Function at 0x100043c0
Capabilities:
Delete file
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1008c3cc]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x54]
mov eax, dword [edi]
push ecx
push edi
mov dword [ebp - 0x60], 0
call dword [eax + 0xc0]
mov esi, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x4c]
push str.CROSSFIRE
shr esi, 1
push 0
shr ebx, 1
mov dword [ebp - 0x60], esi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp dword [0x100944f0], 0
mov dword [ebp - 0x58], eax
je 0x1000455b
mov ecx, dword [0x10094300]
cmp dword [ecx + 0x1643d34], 0xb
jne 0x1000455b
cmp byte [0x10093f46], 0
je 0x10004528
cmp byte [0x10093ee4], 0
jne 0x1000444d
mov byte [0x100905a8], 0
mov byte [0x10093ee4], 1
jmp 0x10004456
cmp byte [0x100905a8], 0
jne 0x1000447d
mov eax, str.____7__126_
sub eax, 0xe2615a
push eax
lea ecx, [ebp - 0x18]
call fcn.100053a0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [eax + 0xda785c], 0
jne 0x1000447d
mov al, 1
jmp 0x1000447f
xor al, al
test al, al
je 0x100044dd
push 0x225a8116
lea ecx, [ebp - 0x18]
call fcn.100020b0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
movq qword [ebp - 0x18], xmm0
mov word [ebp - 0x10], 0
mov byte [ebp - 0xe], 0
mov eax, dword [eax + 0x158f82c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x12c]
cmp eax, 9
je 0x100044c7
cmp eax, 0x17
je 0x100044c7
cmp eax, 0x1f
jne 0x100044ee
call dword [sym.imp.USER32.dll_GetActiveWindow]
test eax, eax
je 0x100044ee
push 0
push 0
push 0
push 0
push 2
jmp 0x100044e7
push 0
push 0
push 0
push 0
push 4
mov eax, dword [sym.imp.USER32.dll_mouse_event]
call eax
push 0x10078848
push 0xff00ff51
push 3
push 1
push edi
call fcn.10001a60
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x78
call eax
test al, 1
je 0x1000455b
push 0
push 0
push 0
push 0
push 4
call dword [sym.imp.USER32.dll_mouse_event]
mov byte [0x10093f46], 0
jmp 0x1000455b
push 0x10078898
push 0xffff0000
push 3
push 1
push edi
call fcn.10001a60
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x78
call eax
test al, 1
movzx eax, byte [0x10093f46]
mov ecx, 1
cmovne eax, ecx
mov byte [0x10093f46], al
cmp dword [0x100944dc], 0
je 0x100049f1
push 0x225a8116
lea ecx, [ebp - 0x18]
call fcn.100020b0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
movq qword [ebp - 0x18], xmm0
mov word [ebp - 0x10], 0
mov byte [ebp - 0xe], 0
mov eax, dword [eax + 0x158f82c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x12c]
cmp eax, 9
je 0x100045b0
cmp eax, 0x17
je 0x100045b0
cmp eax, 0x1f
jne 0x100049f1
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x58]
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x58]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0x58]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push dword [ebp - 0x58]
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [0x10093f44], 0
je 0x1000498d
movzx eax, byte [0x1008d770]
mov edx, dword [0x10094300]
xor ecx, ecx
cmp eax, dword [edx + 0x1643d34]
setne cl
cmp ecx, 0xb
jne 0x10004655
mov eax, 0x3e8
mov dword [0x10093f34], 0x64
mov dword [0x10093f28], eax
cmp dword [edx + 0x1643d34], ecx
jne 0x1000464c
mov byte [0x10093ee4], 0
mov byte [0x10093f45], 0
mov byte [0x10093f46], 0
cmp dword [edx + 0x1643d34], ecx
sete byte [0x1008d770]
jmp 0x1000465a
mov eax, dword [0x10093f28]
cmp dword [0x10094304], 0xb
jne 0x100048a8
cmp byte [0x10093f45], 0
jne 0x100046d6
test eax, eax
jle 0x100046b5
dec eax
push eax
mov dword [0x10093f28], eax
push 0x100788f8
push 0x10154950
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
add eax, 0xfffffdd0
push 0x10154950
