Function at 0x43bca0
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cc5b
mov eax, dword fs:[0]
push eax
sub esp, 0x67c
mov eax, dword [0x4cf06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x634], edi
mov esi, dword [ebp + 0xc]
movzx ecx, si
mov dword [ebp - 0x630], edi
mov eax, ecx
cmp ecx, 0x7533
ja 0x43c19a
je 0x43c0bd
cmp ecx, 0xbb8
ja 0x43bdc4
je 0x43bd4d
sub eax, 1
je case.0x43bded.3075
sub eax, 1
je 0x43c0bd
lea eax, [esi - 0x1388]
mov edx, 0x3e7
cmp ax, dx
ja 0x43c70f
add ecx, 0xffffec78
cmp ecx, dword [edi + 0x1ac8]
jge case.0x43bded.3046
push ecx
mov ecx, edi
call fcn.00439ec0
mov eax, 1
jmp 0x43c9d9
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x43bd76
push 0xbe6
lea ecx, [ebp - 0x630]
call fcn.0043cba0
mov eax, 1
jmp 0x43c9d9
cmp dword [edi + 0x1a44], 0
mov ecx, 0x1f
mov eax, 0x3f
cmovne eax, ecx
mov ecx, 3
push eax
call fcn.0045a590
push eax
mov edx, 0xbe6
mov ecx, edi
call fcn.004441e0
add esp, 8
test eax, eax
je case.0x43bded.3046
push 1
lea ecx, [edi + 0x3984]
call fcn.004489f0
mov eax, 1
jmp 0x43c9d9
cmp ecx, 0xd3b
ja 0x43c055
je 0x43c029
sub eax, 0xbb9
cmp eax, 0x9a
ja case.0x43c1af.30005
movzx eax, byte [eax + 0x43ca28]
jmp dword [eax*4 + 0x43c9f8]
lea ecx, [edi + 0x80]
call fcn.004128d0
test eax, eax
jne 0x43be3e
cmp dword [edi + 0x232c], eax
jne 0x43be3e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0x2360]
cmp eax, 0x3e8
jbe case.0x43bded.3046
xor eax, eax
mov ecx, 0xc03
cmp si, cx
mov ecx, edi
sete al
inc eax
push eax
call fcn.00434ed0
mov eax, 1
jmp 0x43c9d9
mov ecx, edi
call fcn.004319e0
test eax, eax
je case.0x43bded.3046
mov dword [edi + 0x1c50], 0
mov eax, 1
jmp 0x43c9d9
xor eax, eax
mov ecx, edi
cmp dword [edi + 0x1c60], eax
push 0
sete al
mov dword [edi + 0x1c60], eax
call fcn.00437100
mov edx, 0xc09
mov eax, 0x3cd0
cmp si, dx
mov ecx, 0x3d38
cmovne eax, ecx
lea esi, [eax + edi]
test esi, esi
je case.0x43bded.3046
cmp dword [edi + 0x1c60], 0
je 0x43bea4
mov eax, dword [edi + 0x1bf0]
jmp 0x43beaa
mov eax, dword [edi + 0x1bec]
push eax
push 1
push 0xf7
mov ecx, esi
call fcn.00464740
mov ecx, dword [edi + 0x1c60]
neg ecx
push 0
sbb ecx, ecx
push 0
add ecx, 0x3b
call fcn.0045a590
push eax
mov ecx, esi
call fcn.00465420
mov eax, 1
jmp 0x43c9d9
mov eax, dword [edi + 0x36ec]
lea ecx, [edi + 0x36ec]
push 0
mov dword [edi + 0x3770], 0xca
call dword [eax + 0x208]
mov eax, 1
jmp 0x43c9d9
mov ax, word [ebp + 8]
cmp ax, 7
jne 0x43bf27
push ecx
push 0
mov ecx, edi
call fcn.0043e440
mov eax, 1
jmp 0x43c9d9
cmp ax, 8
jne case.0x43bded.3046
push 0
push ecx
push 0x806a
mov ecx, edi
call fcn.004646e0
mov eax, 1
jmp 0x43c9d9
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x43bf73
push 0xbbb
lea ecx, [ebp - 0x630]
call fcn.0043cba0
mov eax, 1
jmp 0x43c9d9
push 4
mov ecx, 4
call fcn.0045a590
push eax
mov edx, 0xbbb
mov ecx, edi
call fcn.004441e0
add esp, 8
mov eax, 1
jmp 0x43c9d9
mov ax, word [ebp + 8]
cmp ax, 7
jne 0x43bfb7
push ecx
push 0
mov ecx, edi
call fcn.0043e4d0
mov eax, 1
jmp 0x43c9d9
cmp ax, 8
jne case.0x43bded.3046
push 0
push ecx
push 0x806b
mov ecx, edi
call fcn.004646e0
mov eax, 1
jmp 0x43c9d9
push 0x64
push dword [edi + 0x54]
mov dword [edi + 0x232c], 0
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 1
lea ecx, [edi + 0x80]
call fcn.00430090
mov ecx, edi
call fcn.00435eb0
mov eax, 1
jmp 0x43c9d9
push 0
mov ecx, edi
call fcn.004333a0
mov eax, 1
jmp 0x43c9d9
push str.usage
jmp 0x43c02e
push 0x4b9220
mov ecx, 0x37
call fcn.0045a590
mov esi, eax
call fcn.0045bfb0
mov edx, esi
mov ecx, eax
call fcn.00458100
add esp, 4
mov eax, 1
jmp 0x43c9d9
sub eax, 0xd4d
cmp eax, 0x2e
ja case.0x43c1af.30005
movzx eax, byte [eax + 0x43cad4]
jmp dword [eax*4 + 0x43cac4]
mov ecx, edi
call fcn.0043b9c0
mov eax, 1
jmp 0x43c9d9
mov ecx, edi
call fcn.004322c0
mov eax, 1
jmp 0x43c9d9
xor eax, eax
mov ecx, 0xd7a
cmp si, cx
lea ecx, [edi + 0x3f40]
setne al
lea eax, [eax*2 + 0xbf9]
push eax
call fcn.00448b20
mov eax, 1
jmp 0x43c9d9
cmp dword [edi + 0x5c], 0
jne 0x43c190
cmp dword [edi + 0xeec], 0
jne 0x43c0eb
cmp dword [edi + 0xef0], 0
jne 0x43c0eb
push ecx
mov ecx, edi
call fcn.004661a0
mov eax, 1
jmp 0x43c9d9
cmp dword [edi + 0x1074], 0
je 0x43c17f
cmp dword [edi + 0x22cc], 0
je 0x43c120
push str.force_terminated
mov ecx, edi
call fcn.0043ff20
push 2
mov ecx, edi
call fcn.004661a0
mov eax, 1
jmp 0x43c9d9
push edi
lea ecx, [ebp - 0xa0]
call fcn.00447e10
mov edi, eax
mov dword [ebp - 4], 0
mov esi, dword [edi]
push 1
call fcn.00458e70
push eax
mov ecx, 0x3e
call fcn.0045a590
push eax
mov eax, dword [esi + 0x21c]
mov ecx, edi
call eax
lea ecx, [ebp - 0xa0]
mov esi, eax
call fcn.00447ec0
cmp esi, 1
jne 0x43c190
mov ecx, dword [ebp + 0xc]
movzx eax, cx
mov ecx, dword [ebp - 0x634]
push eax
call fcn.004661a0
mov eax, esi
jmp 0x43c9d9
mov ecx, edi
call fcn.004319e0
mov dword [edi + 0x1c50], 1
mov eax, 1
jmp 0x43c9d9
sub eax, 0x7534
cmp eax, 0x31
ja case.0x43c1af.30005
movzx eax, byte [eax + 0x43cb68]
jmp dword [eax*4 + 0x43cb04]
mov ecx, dword [edi + 0x1a14]
xor eax, eax
test ecx, ecx
push 0x13
sete al
neg ecx
push 0
push 0
push 0
sbb ecx, ecx
mov dword [edi + 0x1a14], eax
dec ecx
push 0
push ecx
mov ecx, edi
call fcn.00464820
mov ecx, edi
call fcn.0043a2a0
jmp 0x43c9d7
mov ecx, dword [edi + 0x1ab8]
call fcn.0045b890
mov eax, 1
jmp 0x43c9d9
lea eax, [edi + 0x1c88]
mov dword [ebp - 0x668], 0
xorps xmm0, xmm0
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x670]
