Function at 0x401190
Capabilities:
Impersonate user
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [str._93]
xor ecx, ecx
cmp eax, 0x3a
push ebx
setg cl
shl eax, cl
push esi
mov esi, 0x34
push edi
mov edi, dword [0x431a08]
mov dword [str._93], eax
mov eax, dword [0x431a18]
and eax, esi
or edi, eax
mov dword [0x431a08], edi
push fcn.00404d40
push dword fs:[0]
mov dword fs:[0], esp
push 0x61
push 0
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
call sub.LZ32.dll_LZStart
lea ecx, [ebp - 4]
lea edx, [ebp - 0xc]
push ecx
push edx
push 0
push 0
mov dword [ebp - 4], esi
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
call sub.LZ32.dll_LZStart
lea eax, [ebp - 4]
mov edi, 0x2f
push eax
push 0x35
push 4
push str.zsbeskpnclqys
push str.xGFc0n6AdX
push str.WZqnB05KTo085hsr
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
push 0
push 5
push 0
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
push 0x3b
push 0x360
push 0x31
push 0
push 0
push 0x37
push 0x27
call sub.USER32.dll_SetWinEventHook
lea ecx, [ebp - 4]
lea edx, [ebp - 8]
push ecx
push edx
push 0x31
push 0
push 0x21
push 0x906
push 0x32
mov dword [ebp - 8], esi
mov dword [ebp - 4], 0x2b
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push 2
push 0xffffffffffffffdf
push 1
push 2
call fcn.00401bd0
push 0
push 0
call sub.ADVAPI32.dll_LsaDeleteTrustedDomain
push 0xffffffffffffffca
push 0xffffffffffffffcf
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
push 5
push esi
push 0x2b
call sub.LZ32.dll_LZSeek
push 0
push 0x2c
push 0
call sub.ADVAPI32.dll_LsaSetInformationPolicy
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
push 0x5cb
push str.M3v383B57593TT
call dword [sym.imp.ADVAPI32.dll_DecryptFileA]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0x3a
call sub.USER32.dll_DdeFreeDataHandle
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
push ecx
push edx
push 0
push 0x3a
push 0
call sub.ADVAPI32.dll_LsaLookupSids
push 0
push 0x3f
push 0
push 0
call sub.ADVAPI32.dll_LsaQueryTrustedDomainInfo
push 0x39
push 0x25
push 0x2d
call sub.USER32.dll_DdeAbandonTransaction
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0x35e
push 0x3c5
lea eax, [ebp - 0x44]
push 0x3d
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push 0x31
push 0x32
push 0x40
call sub.USER32.dll_DdePostAdvise
push 0x29
call dword [sym.imp.USER32.dll_SetDoubleClickTime]
push 0x37
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
lea edx, [ebp - 0x10]
mov dword [ebp - 0xe], ecx
push edx
mov dword [ebp - 0xa], ecx
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0
mov byte [ebp - 6], cl
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov esi, dword [sym.imp.USER32.dll_OemKeyScan]
push 0x29
call esi
call dword [sym.imp.USER32.dll_GetClipboardOwner]
push 0x2a
push 0x6c
push 0x2e
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
lea eax, [ebp - 0x58]
push eax
push 0x69
push 0
call dword [sym.imp.USER32.dll_GetClassInfoExA]
push 0x3c
push 0x36
push 0x28
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
call fcn.00406e30
lea ecx, [ebp - 8]
mov dword [ebp - 8], edi
push ecx
push str.lv11g8373pj5G0
push 0x31
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x3e
push 0
push 0x3c
lea edx, [ebp - 0x3c]
push edx
push 0
