Function at 0x402160
Capabilities:
Create process on windows
Log keystrokes via polling
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x407ebe
push eax
mov dword fs:[0], esp
sub esp, 0x83c
push esi
push edi
mov esi, ecx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4021c3
push 0x409538
push str.changevm.log
call fcn.00402ab4
mov edi, eax
add esp, 8
test edi, edi
je 0x4021b8
push str.changed
push edi
call fcn.00402cb8
push edi
call fcn.00402a3e
add esp, 0xc
mov dword [esp + 0x84c], 0xffffffff
push 8
call fcn.0040265b
mov edi, eax
mov eax, dword [esi + 4]
push edi
mov dword [edi], eax
mov dword [edi + 4], 0
call dword [sym.imp.directx.dll_struct_DxControl____cdecl_DX_createDx6Control_struct_DxSetup__]
push edi
mov dword [esi + 0x10], eax
call fcn.00402650
call fcn.00401f80
push 0x18
call fcn.0040265b
add esp, 0x10
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x84c], 2
je 0x402217
mov ecx, dword [esi + 0x10]
push ecx
mov ecx, eax
call fcn.004012d0
jmp 0x402219
xor eax, eax
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], eax
mov dword [esp + 0x84c], 0xffffffff
mov edx, dword [ecx]
call dword [edx + 0xd4]
test al, al
jne 0x40225b
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0xc]
call fcn.004015e0
test al, al
jne 0x40225b
push 0x64
call edi
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x40223c
mov ecx, dword [esi + 0xc]
push ebx
push ebp
mov byte [esp + 0x12], 0
call fcn.004015a0
test al, al
je 0x4022ad
push str.errorvm
mov ecx, esi
call fcn.00402610
push 0x41004
push 0
push str.You_dont_have_Java_installed_on_your_computer._nYou_probably_have_Windows_XP_that_does_not_include_Java_by_default._n_nDo_you_want_to_download_and_install_it_now_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40251e
mov ecx, dword [esi + 0x10]
push 1
push 0
push str._top
push str.http:__www.alwaysneat.com_javaupdate1.html
jmp 0x40250d
mov ecx, dword [esi + 0xc]
call fcn.004015c0
test al, al
jne 0x402307
push str.errorjava2
mov ecx, esi
mov byte [esp + 0x16], 1
call fcn.00402610
push 0x41004
push 0
push str.There_is_an_outdated_Java_installed_on_your_computer._A_recent_one_is_required_to_nget_our_Java_games_to_work._Do_you_want_to_update_it_now_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40251e
mov ecx, dword [esi + 0x10]
push 1
push 0
push str._top
mov eax, dword [ecx]
push str.http:__www.alwaysneat.com_javaupdate2.html
push 0
call dword [eax + 0xd0]
jmp 0x402517
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x134]
mov ebp, eax
test ebp, ebp
je 0x4024f1
call fcn.00401fa0
xor ecx, ecx
push ebp
test al, al
setne cl
push ecx
lea edx, [esp + 0x74]
push str.error:__jdk11:_ld___s
push edx
mov byte [esp + 0x23], al
call fcn.00402ac7
lea edi, [esp + 0x7c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x1f4
mov dword [esp + 0x14], ecx
jle 0x402366
mov dword [esp + 0x14], 0x1f4
mov ecx, dword [esp + 0x14]
lea edi, [esp + ecx + 0x6c]
push 0x4090b0
push str.error.log
mov byte [edi], 0
call fcn.00402ab4
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4023be
push ebx
push 0x5dc
push 1
push edi
call fcn.00402bd0
push ebx
mov edi, eax
call fcn.00402a3e
add esp, 0x14
test edi, edi
jge 0x4023a6
xor edi, edi
jmp 0x4023b3
cmp edi, 0x5dc
jle 0x4023b3
mov edi, 0x5dc
mov eax, dword [esp + 0x14]
add edi, eax
mov byte [esp + edi + 0x6c], 0
mov al, byte [esp + 0x13]
test al, al
je 0x402405
lea ecx, [esp + 0x6c]
push ecx
mov ecx, esi
call fcn.00402610
push 0x41004
push 0
push str.There_is_an_outdated_Java_installed_on_your_computer._A_recent_one_is_required_to_nget_our_Java_games_to_work._Do_you_want_to_update_it_now_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40251e
mov ecx, dword [esi + 0x10]
push 1
push 0
push str._top
push str.http:__www.alwaysneat.com_javaupdate2.html
jmp 0x40250d
lea eax, [esp + 0x6c]
mov ecx, esi
push eax
call fcn.00402610
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
or edx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4024df
cmp byte [eax + ebp], 0x23
jne 0x402430
mov edx, eax
inc eax
cmp eax, ecx
jl 0x402428
test edx, edx
jl 0x4024df
push 0x41004
push 0
push ebp
push 0
mov byte [edx + ebp], 0
lea ebx, [edx + ebp + 1]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40251e
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov edi, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.Explorer.exe
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 0xa]
push eax
call fcn.0040265b
push ebx
mov edi, eax
push str.Explorer.exe
push str._s__s
push edi
call fcn.00402ac7
add esp, 0x14
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x40251e
push 0x41000
push 0
push ebp
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40251e
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x148]
test eax, eax
je 0x40251e
mov ecx, dword [esi + 0x10]
push 1
push 0
push str._top
push eax
mov edx, dword [ecx]
push 0
call dword [edx + 0xd0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, dword [esi + 0xc]
pop ebp
test edi, edi
pop ebx
je 0x402537
mov ecx, edi
call fcn.00401320
push edi
call fcn.00402650
add esp, 4
mov al, byte [esp + 0xa]
mov dword [esi + 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_ExitProcess]
test al, al
je 0x402550
push 1
call esi
push 0
call esi
mov ecx, dword [esp + 0x844]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x848
ret 4