Function at 0x443cf0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x4a9110
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea eax, [esp + 0x18]
push 0xb
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x44], 0
call fcn.0048801f
mov eax, dword [eax]
mov byte [esp + 0x3c], 1
mov esi, 0x4d5164
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443d5a
test cl, cl
je 0x443d56
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443d5a
add eax, 2
add esi, 2
test cl, cl
jne 0x443d32
xor eax, eax
jmp 0x443d5f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x443e13
lea eax, [esp + 0x10]
push 9
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.vbscript:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443da6
test cl, cl
je 0x443da2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443da6
add eax, 2
add esi, 2
test cl, cl
jne 0x443d7e
xor eax, eax
jmp 0x443dab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x443e13
lea eax, [esp + 0x14]
push 7
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov esi, 0x4d5150
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443dfc
test cl, cl
je 0x443df8
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443dfc
add eax, 2
add esi, 2
test cl, cl
jne 0x443dd4
xor eax, eax
jmp 0x443e01
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0048fb71
test bl, bl
je 0x443e15
mov bl, 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 0
call fcn.0048fb71
test bl, bl
je 0x443e3d
push 0xffffffffffffffff
push 0
push 0xef96
call fcn.00412c60
add esp, 0xc
jmp 0x4442de
push 0x2e
lea ecx, [esp + 0x48]
call fcn.00490038
test eax, eax
jg 0x443ee9
push 0x2f
lea ecx, [esp + 0x48]
call fcn.00490038
test eax, eax
jg 0x443ee9
push 0x5c
lea ecx, [esp + 0x48]
call fcn.00490038
test eax, eax
jge 0x443ee9
lea eax, [esp + 0x18]
push 2
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov esi, 0x4d6188
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443eb1
test cl, cl
je 0x443ead
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443eb1
add eax, 2
add esi, 2
test cl, cl
jne 0x443e89
xor eax, eax
jmp 0x443eb6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x443ee9
mov ecx, dword [esp + 0x44]
cmp byte [ecx + 1], 0x3a
jne 0x444242
mov al, byte [ecx + 2]
cmp al, 0x5c
je 0x443ee9
cmp al, 0x2f
je 0x443ee9
test al, al
jne 0x444242
push 0x40
lea ecx, [esp + 0x48]
call fcn.00490038
test eax, eax
jle 0x4442a9
lea eax, [esp + 0x2c]
push 7
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov byte [esp + 0x3c], 2
mov esi, str.http:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443f40
test cl, cl
je 0x443f3c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443f40
add eax, 2
add esi, 2
test cl, cl
jne 0x443f18
xor eax, eax
jmp 0x443f45
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44422a
lea eax, [esp + 0x18]
push 7
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.file:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443f8c
test cl, cl
je 0x443f88
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443f8c
add eax, 2
add esi, 2
test cl, cl
jne 0x443f64
xor eax, eax
jmp 0x443f91
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x44422a
lea eax, [esp + 0x14]
push 8
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.https:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443fe6
test cl, cl
je 0x443fe2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443fe6
add eax, 2
add esi, 2
test cl, cl
jne 0x443fbe
xor eax, eax
jmp 0x443feb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x44422a
lea eax, [esp + 0x10]
push 7
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.file:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444040
test cl, cl
je 0x44403c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444040
add eax, 2
add esi, 2
test cl, cl
jne 0x444018
xor eax, eax
jmp 0x444045
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x44422a
lea eax, [esp + 0x1c]
push 4
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.www.
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44409a
test cl, cl
je 0x444096
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44409a
add eax, 2
add esi, 2
test cl, cl
jne 0x444072
xor eax, eax
jmp 0x44409f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x1c]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x44422a
lea eax, [esp + 0x24]
push 6
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov byte [esp + 0x3c], 3
mov esi, str.ftp:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4440f9
test cl, cl
je 0x4440f5
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4440f9
add eax, 2
add esi, 2
test cl, cl
jne 0x4440d1
xor eax, eax
jmp 0x4440fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x444158
lea eax, [esp + 0x20]
push 4
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.ftp.
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444141
test cl, cl
je 0x44413d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444141
add eax, 2
add esi, 2
test cl, cl
jne 0x444119
xor eax, eax
jmp 0x444146
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x20]
sete bl
call fcn.0048fb71
test bl, bl
je 0x44415a
mov bl, 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 2
call fcn.0048fb71
test bl, bl
jne 0x44422a
lea eax, [esp + 0x28]
push 6
push eax
lea ecx, [esp + 0x4c]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.res:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4441af
test cl, cl
je 0x4441ab
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4441af
add eax, 2
add esi, 2
test cl, cl
jne 0x444187
xor eax, eax
jmp 0x4441b4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x28]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x44422a
mov edi, dword [esp + 0x44]
mov esi, str.about:blank
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4441f9
test cl, cl
je 0x4441f5
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4441f9
add eax, 2
add esi, 2
test cl, cl
jne 0x4441d1
xor eax, eax
jmp 0x4441fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x44422a
cmp byte [edi + 1], 0x3a
jne 0x444226
mov al, byte [edi + 2]
cmp al, 0x5c
je 0x44422a
cmp al, 0x2f
sete cl
test cl, cl
jne 0x44422a
test al, al
sete al
test al, al
jne 0x44422a
mov bl, 1
jmp 0x44422c
xor bl, bl
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 0
call fcn.0048fb71
test bl, bl
je 0x4442a9
mov ecx, dword [esp + 0x44]
mov eax, dword [ecx - 8]
test eax, eax
je 0x4442de
mov eax, dword [ebp + 0xbb4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
mov eax, dword [eax + 0x1c]
push 0x407
push eax
call esi
push eax
call fcn.0048c2a9
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, eax
call fcn.0048f12d
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
push 0
test ax, ax
mov eax, dword [ebp + 0x1c]
push 0xef1c
setge dl
dec edx
push 0x111
and edx, 3
push eax
inc edx
mov dword [ebp + 0x1ec], edx
call esi
jmp 0x4442de
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.0048f8e6
push 0
mov ecx, ebp
call fcn.00444790
test eax, eax
jne 0x4442de
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push eax
push 0
push ecx
push 2
push 1
mov ecx, ebp
call fcn.00427110
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0048fb71
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret 8