Function at 0x4239b0
Capabilities:
Log keystrokes via polling
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f2f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4ac084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x423a88
push 0x2011f
push str.SOFTWAREEssentwarePckeeper
push SysReAllocString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.00402f70
mov esi, dword [ebp - 0x1c]
test eax, eax
jne 0x423a40
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push 4
push 0
push str.UPDATED
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x423a40
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [0x4b0490], 0
je 0x423a50
mov eax, 1
jmp 0x423a5e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xe
and eax, 2
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
test esi, esi
je 0x423c0f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00403450
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x423aa4
push 0x80004005
call fcn.004039a0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp dword [edi + 0x48], 0
je 0x423ad1
push 0x40
push 0x83
mov ecx, edi
call fcn.00424110
jmp 0x423bf0
cmp dword [0x4b04a8], 0
jne 0x423af1
push 0x44
push 0x89
mov ecx, edi
call fcn.00424110
cmp eax, 6
jne 0x423bf0
push ecx
mov ecx, dword [edi + 0x3c]
mov dword [edi + 0x48], 1
call fcn.0042d1f0
cmp dword [0x4b049c], 0
je 0x423b53
cmp dword [0x4b04a4], 0
je 0x423b53
mov edx, reloc.OLEAUT32.dll_SysReAllocString
push str.SOFTWAREKromtech
push str.SOFTWAREEssentware
mov ecx, edx
call fcn.00446030
mov edx, SysReAllocString
push str.SOFTWAREKromtech
push str.SOFTWAREEssentware
mov ecx, edx
call fcn.00446030
add esp, 0x10
mov edx, 0x4937dc
mov ecx, 0x4907c0
call fcn.00446460
jmp 0x423bb5
push 0
push 0x4ad280
push 0x4ace60
push 0
push dword [edi + 0x50]
call fcn.0047c9ad
add esp, 0x14
test eax, eax
je 0x423b77
push str.InstallCancelPageZeoSpaceBckp
jmp 0x423bad
push 0
push 0x4ace7c
push 0x4ace60
push 0
push dword [edi + 0x50]
call fcn.0047c9ad
add esp, 0x14
test eax, eax
je 0x423b9b
push str.InstallCancelPageZoomDiagnosticsPC
jmp 0x423bad
cmp dword [edi + 0x40], 0
jne 0x423ba8
push str.InstallCancelPage1
jmp 0x423bad
push str.InstallCancel
call fcn.0040c350
add esp, 4
cmp dword [edi + 0x40], 0
je 0x423be5
push 0x3f0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x83
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0041f100
mov esi, dword [ebp - 0x10]
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x423bf0
push 0xc
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x423c0f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret