Function at 0x426681
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check for unmoving mouse cursor
Log keystrokes via polling
Suspend thread

Disassembly:
push ebp
lea ebp, [esp - 0x4c0]
sub esp, 0x53c
mov eax, dword [0x4755d0]
xor eax, ebp
mov dword [ebp + 0x4bc], eax
mov eax, dword [ebp + 0x4cc]
push ebx
mov ebx, dword [ebp + 0x4c8]
push esi
push edi
push 0x207
mov dword [ebp - 0x64], eax
xor edi, edi
lea eax, [ebp + 0x2b5]
push edi
push eax
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x55], 0
mov byte [ebp + 0x2b4], 0
call fcn.00448090
mov esi, 0x103
push esi
lea eax, [ebp + 0x1b1]
push edi
push eax
mov byte [ebp + 0x1b0], 0
call fcn.00448090
push esi
lea eax, [ebp - 0x53]
push edi
push eax
mov byte [ebp - 0x54], 0
call fcn.00448090
mov dword [ebp - 0x7c], edi
xor eax, eax
and dword [ebp - 0x74], eax
and dword [0x477404], eax
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
lea esi, [ebx*4 + 0x478a70]
mov ebx, dword [ebp - 0x64]
add esp, 0x24
imul ebx, ebx, 0xf54
lea edi, [ebp - 0x70]
stosd dword es:[edi], eax
mov eax, dword [esi]
xor edi, edi
push edi
push edi
push dword [ebp - 0x64]
lea eax, [eax + ebx + 0x15c]
push dword [ebp - 0x68]
push eax
call fcn.0043b804
push edi
push edi
push dword [0x47c474]
call fcn.00419f2c
fmul qword [0x462010]
add esp, 0xc
call fcn.00449ec0
mov dword [ebp - 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x60], eax
mov eax, dword [esi]
add eax, ebx
push str.Freeze
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42679a
push dword [0x47c474]
push str.____Duration:__s_second_s_
call fcn.00421b06
pop ecx
pop ecx
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
jmp 0x427228
mov eax, dword [esi]
add eax, ebx
push 0x461fe0
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426820
push dword [0x47c474]
push str.____Duration:__s_second_s_
call fcn.00421b06
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
pop ecx
call edi
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c]
jae 0x426792
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 0xfa
push 0
call esi
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], ebx
jl 0x4267ea
mov eax, ebx
push eax
call esi
movzx eax, byte [0x47500c]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x426ab8
cmp dword [0x477418], 0
jne 0x426ab8
call edi
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c]
jb 0x4267dc
jmp 0x426792
mov eax, dword [esi]
add eax, ebx
push str.Keypress
push eax
call fcn.004010ff
pop ecx
pop ecx
mov edi, str.Mouse
test eax, eax
jne 0x426f6b
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x426f6b
mov eax, dword [esi]
add eax, ebx
push str.Restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426ac0
mov eax, dword [ebp - 0x68]
imul eax, eax, 0x104
push 0xc
lea ecx, [ebp + 0x2b4]
lea eax, [eax + 0x4775d8]
push ecx
push eax
mov dword [ebp - 0x5c], eax
call fcn.0040eb69
lea eax, [ebp + 0x2b4]
push eax
lea eax, [ebp + 0x1b0]
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x1b0]
push eax
xor edi, edi
push edi
push edi
push edi
push 1
call fcn.00442f38
mov dword [ebp - 0x60], eax
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Remove
push eax
call fcn.004010ff
add esp, 0x28
test eax, eax
je 0x4268fe
lea eax, [ebp + 0x1b0]
push eax
push edi
push edi
push edi
push 4
call fcn.00442f38
lea eax, [ebp + 0x2b4]
push eax
push str.____Successfully_removed_restart_entry_for___s_
call fcn.00421b06
add esp, 0x1c
jmp 0x426792
push 0x103
lea eax, [ebp + 0x2b4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x45ddf8
push edi
push 0
lea eax, [ebp + 0x2b4]
push eax
call fcn.00441ac4
push edi
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x2b4]
push str.vTask.exe
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x426965
push str..VXM
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426995
push str.__r__
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x5c]
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__s
lea eax, [ebp + 0x2b4]
push eax
call edi
mov eax, dword [ebp - 0x64]
inc eax
push eax
lea eax, [ebp - 0x54]
push 0x45cb18
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x2b4]
push eax
call edi
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
cmp byte [eax], 0
mov edi, str.Temp
je 0x426a07
push str.Perm
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x426a07
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426a1f
cmp dword [ebp - 0x60], 0
jne 0x426a1f
lea eax, [ebp + 0x1b0]
push eax
lea eax, [ebp + 0x2b4]
push 0
push eax
call fcn.00445d9a
add esp, 0xc
push 0x103
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [ebp - 0x60], 0
je 0x426a9a
push 0x45e070
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x426a68
lea eax, [ebp - 0x54]
