ecx, dword [0x547570]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x44], ecx
push eax
mov edx, dword [eax - 8]
mov eax, dword [esp + 0x18]
push edx
push eax
mov eax, dword [eax - 8]
lea ecx, [esp + 0x50]
push eax
call fcn.004059f0
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x44]
call fcn.00405440
lea ecx, [esp + 0x44]
call fcn.00405700
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
mov edx, dword [eax - 8]
push edx
call fcn.00405a90
mov eax, dword [esp + 0x40]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4983aa
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4983aa
mov edx, dword [esp + 0x40]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x64]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4983d5
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4983d5
mov edx, dword [esp + 0x64]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
push 0x49960278
push 0x1b20d
lea eax, [esp + 0x1c]
push 0x54da94
push eax
call fcn.00405cb0
add esp, 0x10
lea ecx, [esp + 0x64]
push 0x5491e4
call fcn.00405730
lea ecx, [esp + 0x64]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x54]
push edx
push eax
call fcn.00412c10
push eax
lea ecx, [esp + 0x24]
call fcn.00413070
lea ecx, [esp + 0x50]
call fcn.00405700
lea ecx, [esp + 0x64]
call fcn.00405700
push 0x1b208
lea ecx, [esp + 0x18]
push 0x548b44
push ecx
call fcn.00405cb0
add esp, 0xc
lea ecx, [esp + 0x64]
push 0x5491e4
call fcn.00405730
lea edx, [esp + 0x64]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x54]
push eax
push ecx
call fcn.00412c10
push eax
lea ecx, [esp + 0x24]
call fcn.00413070
lea ecx, [esp + 0x50]
call fcn.00405700
lea ecx, [esp + 0x64]
call fcn.00405700
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
push edx
lea esi, [ebp + 1]
push eax
push 0x410
push esi
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
push esi
push 0x49960278
push edi
call fcn.00486b20
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
add esp, 0xc
push ecx
push 0x1b207
push 0
push edx
call esi
lea eax, [esp + 0x64]
push 0x7e5
push eax
call fcn.004bd990
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
add esp, 8
push eax
push 0x1b209
push 0
push ecx
call esi
lea ecx, [esp + 0x64]
call fcn.00405700
lea edx, [esp + 0x64]
push 0x3ea
push edx
call fcn.004bd990
mov eax, dword [eax]
add esp, 8
push eax
mov eax, dword [esp + 0x14]
push 0x1b20d
push 0
push eax
call esi
lea ecx, [esp + 0x64]
call fcn.00405700
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0xc00
push ecx
call esi
lea edx, [esp + 0x64]
push 0x11174
push edx
call fcn.004bd990
mov eax, dword [eax]
add esp, 8
push eax
mov eax, dword [esp + 0x14]
push 0x1b218
push 0
push eax
call esi
lea ecx, [esp + 0x64]
call fcn.00405700
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0xc00
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.SHA256
push 0x1b213
push 0
push edx
call esi
mov eax, dword [esp + 0x10]
push str.SHA256__PS_
push 0x1b214
push 0
push eax
call esi
lea ecx, [esp + 0x64]
push 0x4e24
push ecx
call fcn.004bd990
mov eax, dword [eax]
add esp, 8
lea ebx, [ebp + 2]
push eax
push 0x1b208
push 0x400
push ebx
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
lea ecx, [esp + 0x64]
call fcn.00405700
push 0
push 0x499602d3
add ebp, 3
push 0xc00
push ebp
mov ebp, dword [sym.imp.USER32.dll_InsertMenuW]
push edi
call ebp
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x498754
mov dword [esp + 0x64], 0
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x54daa0
lea ecx, [esp + 0x54]
mov dword [esp + 0x68], eax
call fcn.00405730
lea edx, [esp + 0x50]
lea eax, [esp + 0x48]
push edx
push 0x11170
push eax
call fcn.004bd990
add esp, 8
lea ecx, [esp + 0x50]
push eax
push ecx
call fcn.00412c10
lea ecx, [esp + 0x48]
call fcn.00405700
lea ecx, [esp + 0x50]
call fcn.00405700
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x64]
push edx
push eax
push 0x410
push ebx
push edi
call ebp
mov ecx, dword [esp + 0x64]
push str.Ceate_Hard_Link_to_this
push 0x1b20a
push 0
push ecx
call esi
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x64]
push edx
push 0x1b20b
push 0
push eax
call esi
mov ecx, dword [esp + 0x64]
push str.Media_test_1
push 0x1b20e
push 0
push ecx
call esi
mov edx, dword [esp + 0x64]
push str.Base64
push 0x10f48d
push 0
push edx
call esi
mov eax, dword [esp + 0x64]
push str.Properity_Test
push 0x10f48e
push 0
push eax
call esi
mov ecx, dword [esp + 0x64]
push str.File2Array
push 0x10f48f
push 0
push ecx
call esi
mov edx, dword [esp + 0x64]
push 0
push 0x499602d3
push 0xc00
push edx
call esi
mov eax, dword [esp + 0x64]
push str.regsvr32.exe
push 0x1b20f
push 0
push eax
call esi
push str.regsvr32.exe__u
push 0x1b210
push 0
mov ecx, dword [esp + 0x70]
push ecx
call esi
mov edx, dword [esp + 0x64]
push 0
push 0x499602d3
push 0xc00
push edx
call esi
mov eax, dword [esp + 0x64]
push str.regsvr32.exe__WOW64_
push 0x1b211
push 0
push eax
call esi
mov ecx, dword [esp + 0x64]
push str.regsvr32.exe__u__WOW64_
push 0x1b212
push 0
push ecx
call esi
mov edx, dword [esp + 0x64]
push str.SHA256
push 0x1b213
push 0
push edx
call esi
lea ecx, [esp + 0x4c]
call fcn.00405700
mov eax, dword [0x55e074]
test eax, eax
jne 0x49877b
push 0x24
call fcn.00532695
add esp, 4
test eax, eax
je 0x498774
mov ecx, eax
call fcn.004864c0
jmp 0x498776
xor eax, eax
mov dword [0x55e074], eax
push 0x499602d3
push 0x499602d2
push edi
mov ecx, eax
call fcn.00486a80
mov eax, dword [0x55e074]
lea ecx, [esp + 0x20]
mov dword [eax + 0x1c], edi
call fcn.00405700
lea ecx, [esp + 0x14]
call fcn.00405700
lea ecx, [esp + 0x54]
call fcn.00405700
lea ecx, [esp + 0x58]
call fcn.00405700
lea ecx, [esp + 0x5c]
call fcn.00405700
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4