Function at 0x41aeb8
Capabilities:
Get common file path
Log keystrokes via polling
Query environment variable
Set current directory

Disassembly:
push ebp
mov eax, 0x41a4
lea ebp, [esp - 0x74]
call fcn.00462ba0
push ebx
push esi
mov dword [ebp + 0x5c], ecx
push edi
lea ecx, [ebp + 0x7c]
call fcn.0040e58b
xor esi, esi
mov byte [ebp + 0x73], 0
xor bl, bl
mov dword [ebp + 0x54], esi
mov dword [ebp + 0x68], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 0x34], eax
push 4
lea eax, [ebp + 0x7c]
push eax
push str.sys
call fcn.0042c9b5
mov byte [ebp + 0x64], al
push 5
lea eax, [ebp + 0x7c]
push eax
push str.sys0
call fcn.0042c9b5
add esp, 0x18
test al, al
je 0x41af1a
mov byte [ebp + 0x64], 0x41
push 7
lea eax, [ebp + 0x7c]
push eax
push str.syscmd
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x41af35
mov byte [ebp + 0x64], 0x10
push 8
lea eax, [ebp + 0x7c]
push eax
push str.sys0cmd
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x41af50
mov byte [ebp + 0x64], 0x50
cmp byte [ebp + 0x64], 0
je 0x41b06b
push 0x48b5d4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.GlobalPECMD:main:lock
call fcn.0040b5b9
mov edi, dword [ebp + 0x64]
and edi, 0x40
push edi
mov dword [ebp + 0x6c], eax
call fcn.0040b580
push dword [ebp + 0x7c]
mov ebx, eax
call fcn.0046176a
mov esi, eax
add esi, 0x10
add esp, 0xc
lea eax, [esi + 0x65]
push eax
lea ecx, [ebp + 0x68]
call fcn.0042465d
mov eax, dword [ebp + 0x68]
and word [eax], 0
test byte [ebp + 0x64], 0x10
jne 0x41afbd
push dword [ebp + 0x34]
push str.THREAD_WAIT__cur:_lu
push dword [ebp + 0x68]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp + 0x68]
call fcn.0046176a
pop ecx
mov ecx, dword [ebp + 0x68]
inc esi
push esi
push dword [ebp + 0x7c]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov esi, dword [ebp + 0x68]
push esi
call fcn.0046176a
shl eax, 1
push eax
push esi
push 1
push str.HOTKEY9000000
push str.SOFTWAREPELOGON
push 0x80000002
call fcn.00425503
add esp, 0x1c
test ebx, ebx
jne 0x41b013
push edi
push dword [ebp + 0x5c]
call fcn.0041154e
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x41b041
push 0
push 0x895440
push 0x312
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp + 0x68]
mov esi, eax
call fcn.00424686
cmp dword [ebp + 0x6c], 0
je 0x41b05b
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x41b05b
lea ecx, [ebp + 0x68]
call fcn.00424686
cmp dword [ebp + 0x6c], 0
je 0x41b058
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor esi, esi
inc esi
push 0x48b5d4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x41b6f2
mov ecx, dword [ebp + 0x7c]
cmp word [ecx], 0x2d
jne 0x41b1bd
push 5
lea eax, [ebp + 0x7c]
push eax
push str._cont
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x41b098
mov dword [ebp + 0x54], 0x10000
jmp 0x41b0fc
push 8
lea eax, [ebp + 0x7c]
push eax
push str._scanall
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x41b0b3
mov bl, 1
jmp 0x41b0fc
push 4
lea eax, [ebp + 0x7c]
push eax
push str._ncd
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x41b0d3
mov dword [ebp + 0x68], 0x40
jmp 0x41b0fc
push 5
