Function at 0x456960
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 0xff
push 0xff
push 0xff
push 0xff
lea ecx, [ebp - 8]
call fcn.00457f50
push 0x70
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
je 0x45699f
xor ecx, ecx
je 0x45699f
mov dword [ebp - 0x20], 1
jmp 0x4569a6
mov dword [ebp - 0x20], 0
mov dl, byte [ebp - 0x20]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x4569c4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x21ac8], 1
jne 0x456ab2
mov dword [ebp - 0xc], 0
jmp 0x4569d6
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 2
jge 0x456aad
push 0
push 0
push 0x64
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.00457f50
push eax
mov eax, dword [ebp - 0xc]
shl eax, 4
fld dword [eax + 0x6e2120]
fadd qword [0x6c9790]
fstp dword [ebp - 0x24]
fld dword [ebp - 0x24]
push ecx
fstp dword [esp]
mov ecx, dword [ebp - 0xc]
shl ecx, 4
fld dword [ecx + 0x6e211c]
fadd qword [0x6c9790]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
push ecx
fstp dword [esp]
mov edx, dword [ebp - 0xc]
shl edx, 4
fld dword [edx + 0x6e2118]
fsub qword [0x6c9798]
fstp dword [ebp - 0x2c]
fld dword [ebp - 0x2c]
push ecx
fstp dword [esp]
mov eax, dword [ebp - 0xc]
shl eax, 4
fld dword [eax + 0x6e2114]
fsub qword [0x6c9798]
fstp dword [ebp - 0x30]
fld dword [ebp - 0x30]
push ecx
fstp dword [esp]
call fcn.005cc2d0
add esp, 0x1c
push 0x20
push 0
push 0
mov ecx, dword [ebp - 0xc]
shl ecx, 9
add ecx, 0x837470
push ecx
mov edx, dword [ebp - 0xc]
shl edx, 4
push ecx
fld dword [edx + 0x6e2118]
fstp dword [esp]
mov eax, dword [ebp - 0xc]
shl eax, 4
push ecx
fld dword [eax + 0x6e2114]
fstp dword [esp]
call fcn.00455e30
add esp, 0x18
jmp 0x4569cd
jmp 0x456cba
movsx ecx, byte [0x837470]
test ecx, ecx
je 0x456b3c
mov edx, dword [0x8357bc]
push edx
mov eax, dword [0x8357b8]
push eax
push 0x6e2104
call fcn.00455a00
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x456b3c
lea edx, [ebp - 8]
push edx
push ecx
fld dword [0x6e2110]
fstp dword [esp]
push ecx
fld dword [0x6e210c]
fstp dword [esp]
push ecx
fld dword [0x6e2108]
fstp dword [esp]
push ecx
fld dword [0x6e2104]
fstp dword [esp]
mov ecx, dword [0x835798]
call fcn.00459d40
cmp dword [0x8357c0], 0
je 0x456b3c
push 0x837470
mov eax, dword [ebp + 8]
add eax, 0x21acc
push eax
call fcn.005e5680
add esp, 8
mov ecx, dword [ebp + 8]
call fcn.0045d530
push 0xff
push 0x4a
push 0x4a
push 0x8a
lea ecx, [ebp - 0x10]
call fcn.00457f50
push str.You_can_paste__Control_V__your_serial
lea ecx, [ebp - 0x10]
push ecx
push ecx
fld dword [0x61b624]
fstp dword [esp]
push ecx
fld dword [0x61b620]
fstp dword [esp]
mov edx, dword [0x8357b4]
push edx
call fcn.005cc1c0
add esp, 0x14
mov eax, dword [0x8357bc]
push eax
mov ecx, dword [0x8357b8]
push ecx
push 0x6e20f4
call fcn.00455a00
add esp, 0xc
movzx edx, al
test edx, edx
je 0x456bfa
lea eax, [ebp - 8]
push eax
push ecx
fld dword [0x6e2100]
fstp dword [esp]
push ecx
fld dword [0x6e20fc]
fstp dword [esp]
push ecx
fld dword [0x6e20f8]
fstp dword [esp]
push ecx
fld dword [0x6e20f4]
fstp dword [esp]
mov ecx, dword [0x83579c]
call fcn.00459d40
cmp dword [0x8357c0], 0
je 0x456bfa
push 5
push 0
push 0x61b04b
push str.http:__192.168.100.6_
push 0x61b318
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x14], 0
jmp 0x456c0c
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 1
jge 0x456cad
cmp dword [0x8357c0], 0
je 0x456c55
mov edx, dword [0x8357bc]
push edx
mov eax, dword [0x8357b8]
push eax
mov ecx, dword [ebp - 0x14]
shl ecx, 4
add ecx, 0x6e2114
push ecx
call fcn.00455a00
add esp, 0xc
movzx edx, al
test edx, edx
je 0x456c55
mov eax, dword [ebp - 0x14]
mov dword [0x837468], eax
call fcn.00461de0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx*4 + 0x6e20f0]
push edx
push 0
mov eax, dword [0x837468]
cmp eax, dword [ebp - 0x14]
sete cl
movzx edx, cl
push edx
mov eax, dword [ebp - 0x14]
shl eax, 9
add eax, 0x837470
push eax
mov ecx, dword [ebp - 0x14]
shl ecx, 4
push ecx
fld dword [ecx + 0x6e2118]
fstp dword [esp]
mov edx, dword [ebp - 0x14]
shl edx, 4
push ecx
fld dword [edx + 0x6e2114]
fstp dword [esp]
call fcn.00455e30
add esp, 0x18
mov dword [ebp - 0x18], eax
jmp 0x456c03
push 0x837670
call fcn.00607202
add esp, 4
mov esp, ebp
pop ebp
ret