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
lea eax, [ebp - 8]
lea ecx, [ebp - 0x3c]
push eax
push 1
push 1
push ecx
push 0x37
push 0xf74
lea edx, [ebp - 0x28]
push 0xeaf
push edx
push str.febsmihriokxslmrkm
push str.J1719011082
push 0
push str.aQzUgw5C8Q2d04Y3V97
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_ObjectOpenAuditAlarmA]
xor eax, eax
lea ecx, [ebp - 8]
mov dword [ebp - 0x22], eax
push 0x2b
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1e], eax
push ecx
push edx
mov word [ebp - 0x1a], ax
push 0x2d
push 0x26
mov byte [ebp - 0x24], 0x36
mov byte [ebp - 0x23], 0
mov byte [ebp - 0x18], al
mov dword [ebp - 8], edi
call dword [sym.imp.USER32.dll_ToAscii]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_EqualRect]
push 0xd38
push 0
push 0x26
push 0x72
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
push 0xffffffffffffffc6
push 1
push 1
push 0
push 1
call fcn.00404c40
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.USER32.dll_SubtractRect]
push 0xffffffffffffffd6
push 0
push 0x35
push 0
push 1
push 0
call fcn.00401d40
push 0x31
call esi
lea edx, [ebp - 8]
lea eax, [ebp - 4]
push edx
push 0x21
push 0
push eax
push 0
mov dword [ebp - 4], edi
mov dword [ebp - 8], 0x30
call sub.ADVAPI32.dll_LsaEnumerateTrustedDomains
mov ecx, dword [0x431a28]
xor edi, edi
xor edx, edx
xor eax, eax
test ecx, ecx
je 0x40167f
xor ecx, ecx
cmp edi, edx
setne cl
sar edi, cl
mov ecx, edi
and ecx, edx
shl edi, cl
cmp edx, 0x3e
jle 0x4014ba
mov ecx, 0xffffffc4
sub ecx, edx
add eax, ecx
xor ecx, ecx
cmp edx, 0x36
setl cl
xor eax, ecx
mov ecx, edi
sar ecx, 0x2c
or edx, ecx
lea ecx, [edx + 0x3f]
shl edx, cl
lea ecx, [eax + 0x30]
shl edx, cl
xor ecx, ecx
cmp eax, 0x27
setge cl
sub edi, ecx
xor ecx, ecx
cmp eax, 0xffffffcc
setne cl
shl edi, cl
mov ecx, edx
sar ecx, 0xc4
add edi, ecx
mov ecx, edi
xor ecx, 0x2a
je 0x4014fa
xor edi, 1
lea ebx, [edx + eax*2]
mov ecx, ebx
and ecx, edx
sar edx, cl
cmp edi, 0x3e
je 0x401510
mov eax, ebx
mov ecx, ebx
sar eax, cl
and ebx, eax
mov eax, dword [0x431a28]
lea ecx, [edi + edx]
dec eax
sub ebx, ecx
mov dword [0x431a28], eax
mov eax, edx
imul eax, edx
test eax, eax
je 0x401532
xor ecx, ecx
cmp ebx, edi
setg cl
shl ebx, cl
lea eax, [edi*8]
sub eax, edi
neg eax
lea ecx, [eax + eax*2]
shl ecx, 1
xor edi, ecx
xor ecx, ecx
cmp ebx, 0x29
setne cl
sar edx, cl
xor eax, eax
cmp ebx, 0x23
setl al
sub edx, eax
mov esi, edx
cmp esi, 0x2d
jle 0x401566
mov ecx, ebx
sar ecx, 0x3b
shl ebx, cl
mov edx, ebx
mov ecx, ebx
sar edx, cl
mov ecx, edx
shl esi, cl
lea eax, [esi*8]
sub eax, esi
neg eax
lea eax, [eax + eax*2]
shl eax, 1
je 0x401584
or edi, ebx
mov eax, ebx
mov edx, esi
mov ecx, edi
imul eax, esi
shl edx, cl
xor ecx, ecx
sub edi, edx
mov edx, esi
and edi, 1
add edi, eax
cmp edi, ebx
setl cl
or edx, 0x26
push ecx
push edx
call fcn.00406f10
push 0x2e
push 0x360
xor eax, eax
push 0x25
cmp ebx, esi
push 0
push 0
push 0x2e
setne al
push 0x39
add edi, eax
call sub.USER32.dll_SetWinEventHook
cmp esi, 0xffffffd2
jle 0x4015d4
mov ecx, ebx
neg ecx
lea edi, [edi + ecx*2]
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, edi
imul ecx, esi
shl esi, cl
call sub.LZ32.dll_LZDone
xor edx, edx
cmp esi, ebx
setge dl
sub esi, edx
lea eax, [edi + esi]
push eax