push dword [ebp + 0x7c]
push str._cur:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x41b10b
add dword [ebp + 0x7c], 0xa
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0042e410
pop ecx
pop ecx
mov ecx, dword [ebp + 0x7c]
cmp word [ecx], 0x2d
je 0x41b078
jmp 0x41b10e
mov ecx, dword [ebp + 0x7c]
test bl, bl
je 0x41b1bd
lea ecx, [ebp + 0x6c]
mov ebx, str.PressKey
call fcn.0042460b
mov eax, dword [ebp + 0x7c]
cmp word [eax], si
je 0x41b140
push 0x2c
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0042df66
mov ebx, dword [ebp + 0x6c]
add esp, 0xc
push 0x3f
xor eax, eax
mov byte [ebp - 0x12c], 0
pop ecx
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor esi, esi
mov word [ebp - 0x4130], si
lea edi, [ebp - 0x4130]
movzx eax, byte [ebp + esi - 0x12c]
push eax
push 0x478744
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add edi, 0xa
cmp esi, 0x100
jl 0x41b173
mov ecx, dword [ebp + 0x5c]
lea eax, [ebp - 0x4130]
push eax
xor esi, esi
push ebx
mov word [ebp - 0x3732], si
call fcn.00428e1b
lea ecx, [ebp + 0x6c]
call fcn.00424686
jmp 0x41b6e8
cmp word [ecx], 0x2d
push 2
pop edi
jne 0x41b1ec
push 4
push ecx
push str._cmd
call fcn.004257a3
add esp, 0xc
test al, al
jne 0x41b1e9
add dword [ebp + 0x7c], edi
lea ecx, [ebp + 0x7c]
mov byte [ebp + 0x73], 1
call fcn.0040e58b
mov ecx, dword [ebp + 0x7c]
cmp word [ecx], 0x3d
jne 0x41b1fb
mov bl, byte [ecx]
add ecx, edi
mov dword [ebp + 0x7c], ecx
jmp 0x41b1fd
xor bl, bl
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.0040e5a7
add esp, 4
test al, al
je 0x41b2f9
or dword [ebp + 0x50], 0xffffffff
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0042e410
and word [ebp - 0x2a], 0
and word [ebp - 0x2c], 0
pop ecx
pop ecx
lea ecx, [ebp + 0x6c]
mov esi, str.PressKey
call fcn.0042460b
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2c
jne 0x41b266
add dword [ebp + 0x7c], edi
push 0x2c
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0042df66
mov eax, dword [ebp + 0x6c]
add esp, 0xc
cmp word [eax], 0
je 0x41b266
mov esi, eax
cmp byte [ebp + 0x73], 0
mov ecx, dword [ebp + 0x50]
jne 0x41b290
test ecx, ecx
je 0x41b28c
jl 0x41b2e6
test bl, bl
push ecx
je 0x41b282
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41b2e6
mov ecx, dword [ebp + 0x5c]
call fcn.0040ac88
jmp 0x41b2e6
mov eax, edi
jmp 0x41b293
xor eax, eax
inc eax
or eax, dword [ebp + 0x54]
push eax
push ecx
call fcn.004128e6
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x41b2d9
cmp ecx, 0x41
jl 0x41b2af
cmp ecx, 0x5a
jle 0x41b2bc
push ecx
call fcn.0040e5a7
add esp, 4
test al, al
je 0x41b2c6
movsx ax, cl
mov word [ebp - 0x2c], ax
jmp 0x41b2d9
push ecx
lea eax, [ebp - 0x2c]
push str.0x_X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, dword [ebp + 0x5c]
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.00428e1b
lea ecx, [ebp + 0x7c]
call fcn.0040e58b
lea ecx, [ebp + 0x6c]
call fcn.00424686
mov ecx, dword [ebp + 0x7c]
and dword [ebp + 0x4c], 0
xor bl, bl
or esi, 0xffffffff
cmp word [ecx], 0x2a
jne 0x41b321
mov eax, dword [ebp + 0x34]
xor esi, esi
add ecx, edi
inc esi
mov dword [ebp + 0x4c], eax