push 0xff00ff51
push eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffdd0
push eax
push edi
call fcn.10001a60
jmp 0x100049f1
push 0
push 1
push 0
push 0x70
call dword [sym.imp.USER32.dll_keybd_event]
mov byte [0x10093f46], 1
mov byte [0x10093f45], 1
jmp 0x100049f1
cmp byte [0x100905a8], 0
mov dword [0x10094418], 0
jne 0x10004719
mov eax, str.____7__126_
sub eax, 0xe2615a
push eax
lea ecx, [ebp - 0x18]
call fcn.100053a0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [eax + 0xda785c], 0
jne 0x10004719
cmp byte [0x10093f46], 0
je 0x10004719
mov al, 1
jmp 0x1000471b
xor al, al
test al, al
je 0x100049f1
mov eax, dword [0x10094300]
mov edx, 0x10
mov eax, dword [eax + 0x15dd8c8]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], edx
lea esp, [esp]
test eax, eax
je 0x10004899
mov eax, dword [0x10094300]
mov ecx, dword [eax + 0x15dd8c8]
test ecx, ecx
je 0x10004896
mov eax, dword [0x10093ee0]
test eax, eax
js 0x100047a6
cmp eax, 0x12c
jge 0x100047ad
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe0], 0x45a1b000
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe4], 0xc5018000
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe8], 0xc4d34000
mov eax, dword [0x10093ee0]
inc eax
mov dword [0x10093ee0], eax
cmp eax, 0x12c
jl 0x100047ef
cmp eax, 0x258
jge 0x100047f6
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe0], 0x43818000
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe4], 0xc5018000
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe8], 0xc4f1a000
mov eax, dword [0x10093ee0]
inc eax
mov dword [0x10093ee0], eax
cmp eax, 0x258
jl 0x10004838
cmp eax, 0x384
jge 0x1000483f
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe0], 0xc1100000
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe4], 0xc5018000
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe8], 0xc5919800
mov eax, dword [0x10093ee0]
inc eax
mov dword [0x10093ee0], eax
cmp eax, 0x384
jl 0x10004880
cmp eax, 0x4b0
jge 0x10004880
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe0], 0x45271000
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe4], 0xc5018000
mov eax, dword [ecx + 0xd8c]
mov dword [eax + 0xe8], 0xc556d000
mov dword [0x10093ee0], 0
push 0
push 0
push 0x1869f
push 0
push 1
call dword [sym.imp.USER32.dll_mouse_event]
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x58]
dec edx
mov dword [ebp - 0x5c], edx
jne 0x10004740
jmp 0x100049f1
cmp dword [0x10094304], 0xd
jne 0x100049f1
push 0x79
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
movzx eax, byte [0x10093f44]
mov ecx, 0
cmovne eax, ecx
mov byte [0x10093f44], al
mov eax, dword [0x10093f34]
test eax, eax
jle 0x100048ed
dec eax
push eax
mov dword [0x10093f34], eax
push str.::_T
jmp 0x10004680
mov eax, dword [ebp - 0x1c]
add eax, 0xffffff2e
push eax
mov eax, dword [ebp - 0x20]
add eax, 0xffffffab
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
mov eax, dword [ebp - 0x1c]
push 0
push 0
add eax, 0xffffff2e
push eax
mov eax, dword [ebp - 0x20]
add eax, 0xffffffab
push eax
push 4
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 1
push 0
push 0xd
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [ebp - 0x1c]
push 0
push 0
add eax, 0xffffff2e
push eax
mov eax, dword [ebp - 0x20]
add eax, 0xffffffab
push eax
push 2
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [ebp - 0x1c]
push 0
push 0
add eax, 0xffffff2e
push eax
mov eax, dword [ebp - 0x20]
add eax, 0xffffffab
push eax
push 2
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [ebp - 0x1c]
push 0
push 0
add eax, 0xffffff2e
push eax
