Function at 0x401000
Capabilities:
Accept command line arguments
Check for unmoving mouse cursor
Find taskbar
Log keystrokes
Log keystrokes via polling
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call edi
movzx esi, ax
push 0x11
shr esi, 1
call edi
movzx eax, ax
or esi, eax
push 0x1d
shr esi, 1
call edi
movzx eax, ax
or esi, eax
push str.user32.dll
shr esi, 0xd
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x40105e
push str.SetProcessDPIAware
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x401057
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x18]
push ebx
push eax
push ebx
push 0x10
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [ebp - 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4010b2
lea eax, [ebp - 0x48]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [ebp - 0x4c]
push ebx
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x40], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add eax, 0xf
mov cl, byte [eax]
cmp cl, bl
je 0x4011db
inc eax
cmp cl, 0x2f
jne 0x4010cf
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x48], ecx
mov cl, byte [eax]
cmp cl, 0x2f
je 0x4010cf
cmp cl, 0x30
jb 0x401132
cmp cl, 0x39
ja 0x401132
xor esi, esi
lea ecx, [eax - 1]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x10], ecx
mov cl, byte [eax]
cmp cl, 0x30
jb 0x40111c
cmp cl, 0x39
ja 0x40111c
and ecx, 0xf
lea edx, [esi + esi*4]
inc eax
lea esi, [ecx + edx*2]
mov dword [ebp - 0x44], esi
jmp 0x401101
mov ecx, dword [ebp - 0x48]
mov dword [ecx], esi
mov ecx, dword [ebp - 0x10]
cmp byte [ecx], 0x2d
jne 0x401132
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx]
neg edx
mov dword [ecx], edx
mov cl, byte [eax]
cmp cl, 0x2c
jne 0x401141
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x48], ecx
jmp 0x4011a2
cmp cl, 0x2a
je 0x4011a8
mov cx, word [eax]
and cx, 0xf0ff
cmp cx, 0x302d
je 0x4011a2
mov dword [ebp - 0x44], 1
xor esi, esi
cmp esi, 0xb
jg 0x4010cf
mov cl, byte [eax]
movsx edx, byte [esi + str.QRLCPSNXYOETProgman]
and ecx, 0xdf
cmp ecx, edx
je 0x401185
mov ecx, dword [ebp - 0x44]
add ecx, ecx
inc esi
mov dword [ebp - 0x44], ecx
jmp 0x40115e
cmp esi, 8
jg 0x40119c
cmp esi, 3
jne 0x401194
cmp dword [ebp - 0x18], ebx
je 0x4011a2
test word [ebp - 4], 0x1ff
jne 0x4011a2
mov ecx, dword [ebp - 0x44]
xor dword [ebp - 4], ecx
inc eax
jmp 0x4010e5
inc eax
mov dword [0x40317c], eax
mov cl, byte [eax]
cmp cl, bl
je 0x4011bc
cmp cl, 0x2f
je 0x4011bc
inc eax
jmp 0x4011ae
lea esi, [eax - 1]
mov dword [ebp - 0x10], esi
mov cl, byte [esi]
cmp cl, 0x20
je 0x4011ce
cmp cl, 0x22
jne 0x4011d3
mov byte [esi], bl
dec esi
jmp 0x4011c2
mov dword [ebp - 0x10], esi
jmp 0x4010cf
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push 0x40300c
call dword [sym.imp.USER32.dll_FindWindowA]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x401810
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.USER32.dll_keybd_event]
and eax, 0x1ff
mov esi, str.ExitWnd
mov dword [ebp - 0x20], eax
je 0x401238
test word [ebp - 4], 0x810
jne 0x401238
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jmp 0x401396
push 0x67
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_LoadMenuA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
push 0x6a
push eax
mov dword [0x4030e8], 0x30
mov dword [0x4030f0], 0x401820
mov dword [0x4030fc], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [0x403104], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x4030e8
mov dword [0x403108], eax
mov dword [0x403110], esi
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov eax, dword [ebp - 0x24]