jmp 0x41b318
inc esi
add ecx, edi
mov dword [ebp + 0x7c], ecx
cmp word [ecx], 0x2a
je 0x41b315
test esi, esi
jle 0x41b37a
mov ax, word [ecx]
cmp ax, 0x2d
jne 0x41b339
add ecx, edi
and dword [ebp + 0x4c], 0
mov dword [ebp + 0x7c], ecx
jmp 0x41b37a
cmp ax, 0x3d
jne 0x41b346
add ecx, edi
mov dword [ebp + 0x7c], ecx
mov bl, 1
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.0040e5a7
add esp, 4
test al, al
je 0x41b368
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0042e410
pop ecx
pop ecx
dec esi
test esi, esi
jle 0x41b37a
push esi
push dword [ebp + 0x4c]
call fcn.0040bacf
pop ecx
pop ecx
mov dword [ebp + 0x4c], eax
or dword [ebp + 0x44], 0xffffffff
lea ecx, [ebp + 0x7c]
call fcn.0040e58b
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x3d
jne 0x41b39b
mov cl, byte [eax]
add eax, edi
mov byte [ebp + 0x73], cl
mov dword [ebp + 0x7c], eax
jmp 0x41b39f
mov byte [ebp + 0x73], 0
movzx eax, word [eax]
push eax
call fcn.0040e5a7
add esp, 4
test al, al
je 0x41b3be
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0042e410
pop ecx
pop ecx
and dword [ebp + 0x58], 0
cmp dword [ebp + 0x4c], 0
je 0x41b3e7
test bl, bl
push dword [ebp + 0x4c]
push 0
push 0x100000
je 0x41b3de
call dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x41b3e4
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 0x58], eax
push 0x209
lea ecx, [ebp + 0x60]
call fcn.0042465d
mov eax, dword [ebp + 0x60]
xor edi, edi
mov word [eax], di
push dword [ebp + 0x60]
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp + 0x60]
push eax
lea ecx, [ebp + 0x48]
call fcn.0042a1a0
push 0x5c
push dword [ebp + 0x48]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov eax, dword [ebp + 0x60]
push esi
mov word [eax], di
push dword [ebp + 0x60]
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp + 0x48]
call fcn.0046176a
pop ecx
lea ecx, [ebp + 0x7c]
call fcn.0040e58b
lea ecx, [ebp + 0x38]
call fcn.00424855
mov eax, dword [ebp + 0x7c]
cmp word [eax], di
mov dword [ebp + 0x30], edi
je 0x41b558
push 4
pop ebx
cmp byte [0x4892b4], 0
jle 0x41b558
push ebx
lea eax, [ebp + 0x7c]
push eax
push str._del
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x41b524
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x54], eax
push 1
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x54]
push eax
mov dword [ebp + 0x50], edi
call fcn.004124b4
add esp, 0xc
lea ecx, [ebp + 0x6c]
mov dword [ebp + 0x7c], eax
call fcn.0042460b
lea ecx, [ebp + 0x64]
call fcn.0042460b
push dword [ebp + 0x50]
lea ecx, [ebp + 0x64]
push dword [ebp + 0x54]
call fcn.00409ba0
lea eax, [ebp + 0x6c]
push eax
push dword [ebp + 0x64]
call fcn.0040c061
pop ecx
pop ecx
lea ecx, [ebp + 0x64]
call fcn.00424686
cmp dword [ebp + 0x50], edi
jle 0x41b512
push ebx
call fcn.00461a38
cmp eax, edi
pop ecx
je 0x41b4f7
mov ecx, dword [ebp + 0x6c]
mov dword [eax], ecx
mov dword [ebp + 0x6c], edi
mov esi, eax
jmp 0x41b4f9
xor esi, esi
push ebx
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x38]
push eax
push dword [ebp + 0x40]
call fcn.004247fa
add esp, 0x10
mov dword [eax], esi