mov dword [ebp - 0x658], 0
push eax
movlpd qword [ebp - 0x650], xmm0
movlpd qword [ebp - 0x648], xmm0
movlpd qword [ebp - 0x640], xmm0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x670], 0x3c
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x654], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, 1
jmp 0x43c9d9
cmp word [edi + 0x1e90], 0
lea esi, [edi + 0x1e90]
je 0x43c2dc
lea ecx, [edi + 0x80]
call fcn.004128d0
test eax, eax
je 0x43c2dc
push dword [edi + 0x2614]
mov byte [ebp - 0x629], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, edi
call fcn.0043fbd0
push dword [edi + 0x2614]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp - 0x629]
jmp 0x43c2de
xor al, al
mov dword [ebp - 0x668], 0
xorps xmm0, xmm0
mov dword [ebp - 0x658], 0
movlpd qword [ebp - 0x650], xmm0
movlpd qword [ebp - 0x648], xmm0
movlpd qword [ebp - 0x640], xmm0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x670], 0x3c
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x664], 0
test al, al
je 0x43c341
mov dword [ebp - 0x660], esi
jmp 0x43c34d
lea eax, [edi + 0x2098]
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x670]
mov dword [ebp - 0x65c], 0
push eax
mov dword [ebp - 0x654], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, 1
jmp 0x43c9d9
cmp dword [edi + 0x1ae4], 0xffffd8f0
jne 0x43c3bd
cmp dword [edi + 0x1ae8], 0xffffd8f0
jne 0x43c3bd
lea esi, [edi + 0x10]
mov ecx, edi
push esi
call fcn.004647e0
mov eax, dword [esi]
mov ecx, edi
mov dword [edi + 0x1ae4], eax
mov eax, dword [edi + 0x14]
mov dword [edi + 0x1ae8], eax
call fcn.0043a2a0
mov eax, 1
jmp 0x43c9d9
mov ecx, edi
mov dword [edi + 0x1ae8], 0xffffd8f0
mov dword [edi + 0x1ae4], 0xffffd8f0
call fcn.0043a2a0
mov eax, 1
jmp 0x43c9d9
cmp dword [edi + 0x1aec], 0xffffd8f0
jne 0x43c469
cmp dword [edi + 0x1af0], 0xffffd8f0
jne 0x43c469
lea esi, [edi + 0x10]
mov ecx, edi
push esi
call fcn.004647e0
mov eax, dword [esi + 8]
sub eax, dword [edi + 0x28]
sub eax, dword [esi]
add eax, dword [edi + 0x20]
cmp dword [edi + 0x2324], 0
mov dword [edi + 0x1aec], eax
je 0x43c444
mov eax, dword [edi + 0x1c]
sub eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x2314]
sub eax, ecx
mov ecx, edi
mov dword [edi + 0x1af0], eax
call fcn.0043a2a0
mov eax, 1
jmp 0x43c9d9
mov eax, dword [edi + 0x1c]
sub eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x2318]
sub eax, ecx
mov ecx, edi
mov dword [edi + 0x1af0], eax
call fcn.0043a2a0
mov eax, 1
jmp 0x43c9d9
mov ecx, edi
mov dword [edi + 0x1af0], 0xffffd8f0
mov dword [edi + 0x1aec], 0xffffd8f0
call fcn.0043a2a0
mov eax, 1
jmp 0x43c9d9
mov eax, dword [edi + 0x36ec]
lea ecx, [edi + 0x36ec]
push 0
call dword [eax + 0x208]
mov ecx, edi
call fcn.00437d40