push ebx
push dword [ebp - 0x14]
sub eax, dword [ebp - 0x2c]
push ebx
push ebx
push eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x80000000
push ebx
push esi
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x401810
push ebx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call dword [sym.imp.USER32.dll_MonitorFromPoint]
test eax, eax
jne 0x4012e6
mov dword [ebp - 0x38], 0x11
mov dword [ebp - 0x34], 0xa
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [ebp - 0x20], ebx
jne 0x401396
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_GetSubMenu]
cmp dword [ebp - 0x18], ebx
mov dword [0x403168], eax
jne 0x40131a
push 1
push 8
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_mouse_event]
push ebx
push 2
push ebx
push ebx
call edi
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 0x34]
push ebx
push esi
add eax, 0xfffffff6
push ebx
push eax
mov eax, dword [ebp - 0x38]
add eax, 0xffffffef
push eax
push 0x102
push dword [0x403168]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov dword [ebp - 0x44], eax
mov eax, dword [0x40316c]
mov ecx, eax
and eax, 3
and ecx, 0x1000
mov dword [0x403168], ebx
or ecx, dword [ebp - 4]
shl eax, 0xa
xor ecx, eax
cmp dword [ebp - 0x44], ebx
mov dword [ebp - 4], ecx
jne 0x401390
mov eax, 0x400
test eax, ecx
je 0x4015a6
mov dword [ebp - 4], eax
jmp 0x401396
mov eax, dword [ebp - 0x44]
or dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0x9ff
cmp eax, 0x800
jle 0x4015a9
push 1
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_GetSubMenu]
mov esi, 0x9c54
push 0x80
push esi
push eax
push dword [ebp - 8]
mov dword [ebp - 0x44], eax
call dword [sym.imp.USER32.dll_HiliteMenuItem]
push ebx
push esi
push dword [ebp - 0x44]
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
jl 0x4013ef
push 0x11
call esi
test ax, ax
jge 0x4013f9
push 0x3d
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4013dd
push ebx
push 2
push ebx
push ebx
call edi
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 0x38]
push ebx
push dword [ebp - 8]
add eax, 0xffffffef
push ebx
push dword [ebp - 0x34]
push eax
push 2
push dword [ebp - 0x44]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0x1b
call esi
test ax, ax
jl 0x4015a6
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, eax
cmp esi, ebx
je 0x40146f
mov edi, esi
push 4
push esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x401472
push 0xfffffffffffffff8
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
cmp esi, ebx
jne 0x40144c
jmp 0x401472
mov edi, dword [ebp - 0x10]
cmp edi, dword [ebp - 0x1c]
je 0x401590
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
cmp edi, eax
je 0x401590
lea eax, [ebp - 0x44]
push eax
push 0x7f
push 2
push 0x4030e8
push 0x55
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
je 0x401590
mov edi, 0x4030e8
mov esi, 0x403064
add dword [ebp - 0x44], edi
test byte [ebp - 4], 0x10
jne 0x40151a
test byte [ebp - 4], 0x40
jne 0x4014fe
mov eax, dword [ebp - 4]
push ebx
push 0x10
and eax, 0x1ff
push esi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_GetMenuStringA]
mov al, byte [0x403064]
mov ecx, esi
cmp al, bl
je 0x401556
cmp al, 0x28
je 0x4014fa
cmp word [ecx], 0x4081
je 0x4014fa
mov al, byte [ecx + 1]
inc ecx
jmp 0x4014e5
mov byte [ecx], bl
jmp 0x401556
mov dword [0x403064], 0xed8fca92
mov dword [0x403068], 0xb997498f
mov byte [0x40306c], bl
jmp 0x401556
mov eax, dword [0x40316c]
test ah, 0x10
je 0x40153a
or byte [ebp - 3], 0x80
mov dword [0x403064], 0x418b9c95
mov dword [0x403068], ebx
jmp 0x401556
test al, 1
je 0x401556
or byte [ebp - 3], 0x40
