Function at 0x402fbd
Capabilities:
Inspect load icon resource
Log keystrokes via polling

Disassembly:
push 0x40
mov eax, 0x438211
call fcn.004368bd
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x44], ecx
xor ebx, ebx
mov dword [ebp - 0x2c], 7
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 4], ebx
call fcn.00402d71
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0041797f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0041e2b0
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, 0x800
pop ecx
push edi
push ebx
push str.RichEd20.dll
call esi
push edi
push ebx
push str.Msftedit.dll
call esi
push 0x441000
mov ecx, 0x44df00
call fcn.004011c3
push 0x7b
push dword [0x44da9c]
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x64
pop esi
push 0x4c4
mov dword [0x44da98], eax
call fcn.0041a501
pop ecx
mov dword [ebp - 0x48], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00402d8d
push 0x441020
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
mov edi, eax
call fcn.004040e9
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
lea eax, [edi + 0x1c]
push ecx
mov ecx, eax
call fcn.0040519b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
mov bl, al
call fcn.00404129
test bl, bl
je 0x403400
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
shr eax, 0xf
test al, 1
je 0x4030d2
push 0x14
call esi
lea ebx, [edi + 0x1c]
test al, 1
je 0x4030d5
mov ecx, ebx
call fcn.00405356
mov eax, dword [edi + 0x134]
push str.____Bvckup_2_setup_log_____n
push 3
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
add esp, 0xc
jmp 0x4030d5
lea ebx, [edi + 0x1c]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x44]
push 0x66
pop esi
push edi
call fcn.0040345d
pop ecx
test al, al
je 0x403400
mov ecx, ebx
call fcn.004053d8
cmp byte [edi + 0x7d], 0
mov ebx, dword [edi + 0x134]
je 0x40311e
cmp byte [edi + 0x28], 0
je 0x40311e
mov eax, dword [ebx]
push str.Started_with___elevating__but_no_Admin_priviles_n
push 0
push ebx
call dword [eax + 0xc]
add esp, 0xc
push 0x67
pop esi
jmp 0x403447
cmp dword [edi + 0x14], 0
je 0x403132
mov ecx, edi
call fcn.00403c0c
mov esi, eax
jmp 0x403400
cmp dword [edi + 0x78], 3
jge 0x40313d
call fcn.0040c75c
push 0x69
pop esi
lea edx, [ebp - 0x40]
lea ecx, [edi + 0x1c]
call fcn.004038d6
test al, al
jne 0x40316d
call fcn.0040c7fe
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
push eax
push 0x31
pop edx
lea ecx, [ebp - 0x40]
call fcn.0040d661
pop ecx
jmp 0x403400
push 0x6a
pop esi
lea ecx, [edi + 0x1c]
call fcn.0040553e
test al, al
jne 0x4031b3
call fcn.0040c7fe
push str.Failed_to_set_up_file_system_redirect
lea ecx, [ebp - 0x28]
call fcn.004040e9
mov byte [ebp - 4], 3
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
push eax
push 0x31
pop edx
lea ecx, [ebp - 0x28]
call fcn.0040d661
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00404129
jmp 0x403400
mov eax, dword [ebx]
push str.Extracting_license.rtf..._n
push 3
push ebx
call dword [eax + 0xc]
push 0x6b
pop esi
lea eax, [edi + 0x138]
mov edx, str.license.rtf
push eax
lea eax, [edi + 0x20c]
push eax
lea ecx, [edi + 0x98]
