Function at 0x7d020b66
Capabilities:
Get disk information
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
cmp dword [ebp + 8], 0x10000
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
jne 0x7d020d78
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
push 0x10
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x7d020d78
lea eax, [ebp - 0x254]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
call sym.SHELL32.dll_SHGetPathFromIDListW
xor ebx, ebx
cmp word [ebp - 0x250], bx
je 0x7d020bc7
cmp word [ebp - 0x24e], bx
jne 0x7d020d78
mov eax, dword [ebp - 0x254]
push 0x100
lea esi, [eax - 1]
and esi, 0x1f
call sym.SHELL32.dll_SHRestricted
push 1
mov ecx, esi
pop edx
shl edx, cl
test eax, edx
jne 0x7d020d78
call fcn.7d020ad3
test eax, eax
je 0x7d020d78
cmp edi, ebx
je 0x7d020c1f
mov eax, dword [ebp - 4]
cmp edi, dword [eax + 0x50]
je 0x7d020c16
mov eax, dword [eax + 0x4c]
cmp edi, dword [eax]
je 0x7d020c16
push edi
call fcn.7d033894
test eax, eax
je 0x7d020c1f
mov dword [ebp + 8], 1
jmp 0x7d020c22
mov dword [ebp + 8], ebx
push esi
xor edi, edi
call sym.SHELL32.dll_IsNetDrive
test eax, eax
je 0x7d020c36
push 1
pop edi
jmp 0x7d020d19
push esi
call fcn.7cfdb743
test eax, eax
jne 0x7d020c4f
cmp dword [ebp + 8], ebx
je 0x7d020c52
push esi
call fcn.7cfdb788
test eax, eax
je 0x7d020c52
push 1
pop edi
cmp edi, ebx
je 0x7d020d78
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x7d020cbe
lea eax, [ebp + 8]
push eax
push 0x20019
push ebx
push 0x7cf33008
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7d020cbe
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x7cf47ff8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7d020cb5
cmp dword [ebp - 8], 1
jne 0x7d020cb5
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x7d020d78
push esi
call fcn.7cfdb6fe
test eax, eax
je 0x7d020cdc
push dword [ebp - 0xc]
call fcn.7d020a8c
test eax, eax
je 0x7d020d17
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x7d020d19
mov esi, dword [sym.imp.SHLWAPI.dll_IsOS]
push 9
call esi
test eax, eax
jne 0x7d020d17
push 0xa
call esi
test eax, eax
jne 0x7d020d17
push 0xb
call esi
test eax, eax
jne 0x7d020d17
push 2
call sub.SHLWAPI.dll_Ordinal_413
test eax, eax
je 0x7d020d19
xor edi, edi
cmp edi, ebx
je 0x7d020d78
mov eax, dword [ebp - 4]
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0xc
mov eax, dword [eax + 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x254]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x254]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], 1
mov eax, dword [eax]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call sym.SHELL32.dll_ShellExecuteExW
pop edi
pop esi
pop ebx
leave
ret 8