push str.vTask.EXE
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x426a9a
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426792
lea eax, [ebp + 0x1b0]
push eax
xor eax, eax
push eax
push eax
push eax
push 4
call fcn.00442f38
add esp, 0x14
jmp 0x426792
push str.____Successfully_saved_restart_configuration
call fcn.00421b06
lea eax, [ebp + 0x2b4]
push eax
push str.____Script_will_be_launched_next_time_Windows_is_started___s_
call fcn.00421b06
add esp, 0xc
or eax, 0xffffffff
jmp 0x427228
mov eax, dword [esi]
add eax, ebx
push str.Window
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426b52
mov eax, dword [esi]
lea eax, [eax + ebx + 0x364]
push 0x45db2c
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426b52
mov eax, dword [esi]
xor edi, edi
push edi
push edi
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [eax + ebx + 0x50]
call fcn.0043b804
push edi
push dword [0x4771a0]
push dword [0x47c474]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
call fcn.00420936
or eax, 0x4000
push eax
call fcn.00446605
mov dword [ebp - 0x60], eax
cmp eax, edi
je 0x426b52
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x426b52
cmp dword [0x4771e8], edi
jne 0x426792
mov eax, dword [ebp - 0x60]
mov dword [0x4771e8], eax
jmp 0x426792
mov eax, dword [ebp - 0x68]
mov dword [section..data], eax
mov eax, dword [ebp - 0x64]
mov dword [0x475004], eax
mov eax, dword [esi]
and dword [eax + ebx + 0xf28], 0
xor eax, eax
mov edi, 0x4775a4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, 0x478898
stosd dword es:[edi], eax
mov byte [ecx], 0
add ecx, 0x20
cmp ecx, 0x478938
jl 0x426b7d
mov eax, dword [esi]
add eax, ebx
push str.Idle
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426c03
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0xff
push edi
lea eax, [ebp + 0xb1]
push 0
push eax
mov byte [ebp + 0xb0], 0
call fcn.00448090
push 0x100
lea eax, [ebp + 0xb0]
push 0
push eax
call fcn.00448090
add esp, 0x18
lea eax, [ebp + 0xb0]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
and dword [ebp - 0x5c], 0
push dword [ebp - 0x5c]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], edi
jl 0x426bed
jmp 0x426e78
mov eax, dword [esi]
add eax, ebx
push str.Type
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426d02
push 0x100
push 0
push 0x47b0e8
call fcn.00448090
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0xc
push 0x90
call edi
test al, 1
je 0x426c48
mov byte [0x47b178], 1
push 0x14
call edi
test al, 1
je 0x426c57
mov byte [0x47b0fc], 1
push 0x91
call edi
test al, 1
je 0x426c69
mov byte [0x47b179], 1
mov eax, dword [esi]
push 0
push 0
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [eax + ebx + 0x50]
call fcn.0043b804
push dword [0x47c474]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
lea ecx, [eax + 1]
push 0x1f
pop eax
cmp ecx, eax
jg 0x426c9f
push dword [0x47c474]
call edi
inc eax
push eax
push dword [0x47c474]
push 0x478898
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
and dword [ebp - 0x5c], 0
push 0x478898
call edi
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx + 0x478898]
mov dl, byte [ecx]
dec eax
mov byte [ebp - 0x56], dl
test dl, dl
je 0x426cea
cmp dword [ebp - 0x5c], eax
jge 0x426cea
mov dl, byte [eax + 0x478898]
inc dword [ebp - 0x5c]
mov byte [ecx], dl
mov cl, byte [ebp - 0x56]
mov byte [eax + 0x478898], cl
jmp 0x426cbc
push 0x478898
call edi
mov byte [0x4788b8], al
mov byte [0x47b350], 0
jmp 0x426e78
mov eax, dword [esi]
add eax, ebx
push str.Date_Time
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426e5c
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426e5c
mov eax, dword [ebp - 0x68]
imul eax, eax, 0x104
push 0xc
lea ecx, [ebp + 0x2b4]
lea eax, [eax + 0x4775d8]
push ecx
push eax
mov dword [ebp - 0x5c], eax
call fcn.0040eb69
lea eax, [ebp + 0x2b4]
push eax
lea eax, [ebp + 0x1b0]
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x103
lea eax, [ebp + 0x2b4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x45ddf8
push edi
push 0
lea eax, [ebp + 0x2b4]
push eax
call fcn.00441ac4
push edi
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x2b4]
push str.vTask.exe
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x426dda
push str..VXM
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426e0a
push str.__r__
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x5c]
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__s
lea eax, [ebp + 0x2b4]
push eax
call edi
mov eax, dword [ebp - 0x64]
inc eax
push eax
lea eax, [ebp - 0x54]
push 0x45cb18
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x2b4]
push eax
call edi
lea eax, [ebp + 0x1b0]
push eax
lea eax, [ebp + 0x2b4]
push 0
push eax
call fcn.00445d9a
add esp, 0xc
jmp 0x426e78