mov dword [0x403064], 0x4e8bc48d
mov dword [0x403068], 0xae93
push esi
push 0x40302c
push dword [ebp - 0x44]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x50023
push str.ExitWnd
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
mov dword [ebp - 0x44], eax
jne 0x40158c
mov eax, dword [ebp - 0x10]
mov dword [0x403170], eax
jmp 0x4015a9
jae 0x4015a9
jmp 0x4015a6
push 0x50030
push str.ExitWnd
push 0x403048
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_DestroyMenu]
test byte [ebp - 4], 0x10
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
je 0x40165c
test byte [ebp - 3], 0x10
jne 0x401639
mov eax, dword [0x40317c]
cmp eax, ebx
je 0x4015ed
jmp 0x4015d8
mov eax, dword [0x40317c]
mov edx, eax
mov cl, byte [edx]
cmp cl, bl
je 0x40161c
jl 0x4015e5
inc edx
jmp 0x4015da
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push ebx
push 0x401aed
push ebx
push 0x69
push dword [ebp - 0x14]
mov dword [0x40317c], 0x4030e8
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
je 0x4015d3
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x401810
cmp byte [eax], bl
jne 0x401626
mov dword [0x40317c], ebx
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx eax, ax
shr eax, 6
xor dword [ebp - 4], eax
jmp 0x40163f
mov dword [0x40317c], ebx
push ebx
push ebx
push ebx
push 0x11
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test byte [ebp - 3], 2
push 0
pop eax
setne al
inc eax
mov dword [0x403174], eax
jmp 0x40167c
cmp dword [0x403170], ebx
je 0x401743
push 0x83
push ebx
push ebx
push ebx
push ebx
push 1
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebx
push 0x400
push 1
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x4c]
push ebx
push eax
call esi
test eax, eax
je 0x4016bd
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x4c]
push ebx
push eax
jmp 0x40169a
test byte [ebp - 4], 0x10
je 0x401734
cmp dword [0x403170], ebx
je 0x4016f4
test byte [ebp - 3], 0x80
jne 0x4016f4
test byte [ebp - 3], 0x40
push 0
pop eax
setne al
push 2
push 0xf170
inc eax
push 0x112
push 0xffff
mov dword [ebp - 4], eax
call edi
jmp 0x401734
push 0xffffffffffffffff
push 0xf170
push 0x112
push 0xffff
call edi
mov dword [ebp - 4], 0x32
mov eax, dword [ebp - 4]
push ebx
and eax, 1
push ebx
push ebx
lea eax, [eax + eax - 1]
push eax
push 1
call dword [sym.imp.USER32.dll_mouse_event]
push 0x5d
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 4]
cmp dword [ebp - 4], ebx
jg 0x40170e
push ebx
push ebx
push dword [ebp - 0x18]
push 0x11
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x40174c
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 4]
test ah, 4
je 0x40175f
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHAddToRecentDocs]
mov eax, dword [ebp - 4]
test al, 8
je 0x401778
push ebx
push 0xf140
push 0x112
push dword [ebp - 0x1c]
call edi
jmp 0x401810
test al, 0x20
je 0x401788
push ebx
push ebx
call sub.KERNEL32.dll_SetSystemPowerState
jmp 0x401810
test al, 0x40
je 0x401792
push ebx
push ebx
push 0x10
jmp 0x40176e
test al, 1
je 0x40179f
mov dword [ebp - 4], 9
jmp 0x4017ce
test al, 2
je 0x4017ac
mov dword [ebp - 4], 3
jmp 0x4017ce
test al, 4
je 0x4017b5
mov dword [ebp - 4], ebx
jmp 0x4017ce
test al, 0x80
je 0x4017c2
mov dword [ebp - 4], 0x1d
jmp 0x4017ce
test ah, 1
je 0x401810
mov dword [ebp - 4], 0x17
test byte [ebp - 4], 0x10
je 0x401806
mov esi, 0x80000001
push esi
push ebx
push 0x11
push 0xffff
call edi
push 0x200
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 1
push 0x16
push 0xffff
call edi
push 0x400
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]