mov ecx, edi
call fcn.004395e0
mov eax, 1
jmp 0x43c9d9
mov ecx, edi
call fcn.004317e0
mov eax, 1
jmp 0x43c9d9
xor eax, eax
mov ecx, edi
mov word [edi + 0x1b54], ax
push 1
mov dword [edi + 0x1b94], eax
call fcn.004315a0
mov ecx, edi
call fcn.0043a2a0
mov eax, 1
jmp 0x43c9d9
xor eax, eax
mov ecx, edi
cmp dword [edi + 0x22c4], eax
sete al
mov dword [edi + 0x22c4], eax
call fcn.00433290
mov eax, 1
jmp 0x43c9d9
mov eax, dword [edi + 0x3670]
lea ecx, [edi + 0x3670]
push 0
call dword [eax + 0x208]
mov eax, 1
jmp 0x43c9d9
mov ecx, 0x35
push 5
push 0
push 0
call fcn.0045a590
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
jmp 0x43c9d9
mov ecx, 0x36
jmp 0x43c539
lea eax, [ecx - 0x7540]
mov ecx, edi
mov dword [edi + 0x1c70], eax
call fcn.00439a20
jmp 0x43c9d7
mov eax, dword [edi + 0x1c70]
xor edx, edx
inc eax
mov ecx, 3
div ecx
mov ecx, edi
mov dword [edi + 0x1c70], edx
call fcn.00439a20
jmp 0x43c9d7
mov eax, dword [edi + 0x387c]
lea ecx, [edi + 0x387c]
push 0
call dword [eax + 0x208]
mov ecx, edi
call fcn.00439a20
jmp 0x43c4a2
push 0
mov ecx, edi
call fcn.00431f10
mov eax, 1
jmp 0x43c9d9
lea ecx, [edi + 0x80]
call fcn.004128d0
test eax, eax
jne 0x43c9d7
push eax
mov ecx, edi
call fcn.00437260
jmp 0x43c9d7
push 0
jmp 0x43c02e
lea ecx, [edi + 0x37f0]
call fcn.0042ec90
xor ecx, ecx
cmp dword [edi + 0x14f8], 1
sete cl
call fcn.00458da0
mov ecx, edi
call fcn.004395e0
mov ecx, edi
call fcn.00437d40
mov eax, 1
jmp 0x43c9d9
mov eax, dword [edi + 0x3900]
lea ecx, [edi + 0x3900]
push 0
call dword [eax + 0x208]
mov eax, dword [edi + 0x1bfc]
xor ecx, ecx
cmp eax, dword [edi + 0x1ad0]
cmovge eax, ecx
mov ecx, edi
push eax
call fcn.0043a280
mov eax, 1
jmp 0x43c9d9
push 0
mov ecx, edi
call fcn.004424e0
mov eax, 1
jmp 0x43c9d9
push 5
push 0
push 0
push 0x4b9244
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
jmp 0x43c9d9
push 0x40
lea eax, [ebp - 0x674]
mov dword [ebp - 0x678], 0x44
push 0
push eax
call fcn.00481280
add esp, 0xc
lea eax, [ebp - 0x688]
xorps xmm0, xmm0
movups xmmword [ebp - 0x688], xmm0
push eax
lea eax, [ebp - 0x678]
push eax
call fcn.0045bfb0
push eax
push 0
push 0x8000000
push 0
push 0
push 0
call fcn.0045bdc0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x43c9d7
push dword [ebp - 0x684]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x688]
call esi
mov eax, 1
jmp 0x43c9d9
lea eax, [esi - 0x1b58]
cmp ax, dx
ja 0x43c732
lea eax, [ecx - 0x1b58]
mov ecx, edi
push eax
call fcn.0043a280
mov eax, 1
jmp 0x43c9d9
lea eax, [esi - 0x1f40]
mov edx, 0x3e6
cmp ax, dx
ja 0x43c755
lea eax, [ecx - 0x1f40]
mov ecx, edi
push eax
call fcn.004324c0
jmp 0x43c9d7
mov eax, 0x2327
cmp si, ax
jne 0x43c76b
mov ecx, edi
call fcn.00432650
jmp 0x43c9d7
