Function at 0x401000
Capabilities:
Accept command line arguments
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Find taskbar
Get graphical window text
Log keystrokes via polling
Register raw input devices
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edi, ax
shr edi, 0xd
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0x22
jne 0x401028
inc esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov al, byte [esi]
cmp al, bl
je 0x401325
inc esi
cmp al, 0x2e
jne 0x40102d
mov eax, dword [esi]
and eax, 0xdddfdfdf
cmp eax, 0x455845
jne 0x40102d
push ebx
push 0x406018
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x40109c
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x401084
mov al, byte [esi]
cmp al, bl
je 0x401325
inc esi
cmp al, 0x2f
jne 0x40106d
mov al, byte [esi]
or al, 0x20
cmp al, 0x6d
jne 0x40106d
xor edi, 6
push edi
push ebx
push 0x8010
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x401325
push ebx
call sub.IMM32.dll_ImmDisableIME
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4010e8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessDPIAware
push eax
call edi
cmp eax, ebx
je 0x4010c8
call eax
push str.ChangeWindowMessageFilter
push dword [ebp - 0xc]
call edi
cmp eax, ebx
je 0x4010df
push 1
push 0x8010
call eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 8], ebx
mov al, byte [esi]
cmp al, bl
je 0x40111a
cmp al, 0x22
jne 0x4010f9
mov byte [esi], bl
jmp 0x401115
cmp al, 0x5c
jne 0x401107
cmp byte [esi + 1], al
jne 0x401107
cmp byte [esi - 1], bl
jg 0x40110d
cmp byte [esi + 1], 0x3a
jne 0x401115
cmp dword [ebp - 8], ebx
jne 0x401118
mov dword [ebp - 8], esi
inc esi
jmp 0x4010eb
mov byte [esi], bl
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0x66
push edi
mov dword [ebp - 0x50], 0x20
mov dword [ebp - 0x4c], fcn.0040132f
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], edi
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x406014], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
mov esi, 0x406018
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
call dword [sym.imp.USER32.dll_RegisterClassA]
push ebx
push edi
push ebx
push ebx
push 0x20
push 0x7e
push ebx
push ebx
push 0x80000000
push ebx
push esi
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x401325
push eax
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push 0xffffffffffffffff
push ebx
mov dword [0x4069b4], eax
call fcn.00404565
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
add esp, 0xc
push 0x6b
push edi
call esi
push 0x7f00
push ebx
mov dword [0x40699c], eax
call esi
push 6
push ebx
mov dword [0x406998], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x65
push edi
call dword [sym.imp.USER32.dll_LoadMenuA]
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push ebx
push eax
mov dword [ebp - 0x10], eax
call esi
push 0x10
push eax
mov dword [0x406cd0], eax
call esi
push 1
mov dword [0x406ccc], eax
pop edi
push edi
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 8], ebx
mov dword [0x406cd4], eax
je 0x401212
push ebx
push dword [ebp - 8]
call fcn.00402b6a
pop ecx
test eax, eax
pop ecx
jge 0x401226
mov eax, dword [ebp - 0x14]
push edi
push dword [ebp - 0x18]
mov dword [eax], 0x667762
call fcn.00402b6a
pop ecx
pop ecx
mov esi, dword [ebp - 0xc]
push 0xc
lea eax, [ebp - 0x50]
push edi
push eax
mov word [ebp - 0x50], di
mov word [ebp - 0x4e], 2
mov dword [ebp - 0x4c], 0x100
mov dword [ebp - 0x48], esi
mov dword [0x406004], esi
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x401267
push ebx
push 0x40607a
call fcn.00402ff2
pop ecx
pop ecx
push ebx
push ebx
push 0x10
jmp 0x401294
test byte [0x406c98], 1
jne 0x401275
push 4
pop eax
jmp 0x401278
mov eax, dword [ebp - 4]
and dword [0x406c98], 0xfffffffe
xor eax, 0x8024
push 0xca
push ebx
mov dword [0x406cac], eax
push 0x800d
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x50]
push ebx
push eax
call edi
test eax, eax
je 0x40130a
mov esi, dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [ebp - 0x4c], 0x800c
jb 0x4012f7
cmp dword [ebp - 0x50], ebx
jne 0x4012c8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], ebx
push 1
push 0x7fff
push ebx
lea eax, [ebp - 0x34]
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4012f7
cmp dword [ebp - 0x30], 0x12
je 0x40130a
lea eax, [ebp - 0x34]
push eax
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jbe 0x4012cb
lea eax, [ebp - 0x50]
push eax
call esi
push ebx
push ebx
lea eax, [ebp - 0x50]
push ebx
push eax
call edi
test eax, eax
jne 0x4012b4
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyMenu]
push dword [0x4069b8]
call dword [sym.imp.GDI32.dll_DeleteObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]