Function at 0x423980
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Log keystrokes via polling

Disassembly:
mov eax, 0x48e8
call fcn.0042ec50
sub rsp, rax
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rsp + 0x4908], rbx
mov qword [rsp + 0x48e0], rbp
mov qword [rsp + 0x48d8], rsi
mov qword [rsp + 0x48d0], rdi
mov qword [rsp + 0x48c8], r12
mov rax, qword [0x004583d0]
mov qword [rsp + 0x48b0], rax
mov rbx, r8
mov r12d, edx
xor edi, edi
mov dword [rsp + 0x18b0], edi
xor edx, edx
mov r8d, 0xffc
lea rcx, [rsp + 0x18b4]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x8b0], edi
xor edx, edx
mov r8d, 0xffc
lea rcx, [rsp + 0x8b4]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x38b0], edi
xor edx, edx
mov r8d, 0xffc
lea rcx, [rsp + 0x38b4]
call sub.msvcrt.dll_memset
test rbx, rbx
je 0x423a42
mov rdx, rbx
lea rcx, [rsp + 0x18b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rbx, [rsp + 0x18b0]
movzx eax, word [rsp + 0x18b0]
test ax, ax
je 0x423a6f
cmp ax, 0x20
je 0x423a63
cmp ax, 9
jne 0x423a6f
add rbx, 2
mov ax, word [rbx]
test ax, ax
jne 0x423a57
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
movsxd rcx, eax
lea rax, [rbx + rcx*2]
cmp rax, rbx
jbe 0x423aa1
movzx ecx, word [rax]
cmp cx, 0x20
je 0x423a95
cmp cx, 9
jne 0x423aa1
mov word [rax], di
sub rax, 2
cmp rax, rbx
ja 0x423a86
mov rdx, rbx
lea rcx, [rsp + 0x38b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rbx
lea rcx, [rsp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x423adc
xor eax, eax
jmp 0x423e8d
mov dword [rsp + 0x28b0], edi
xor edx, edx
mov r8d, 0xffc
lea rcx, [rsp + 0x28b4]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x8b0]
lea rcx, [rsp + 0x28b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x28b0]
call fcn.004235f0
lea rcx, [rsp + 0x28b0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x423b41
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x423b87
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x423b87
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov r11w, ax
shr r11d, 0xf
and r11d, 1
test r12d, r12d
cmovne r11d, r12d
lea rax, [0x00433b80]
test r11d, r11d
cmovne rdi, rax
xor r9d, r9d
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x28b0]
call fcn.004237b0
jmp 0x423e8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rbp, rdi
movsxd rcx, eax
cmp word [rbx], 0x22
jne 0x423bd2
mov edx, 1
mov rax, rdx
cmp rdx, rcx
jge 0x423bd2
nop
nop
cmp word [rbx + rax*2], 0x22
je 0x423bc3
inc edx
inc rax
cmp rax, rcx
jl 0x423bb0
jmp 0x423bd2
movsxd rax, edx
mov word [rbx + rax*2 + 2], di
lea rbp, [rbx + rax*2 + 4]
jmp 0x423bff
mov edx, edi
mov rax, rdi
test rcx, rcx
jle 0x423bff
nop
cmp word [rbx + rax*2], 0x20
je 0x423bf3
inc edx
inc rax
cmp rax, rcx
jl 0x423be0
jmp 0x423bff
movsxd rax, edx
lea rbp, [rbx + rax*2 + 2]
mov word [rbx + rax*2], di
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov si, ax
shr esi, 0xf
and esi, 1
test r12d, r12d
cmovne esi, r12d
mov rcx, rbp
call fcn.004235f0
lea rcx, [rsp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x423d07
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], WSAStartup
mov dword [rsp + 0x34], 0x200
lea rax, [rsp + 0x8b0]
mov qword [rsp + 0x48], rax
lea rax, str._UserProfile_
mov qword [rsp + 0x58], rax
mov dword [rsp + 0xb0], edi
xor edx, edx
mov r8d, 0x7fc
lea rcx, [rsp + 0xb4]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x8b0]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dx, 0x2e
lea rcx, [rsp + 0xb0]
call qword [sym.imp.msvcrt.dll_wcsrchr]
lea rcx, [rsp + 0xb0]
test rax, rax
cmove rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x50], rdi
lea rax, [0x00433b80]
test esi, esi
cmovne rdi, rax
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
jmp 0x423e8b
lea rcx, [rsp + 0x20]
call sub.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo
nop
mov byte [rsp + 0xa8], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xa9], WSAGetLastError
mov byte [rsp + 0xaa], 0x65
mov byte [rsp + 0xab], WSAGetLastError
mov byte [rsp + 0xac], WSAGetLastError
mov byte [rsp + 0xad], 0x3a
mov byte [rsp + 0xae], 0
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x20]
call sub.MFC42u.dll_AfxDaoTerm
mov rdx, rbx
lea rcx, [rsp + 0x28]
call sub.MFC42u.dll_CDaoException::CDaoException
nop
lea rcx, [rsp + 0x28]
call sub.MFC42u.dll_CWnd::OnDragList
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call sub.MFC42u.dll_CRichEditView::FindTextW
test eax, eax
jne 0x423e56
xor edx, edx
lea r8d, [rax + 0x70]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], WSAStartup
mov dword [rsp + 0x34], 0x200
lea rax, [rsp + 0x38b0]
mov qword [rsp + 0x48], rax
lea rax, str._UserProfile_
mov qword [rsp + 0x58], rax
mov dword [rsp + 0xb0], edi
xor edx, edx
mov r8d, 0x7fc
lea rcx, [rsp + 0xb4]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x38b0]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dx, 0x2e
lea rcx, [rsp + 0xb0]
call qword [sym.imp.msvcrt.dll_wcsrchr]
lea rcx, [rsp + 0xb0]
test rax, rax
cmove rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x50], rdi
lea rax, [0x00433b80]
test esi, esi
cmovne rdi, rax
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
jmp 0x423e76
lea rax, [0x00433b80]
test esi, esi
cmovne rdi, rax
xor r9d, r9d
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.004237b0
mov ebx, eax
lea rcx, [rsp + 0x28]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x20]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov eax, ebx
mov rcx, qword [rsp + 0x48b0]
call fcn.0042ec20
mov rbx, qword [rsp + 0x4908]
mov rbp, qword [rsp + 0x48e0]
mov rsi, qword [rsp + 0x48d8]
mov rdi, qword [rsp + 0x48d0]
mov r12, qword [rsp + 0x48c8]
add rsp, 0x48e8
ret