call fcn.004087ef
add esp, 0x14
test al, al
jne 0x403200
call fcn.0040c7fe
push str.Failed_to_extract_license.rtf
lea ecx, [ebp - 0x28]
call fcn.004040e9
mov byte [ebp - 4], 4
jmp 0x403192
call fcn.0040c7fe
cmp dword [edi + 0x2c8], 0
jne 0x40321b
lea ecx, [edi + 0x29c]
call fcn.00409f67
jmp 0x403253
lea ecx, [edi + 0x2b8]
cmp dword [ecx + 0x10], 0
je 0x403457
mov eax, dword [edi + 0x2d8]
add eax, 0x11c
cmp dword [ecx + 0x14], 8
jb 0x40323e
mov ecx, dword [ecx]
push eax
lea edx, [edi + 0x324]
call fcn.004155e3
pop ecx
test al, al
je 0x403400
mov eax, dword [edi + 0x330]
or eax, dword [edi + 0x32c]
or eax, dword [edi + 0x328]
or eax, dword [edi + 0x324]
mov eax, dword [ebx]
jne 0x40338a
push 0x441140
push 3
push ebx
call dword [eax + 0xc]
add esp, 0xc
cmp dword [edi + 0x78], 1
jne 0x4032ff
push 0x10c
call fcn.0041a501
pop ecx
mov dword [ebp - 0x48], eax
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00409bf2
mov byte [ebp - 4], 0
lea esi, [edi + 0x424]
mov dword [ebp - 0x44], eax
mov ecx, esi
lea eax, [ebp - 0x44]
push eax
call fcn.00403fd5
call fcn.00409b98
mov dword [ebp - 0x44], eax
mov ecx, esi
lea eax, [ebp - 0x44]
push eax
call fcn.00403fd5
push 0x124
call fcn.0041a501
pop ecx
mov dword [ebp - 0x48], eax
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.00408e11
mov byte [ebp - 4], 0
mov ecx, esi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
call fcn.00403fd5
call fcn.004099e8
mov ecx, esi
jmp 0x40335e
cmp byte [edi + 0x1b4], 0
je 0x40333e
cmp byte [edi + 0x28], 0
je 0x40332a
lea ecx, [edi + 0x19c]
call fcn.00406e18
mov esi, 0xf0
xor ecx, ecx
test al, al
cmovne esi, ecx
jmp 0x403400
cmp byte [edi + 0x1b4], 0
je 0x40333e
mov eax, dword [edi + 0x208]
add eax, 0x2c
jmp 0x403347
mov eax, dword [edi + 0x208]
add eax, 0x44
push eax
lea ecx, [edi + 0x1b8]
call fcn.00406560
call fcn.004099e8
lea ecx, [edi + 0x424]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
call fcn.00403fd5
push ecx
push 0x65
lea ecx, [edi + 0x368]
call fcn.0040f598
xor eax, eax
mov esi, 0xfa
cmp byte [edi + 0x299], al
cmovne esi, eax
jmp 0x403400
push 0x441160
push 3
push ebx
call dword [eax + 0xc]
add esp, 0xc
lea ebx, [edi + 0x29c]
mov ecx, ebx
mov esi, 0x131
call fcn.0040a245
test al, al
jne 0x403400
cmp dword [edi + 0x78], 1
jne 0x4033c2
mov ecx, ebx
add esi, 5
call fcn.0040a29c
test al, al
je 0x403400
cmp byte [edi + 0x2b4], 0
je 0x4033e2
cmp byte [edi + 0x28], 0
je 0x4033e2
mov ecx, ebx
call fcn.0040a45d
mov esi, 0x138
jmp 0x40331e
push ecx
push 0x79
lea ecx, [edi + 0x438]
call fcn.0040f598
mov esi, dword [edi + 0x334]
neg esi
sbb esi, esi
and esi, 0x15e
cmp byte [edi + 0x198], 0
je 0x403447
mov dword [ebp - 0x1c], vtable.sfc_hwnd.0
mov byte [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x403435
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0040fcec
sub esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0040fdd7
push esi
push str._nCompleted_with__d_n_nPress_Enter_to_exit..._n
call fcn.0041a22e
pop ecx
pop ecx
call fcn.0041e435
lea ecx, [ebp - 0x40]
call fcn.00404129
mov eax, esi
call fcn.00436878
ret
call fcn.00428d1b
int3