mov eax, 0x2328
cmp si, ax
jne 0x43c7b0
mov edx, dword [edi + 0x1ab8]
lea ecx, [ebp - 0x420]
push 0x104
push 0x4b9278
call fcn.0045c480
add esp, 8
lea eax, [ebp - 0x420]
push 1
push 0
push 0
push eax
push 0
push dword [edi + 0x54]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x43c9d7
lea eax, [esi - 0x2329]
cmp ax, 0x62
ja 0x43c88a
push 4
push 0
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_GetMenu]
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call esi
push eax
call esi
mov edx, eax
test edx, edx
je 0x43c9d7
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x218]
push 0
push 0x104
push eax
movzx eax, cx
push eax
push edx
call dword [sym.imp.USER32.dll_GetMenuStringW]
test eax, eax
jle 0x43c9d7
lea eax, [ebp - 0x218]
push eax
lea eax, [edi + 0x1e90]
push eax
call fcn.0047f21b
add esp, 8
test eax, eax
je 0x43c836
push 0
push 0x754f
push 0
mov ecx, edi
call fcn.0043bca0
jmp 0x43c9d7
mov edx, dword [edi + 0x1ab8]
lea ecx, [ebp - 0x628]
push 0x104
push 0x4b9270
call fcn.0045c480
lea eax, [ebp - 0x218]
xor edx, edx
push 0x104
push eax
lea ecx, [ebp - 0x628]
call fcn.0045c480
add esp, 0x10
lea eax, [ebp - 0x628]
push 1
push 0
push 0
push eax
push 0
push dword [edi + 0x54]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x43c9d7
lea eax, [esi - 0x238c]
cmp ax, 0x63
ja 0x43c9d7
mov eax, dword [edi + 0x1bf8]
lea edx, [ecx - 0x238c]
lea ecx, [edx + edx*4]
cmp dword [eax + ecx*4], 0x1f
lea eax, [eax + ecx*4]
mov ecx, edi
jne 0x43c8d4
push 0
push 0xd76
push 0x111
mov dword [edi + 0x2330], 1
call fcn.004646e0
jmp 0x43c9d7
mov dword [edi + 0x2330], 0
cmp dword [eax], 0x20
jne 0x43c8f9
push 0
push 0xd6
push 0x807e
call fcn.004646e0
jmp 0x43c9d7
mov dword [edi + 0x1c10], edx
call fcn.00433260
mov ecx, edi
call fcn.00433240
cmp eax, 6
jne 0x43c93a
cmp dword [edi + 0x1c7c], 0
je 0x43c93a
mov eax, dword [edi + 0x3984]
lea ecx, [edi + 0x3984]
push 0x4b9284
call dword [eax + 0x178]
mov dword [edi + 0x1c7c], 0
mov ecx, edi
call fcn.00433240
cmp eax, 0xa
jne 0x43c963
lea esi, [edi + 0x3984]
mov ecx, 0x4b5
mov edi, dword [esi]
call fcn.0045a590
push eax
mov ecx, esi
call dword [edi + 0x178]
jmp 0x43c9d7
cmp dword [edi + 0x1a34], 0
je 0x43c9d7
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00481280
mov eax, dword [edi + 0x3984]
lea ecx, [ebp - 0x420]
add esp, 0xc
mov eax, dword [eax + 0x170]
push 0x104
push ecx
lea ecx, [edi + 0x3984]
call eax
test eax, eax
jle 0x43c9d7
push 2
lea eax, [ebp - 0x420]
push 0x4b928c
push eax
call fcn.0048b2ca
add esp, 0xc
test eax, eax
jne 0x43c9d7
mov eax, dword [edi + 0x3984]
lea ecx, [edi + 0x3984]
push 0x4b9288
call dword [eax + 0x178]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret 0xc