mov eax, dword [ebp - 0x20]
add eax, 0xffffffab
push eax
push 4
call dword [sym.imp.USER32.dll_mouse_event]
mov dword [0x10093f34], 0x12c
jmp 0x100049f1
cmp dword [0x10094304], 0xd
jne 0x100049f1
mov eax, dword [ebp - 0x1c]
push str.::_Ch
push 0xffff0000
add eax, 0xfffffdd0
push eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffdd0
push eax
push edi
mov byte [0x10093f46], 0
call fcn.10001a60
push 0x79
mov dword [0x10093f34], 0x64
mov dword [0x10093ee0], 0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
movzx eax, byte [0x10093f44]
mov ecx, 1
cmovne eax, ecx
mov byte [0x10093f44], al
cmp dword [0x10094304], 8
jne 0x10004a9f
cmp byte [0x10093ee6], 0
jne 0x10004a9f
cmp dword [0x10094300], 0
mov dword [ebp - 0x5c], str.::_SKYHT.CF_::_n_n::
je 0x10004a37
push 0
push dword [ebp - 0x5c]
push 0
push 0x75
push 0x2e
mov esi, dword [0x10094300]
add esi, 0x18ce50
call esi
add esp, 0x14
mov eax, 0x10078ab8
sub eax, 0x43d11b94
push eax
lea ecx, [ebp - 0x30]
call fcn.100053e0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
mov eax, str.ETcehbyLs_fbvl7zh
sub eax, 0x7d3ba70f
push eax
lea ecx, [ebp - 0x30]
call fcn.10005420
push eax
call esi
mov eax, 0x10078ae8
sub eax, 0x67c65c69
push eax
lea ecx, [ebp - 0x3c]
call fcn.10005460
push eax
call esi
mov eax, 0x10078b0c
sub eax, 0x65eb18c0
push eax
lea ecx, [ebp - 0x3c]
call fcn.100054a0
push eax
call esi
mov esi, dword [ebp - 0x60]
mov byte [0x10093ee6], 1
cmp dword [0x1009432c], 0
jne 0x10004b07
mov eax, dword [0x10094330]
dec eax
cmp eax, 6
ja case.default.0x10004beb
jmp dword [eax*4 + 0x10004c50]
push 0
push edi
push 0xffff0000
jmp 0x10004aff
push 0
push edi
push 0xffffff00
jmp 0x10004aff
push 0
push edi
push 0xff00ff51
jmp 0x10004aff
push 0
push edi
push 0xff00aeff
jmp 0x10004aff
push 0
push edi
push 0xffa01af0
jmp 0x10004aff
push 0
push edi
push 0xffffffffffffffff
jmp 0x10004aff
push 0
push edi
push 0xff000000
push esi
mov ecx, ebx
call fcn.10004cc0
cmp dword [0x1009432c], 1
jne 0x10004b6f
mov eax, dword [0x10094330]
dec eax
cmp eax, 6
ja case.default.0x10004beb
jmp dword [eax*4 + 0x10004c6c]
push 1
push edi
push 0xffff0000
jmp 0x10004b67
push 1
push edi
push 0xffffff00
jmp 0x10004b67
push 1
push edi
push 0xff00ff51
jmp 0x10004b67
push 1
push edi
push 0xff00aeff
jmp 0x10004b67
push 1
push edi
push 0xffa01af0
jmp 0x10004b67
push 1
push edi
push 0xffffffffffffffff
jmp 0x10004b67
push 1
push edi
push 0xff000000
push esi
mov ecx, ebx
call fcn.10004cc0
cmp dword [0x1009432c], 2
jne 0x10004bd7
mov eax, dword [0x10094330]
dec eax
cmp eax, 6
ja case.default.0x10004beb
jmp dword [eax*4 + 0x10004c88]
push 2
push edi
push 0xffff0000
jmp 0x10004bcf
push 2
push edi
push 0xffffff00
jmp 0x10004bcf
push 2
push edi
push 0xff00ff51
jmp 0x10004bcf
push 2
push edi
push 0xff00aeff
jmp 0x10004bcf
push 2
push edi
push 0xffa01af0
jmp 0x10004bcf
push 2
push edi
push 0xffffffffffffffff
jmp 0x10004bcf
push 2
push edi
push 0xff000000
push esi
mov ecx, ebx
call fcn.10004cc0
cmp dword [0x1009432c], 3
jne case.default.0x10004beb
mov eax, dword [0x10094330]
dec eax
cmp eax, 6
ja case.default.0x10004beb
jmp dword [eax*4 + 0x10004ca4]
push 3
push edi
push 0xffff0000
jmp 0x10004c33
push 3
push edi
push 0xffffff00
jmp 0x10004c33
push 3
push edi
push 0xff00ff51
jmp 0x10004c33
push 3
push edi
push 0xff00aeff
jmp 0x10004c33
push 3
push edi
push 0xffa01af0
jmp 0x10004c33
push 3
push edi
push 0xffffffffffffffff
jmp 0x10004c33
push 3
push edi
push 0xff000000
push esi
mov ecx, ebx
call fcn.10004cc0
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003cd0a
mov esp, ebp
pop ebp
ret 4