mov eax, dword [esi]
add eax, ebx
push str.File
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426e78
or dword [0x4775a4], 0xffffffff
cmp dword [ebp - 0x6c], 0
mov edi, dword [sym.imp.USER32.dll_SetTimer]
jle 0x426e96
push 0
push dword [ebp - 0x6c]
push 0x806e
push dword [0x4771a0]
call edi
mov eax, dword [esi]
push 0
add eax, ebx
push str.Type
push eax
call fcn.004010ff
neg eax
pop ecx
sbb eax, eax
pop ecx
and eax, 0xfffffd12
add eax, 0x3e8
push eax
push 0x806c
push dword [0x4771a0]
call edi
push dword [0x4771a0]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
push dword [0x4771a0]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x477340]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [esi]
add eax, ebx
push str.Date_Time
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426f61
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x426f61
push 0xc
lea eax, [ebp + 0x2b4]
push eax
mov eax, dword [ebp - 0x68]
imul eax, eax, 0x104
add eax, 0x4775d8
push eax
call fcn.0040eb69
lea eax, [ebp + 0x2b4]
push eax
lea eax, [ebp + 0x1b0]
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x1b0]
push eax
xor eax, eax
push eax
push eax
push eax
push 4
call fcn.00442f38
add esp, 0x20
mov eax, dword [0x477404]
jmp 0x427228
mov eax, dword [esi]
push 0
push 0
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [eax + ebx + 0x50]
call fcn.0043b804
mov eax, dword [0x47c474]
cmp byte [eax], 0
je 0x426fbd
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
call fcn.004391e1
mov ecx, dword [esi]
cmp dword [ecx + ebx + 0xf28], 1
mov byte [ebp - 0x56], al
jg 0x426fc1
movzx eax, al
push eax
push dword [0x47c474]
push str.____Waiting_for_keypress__s___d_
call fcn.00421b06
add esp, 0xc
jmp 0x426fc1
mov byte [ebp - 0x56], 0
push 0x15e
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xff
lea eax, [ebp + 0xb1]
push 0
push eax
mov byte [ebp + 0xb0], 0
call fcn.00448090
push 0x100
lea eax, [ebp + 0xb0]
push 0
push eax
call fcn.00448090
add esp, 0x18
lea eax, [ebp + 0xb0]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
and dword [ebp - 0x5c], 0
push dword [ebp - 0x5c]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xff
jl 0x42700d
mov eax, dword [esi]
add eax, ebx
push str.Keypress
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x427040
mov byte [ebp - 0x55], 1
jmp 0x427134
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42707b
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Move
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42707b
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov byte [ebp - 0x55], 2
jmp 0x427134
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4270ac
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Left
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4270ac
mov byte [ebp - 0x55], 4
jmp 0x427134
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4270da
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Right
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4270da
mov byte [ebp - 0x55], 8
jmp 0x427134
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x427108
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Middle
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x427108
mov byte [ebp - 0x55], 0x10
jmp 0x427134
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x427134
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push 0x45cafc
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x427134
mov byte [ebp - 0x55], 0x20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c]
jae 0x427226
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
inc edi
cmp byte [ebp - 0x55], 0
je 0x427226
movzx eax, byte [0x47500c]
push eax
call esi
test ax, ax
jne 0x426ab8
cmp dword [0x477418], 0
jne 0x426ab8
push 0
call ebx
push 0xfa
call ebx
movzx eax, byte [ebp - 0x55]
dec eax
je 0x4271dd
dec eax
je 0x4271c3
dec eax
dec eax
je 0x4271c0
sub eax, 4
je 0x4271bc
sub eax, 8
je 0x4271b8
sub eax, 0x10
jne 0x427214
push edi
call esi
test ax, ax
jne 0x4271ef
push 2
call esi
test ax, ax
jne 0x4271ef
push 4
jmp 0x4271e8
push 2
jmp 0x4271e8
push edi
jmp 0x4271e8
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x74]
jne 0x4271ef
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x70]
jmp 0x4271ed
cmp byte [ebp - 0x56], 0
je 0x4271f3
movzx eax, byte [ebp - 0x56]
push eax
call esi
test ax, ax
je 0x427214
mov eax, edi
jmp 0x427228
xor edi, edi
lea eax, [edi - 8]
cmp eax, 0x97
ja 0x42720b
push edi
call esi
test ax, ax
jne 0x426792
inc edi
cmp edi, 0xff
jl 0x4271f5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c]
jb 0x427152
xor eax, eax
mov ecx, dword [ebp + 0x4bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448080
add ebp, 0x4c0
leave
ret 8