Function at 0x572904
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x572f1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xa], 1
lea eax, [ebp - 0x14]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00403d34
mov byte [ebp - 0xb], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
jne 0x572c1f
xor eax, eax
mov al, byte [ebp - 9]
imul eax, eax, 0x22
mov dl, byte [eax*8 + 0x5c12ee]
or dl, byte [0x5c1664]
je 0x572982
mov byte [ebp - 0xa], 0
jmp 0x572f01
mov byte [eax*8 + 0x5c12ee], 1
xor edx, edx
push ebp
push 0x572c18
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x5c12f0]
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x5bbab0]
call fcn.00405c9c
mov edx, dword [ebp - 0x1c]
mov ecx, 0x572f38
mov eax, dword [0x5c12b4]
call fcn.00489dc4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00403cf0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
call fcn.0046b1e4
mov edx, dword [ebp - 0x1c]
mov cl, 0x5f
mov eax, dword [ebp - 8]
call fcn.005913dc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00403f20
mov eax, dword [ebp - 4]
mov byte [0x5c1748], 0
push ebp
lea eax, [ebp - 0x18]
call fcn.00572618
pop ecx
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00403d34
mov eax, dword [ebp - 0x10]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
jne 0x572a9f
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004096a8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408a4c
mov eax, dword [ebp - 0x18]
mov edx, 0x572f4c
call fcn.00404028
je 0x572a9b
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004096a8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408a4c
mov eax, dword [ebp - 0x18]
mov edx, 0x572f5c
call fcn.00404028
je 0x572a9b
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004096a8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408a4c
mov eax, dword [ebp - 0x18]
mov edx, 0x572f6c
call fcn.00404028
jne 0x572a9f
mov byte [ebp - 0xb], 1
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x572ab8
lea eax, [ebp - 0x10]
mov edx, 0x572f7c
call fcn.00403d34
mov cl, 1
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.00564894
xor eax, eax
mov al, byte [ebp - 9]
imul eax, eax, 0x22
mov byte [eax*8 + 0x5c12d2], 1
mov byte [0x5c177c], 1
xor edx, edx
push ebp
push 0x572b10
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
mov edx, dword [edx]
push edx
push 1
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov edx, dword [eax*8 + 0x5c12bd]
mov eax, dword [ebp - 8]
call fcn.0058b538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x572b1e
mov byte [0x5c177c], 0
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00591794
xor eax, eax
mov dword [0x5c1764], eax
xor eax, eax
mov al, byte [ebp - 9]
imul eax, eax, 0x22
mov byte [eax*8 + 0x5c12d2], 0
xor ecx, ecx
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.00564894
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.005955e4
cmp byte [0x5c1749], 0
jbe 0x572ba2
mov dl, 0x14
mov eax, dword [ebp - 8]
call fcn.00596b8c
test al, al
je 0x572b97
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
je 0x572b97
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [0x5c1744]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x5c1749], 0
mov byte [ebp - 0xa], 0
cmp byte [ebp - 0xa], 0
jne 0x572bb2
call fcn.004037b0
jmp 0x572f01
xor eax, eax
mov al, byte [ebp - 9]
imul ebx, eax, 0x22
mov eax, dword [ebx*8 + 0x5c12bd]
cmp byte [eax + 0x1d0], 0
je 0x572bfa
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409670
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx*8 + 0x5c12bd]
mov cl, byte [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.0059b900
mov byte [ebp - 0xa], 0
call fcn.004037b0
jmp 0x572f01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x572c5a
xor eax, eax
mov al, byte [ebp - 9]
imul eax, eax, 0x22
mov byte [eax*8 + 0x5c12ee], 0
ret
lea eax, [ebp - 0x14]
mov edx, 0x572f94
call fcn.00403d34
push ebp
lea eax, [ebp - 0x18]
call fcn.00572618
pop ecx
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00403d34
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x572c5a
lea eax, [ebp - 0x10]
mov edx, 0x572f7c
call fcn.00403d34
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0046ad3c
test al, al
je 0x572f01
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
je 0x572f01
mov dl, 0x14
mov eax, dword [ebp - 8]
call fcn.00596b8c
test al, al
je 0x572cbb
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
je 0x572cbb
cmp byte [ebp + 0xc], 0
jne 0x572cbb
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [0x5c1744]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x10]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
jne 0x572d6f
cmp byte [ebp - 0xb], 0
jne 0x572d6f
cmp byte [ebp + 0xc], 0
je 0x572cf0
lea eax, [ebp - 0x14]
mov edx, 0x572f94
call fcn.00403d34
jmp 0x572cfd
lea eax, [ebp - 0x14]
mov edx, 0x572fa4
call fcn.00403d34
xor eax, eax
push ebp
push 0x572d65
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x572fb4
call fcn.0040a09c
mov eax, dword [ebp - 0x18]
call fcn.004040dc
push eax
mov eax, dword [ebp - 0x14]
call fcn.004040dc
push eax
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x572d5b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x572f01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x572d6f
mov eax, dword [ebp - 0x10]
mov edx, 0x572fc4
call fcn.00404028
jne 0x572dee
xor eax, eax
push ebp
push 0x572ddf
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
lea eax, [ebp - 0x18]
mov edx, 0x572fe8
call fcn.00403f64
mov eax, dword [ebp - 0x18]
call fcn.004040dc
push eax
push 0x573004
mov eax, dword [ebp - 0x14]
call fcn.004040dc
push eax
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x572dd2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x572f01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x572ed6
mov eax, dword [ebp - 0x10]
mov edx, 0x572f7c
call fcn.00404028
je 0x572e0f
mov eax, dword [ebp - 0x10]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
jne 0x572e55
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
push 0
cmp byte [ebp + 0xc], 0
je 0x572e31
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
jne 0x572e35
xor eax, eax
jmp 0x572e37
mov al, 1
push eax
mov al, byte [ebp + 8]
push eax
push 0
mov edx, dword [0x5bc024]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.005794ec
jmp 0x572f01
mov eax, dword [ebp - 0x10]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
je 0x572ed6
xor eax, eax
push ebp
push 0x572ecc
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x572fb4
call fcn.0040a09c
mov eax, dword [ebp - 0x18]
call fcn.004040dc
push eax
mov eax, dword [ebp - 0x10]
call fcn.004040dc
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x572ec2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x572f01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x572ed6
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x5bbc1c]
call fcn.00405c9c
mov eax, dword [ebp - 0x18]
call fcn.004040dc
push eax
push 0x573014
mov eax, dword [ebp - 8]
call fcn.0045abd4
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x572f23
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00403cc0
ret