inc dword [ebp + 0x40]
lea ecx, [ebp + 0x7c]
call fcn.0040e58b
lea ecx, [ebp + 0x6c]
call fcn.00424686
jmp 0x41b544
push ebx
lea eax, [ebp + 0x7c]
push eax
push str._cmd
call fcn.0042c9b5
add esp, 0xc
test al, al
jne 0x41b552
lea eax, [ebp + 0x7c]
push eax
call fcn.00403977
pop ecx
mov eax, dword [ebp + 0x7c]
cmp word [eax], di
jne 0x41b462
jmp 0x41b558
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x30], eax
cmp dword [ebp + 0x68], edi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jne 0x41b56d
cmp dword [ebp + 0x58], edi
je 0x41b5d0
push dword [ebp + 0x60]
call esi
cmp dword [ebp + 0x58], edi
je 0x41b5d0
jmp 0x41b5c7
push 0x4ff
push 0x3e8
push edi
lea eax, [ebp + 0x58]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x41b5d0
jmp 0x41b5be
push 1
push edi
push edi
push edi
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41b5c7
cmp dword [ebp + 0x18], 0x12
je 0x41b5c7
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4892b4], 0
jg 0x41b591
cmp byte [0x4892b4], 0
jg 0x41b574
cmp dword [ebp + 0x44], edi
jl 0x41b5ee
cmp byte [ebp + 0x73], 0
push dword [ebp + 0x44]
je 0x41b5e6
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41b5ee
mov ecx, dword [ebp + 0x5c]
call fcn.0040ac88
cmp dword [ebp + 0x40], edi
jle 0x41b699
cmp byte [0x4892b4], 0
jle 0x41b699
cmp dword [ebp + 0x68], 0
jne 0x41b60f
push dword [ebp + 0x60]
call esi
cmp dword [ebp + 0x40], 0
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x50], eax
jle 0x41b699
cmp byte [0x4892b4], 0
jle 0x41b699
mov eax, dword [ebp + 0x40]
xor edi, edi
cmp eax, edi
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x6c], eax
jle 0x41b699
cmp byte [0x4892b4], 0
jle 0x41b683
mov eax, dword [ebp + 0x50]
lea esi, [eax + edi*4]
mov eax, dword [esi]
test eax, eax
je 0x41b67d
push dword [eax]
call fcn.00410564
mov eax, dword [esi]
push dword [eax]
call fcn.004613a8
test eax, eax
pop ecx
pop ecx
jne 0x41b677
mov ebx, dword [esi]
test ebx, ebx
je 0x41b672
mov ecx, ebx
call fcn.00424686
push ebx
call fcn.004617e0
pop ecx
and dword [esi], 0
jmp 0x41b67d
lea eax, [edi + 1]
mov dword [ebp + 0x54], eax
inc edi
cmp edi, dword [ebp + 0x6c]
jl 0x41b633
mov esi, dword [ebp + 0x54]
test esi, esi
jle 0x41b699
mov ecx, dword [ebp + 0x5c]
push 0x64
call fcn.0040ac88
mov dword [ebp + 0x40], esi
jmp 0x41b61b
mov edi, dword [ebp + 0x30]
xor esi, esi
cmp edi, esi
je 0x41b6f6
cmp word [edi], si
je 0x41b6f6
cmp dword [ebp + 0x68], esi
jne 0x41b6ba
cmp dword [ebp + 0x58], esi
je 0x41b6ba
push dword [ebp + 0x48]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp + 0x5c]
push esi
push esi
push esi
push edi
call fcn.0041e84e
lea ecx, [ebp + 0x38]
mov esi, eax
call fcn.00442c3f
lea ecx, [ebp + 0x48]
call fcn.00424686
lea ecx, [ebp + 0x60]
call fcn.00424686
lea ecx, [ebp + 0x58]
call fcn.00402905
mov ecx, dword [ebp + 0x5c]
push 0
call fcn.0044c8fd
mov eax, esi
jmp 0x41b718
lea ecx, [ebp + 0x38]
call fcn.00442c3f
lea ecx, [ebp + 0x48]
call fcn.00424686
lea ecx, [ebp + 0x60]
call fcn.00424686
lea ecx, [ebp + 0x58]
call fcn.00402905
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4