call fcn.00401a90
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, 0xffffffda
mov eax, edi
sub ecx, ebx
or eax, ebx
shl esi, cl
or esi, 0x3d
mov ecx, esi
xor ecx, 0x2a
and eax, ecx
cmp eax, 0xffffffc3
jge 0x401623
mov edx, eax
imul edx, esi
sub edi, edx
lea ecx, [eax + 0x2b]
xor edx, edx
and esi, ecx
cmp esi, edi
setne dl
or eax, edx
xor ecx, ecx
cmp edi, eax
setl cl
or edi, ecx
xor edx, edx
cmp edi, 0xffffffdc
setl dl
xor esi, edx
xor ecx, ecx
cmp esi, 0x31
setg cl
inc edi
xor edx, edx
and edi, ecx
cmp eax, 0xffffffce
setl dl
or edx, eax
xor ecx, ecx
cmp eax, 0xffffffdc
setne cl
or eax, ecx
lea ecx, [eax + eax]
test ecx, ecx
je 0x401671
mov ecx, edi
sar ecx, 0x24
and edi, ecx
mov ecx, dword [0x431a28]
test ecx, ecx
jne 0x40149d
xor ecx, ecx
cmp eax, 0xffffffdc
sete cl
xor eax, ecx
mov ecx, eax
xor ecx, edx
and edi, ecx
cmp edx, 0x3a
jg 0x40169b
mov ecx, edx
xor ecx, 0x35
add eax, ecx
mov ecx, edi
and ecx, edx
add edi, ecx
mov ecx, edx
sar ecx, 0x20
sub eax, ecx
xor ecx, ecx
cmp edi, 0x24
setl cl
sub edx, ecx
xor ecx, ecx
cmp eax, 0x2a
mov esi, edx
setg cl
sar eax, cl
and edi, 0x28
or eax, edi
mov ecx, eax
shl esi, cl
mov ecx, edx
or eax, esi
or ecx, 0xffffffcb
je 0x4016da
mov ecx, 1
sub ecx, edx
imul eax, ecx
xor ecx, ecx
cmp eax, 0x31
setge cl
shl edx, cl
mov ecx, eax
and ecx, 0x2c
add edx, 0x21
imul ecx, edx
sar eax, cl
mov ecx, edx
mov esi, edx
shl edx, cl
lea ecx, [eax + edx]
test ecx, ecx
je 0x401701
and edx, 1
sar eax, 1
xor ecx, ecx
cmp eax, esi
setne cl
sub edx, ecx
xor ecx, ecx
mov edi, edx
sub edi, eax
or edi, esi
cmp edx, eax
setl cl
sub edi, ecx
lea esi, [edx + edx]
mov ebx, edi
or ebx, eax
mov eax, edi
imul eax, edx
or ebx, 0x32
sub ebx, eax
mov ecx, ebx
sub esi, ebx
shl ecx, 5
add ecx, ebx
je 0x40173c
lea edx, [esi + 0x3e]
xor esi, edx
xor ecx, ecx
cmp ebx, 0x2d
setle cl
sar ebx, cl
mov eax, edi
xor ecx, ecx
sub eax, esi
and ebx, eax
cmp esi, 0x22
setl cl
and esi, ecx
xor edx, edx
xor ebx, esi
xor ebx, 0x23
lea eax, [esi + 0x32]
lea ebx, [ebx + edi - 0x22]
cmp edi, ebx
setl dl
sub edi, edx
test eax, eax
je 0x401774
lea ecx, [edi + edi]
shl edi, cl
mov eax, 0x531d7
xor ecx, ecx
cmp ebx, 0xffffffc8
setge cl
sub esi, ecx
test edi, edi
je 0x40178f
mov edx, esi
mov ecx, edi
shl edx, cl
xor esi, edx
lea ecx, [edi - 0x35]
test ecx, ecx
je 0x4017a0
xor ecx, ecx
cmp esi, 0xffffffd1
setg cl
and esi, ecx
xor edx, edx
cmp edi, esi
setne dl
add ebx, edx
lea ecx, [ebx - 0x31]
xor esi, ecx
dec eax
jne 0x401779
mov eax, esi
mov ecx, ebx
shl eax, cl
mov edx, ebx
mov ecx, esi
xor edx, esi
and edi, edx
xor ebx, eax
mov eax, esi
mov edx, ebx
imul eax, esi
shl edx, cl
mov ecx, edx
mov edx, 0x32
sar edi, cl
mov ecx, esi
sar edx, cl
or edi, eax
test edx, edx
je 0x4017df
and esi, ebx
cmp edi, 0x21
jge 0x4017ed
xor ecx, ecx
cmp esi, ebx
sete cl
shl ebx, cl
mov eax, esi
xor ecx, ecx
xor eax, 0x34
sub edi, eax
cmp ebx, esi
setne cl
sub ebx, ecx
xor esi, 9
or ebx, 1
cmp edi, 0x34
jge 0x40180f
mov ecx, edi
imul ecx, edi
sar edi, cl
mov edx, 0x24
sub edx, edi
je 0x40181d
lea eax, [edi - 0x2f]
or esi, eax
call fcn.00404d40
xor ecx, ecx
cmp ebx, 0xffffffc6
sete cl
shl edi, cl
or esi, 0x30
shl edi, 6
sub esi, edi
pop edi
mov dword [ebp - 8], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret