Function at 0x4ecdf0
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x28], edi
mov eax, dword [edi + 0xf0]
mov ebx, ecx
cmp eax, ebp
mov dword [esp + 0x18], ebx
je 0x4ed114
cmp ecx, ebp
je 0x4ed114
push ecx
lea ecx, [esp + 0x34]
mov dword [eax + 0xd8], 1
call fcn.0050fe10
lea eax, [esp + 0x30]
lea ecx, [esp + 0x34]
neg eax
sbb eax, eax
lea edx, [esp + 0x20]
and eax, ecx
lea ecx, [esp + 0x1c]
push edx
push ecx
mov eax, dword [eax]
lea ecx, [edi + 0x1fc]
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.004d82d0
test al, al
je 0x4ecf27
mov eax, dword [0x554ad4]
mov esi, dword [esp + 0x1c]
cmp eax, ebp
mov dword [esp + 0x10], ebp
jne 0x4ece87
push 0x554ad4
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
jmp 0x4ece8d
mov edx, dword [eax]
push eax
call dword [edx + 4]
cmp esi, ebp
je 0x4ecea7
cmp word [esi], bp
jne 0x4ecea7
mov eax, dword [0x554ad4]
lea ecx, [esp + 0x10]
push eax
call fcn.00424ca0
jmp 0x4ecebe
mov eax, dword [0x554ad4]
lea edx, [esp + 0x10]
push edx
push 0x542354
mov ecx, dword [eax]
push ebp
push esi
push eax
call dword [ecx + 0x14]
lea ecx, [esp + 0x2c]
call fcn.00424c80
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x38]
push eax
call fcn.0050fe10
lea eax, [esp + 0x38]
lea ecx, [esp + 0x3c]
neg eax
sbb eax, eax
lea edx, [esp + 0x24]
and eax, ecx
mov ecx, dword [edi + 0xf0]
push edx
add ecx, 0x20
mov eax, dword [eax]
mov dword [esp + 0x28], ebp
push eax
mov eax, dword [esp + 0x18]
push eax
call fcn.00508830
test al, al
je 0x4ecf10
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
mov ebx, ecx
lea ecx, [esp + 0x38]
call fcn.0050fe40
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x4ecf27
mov edx, dword [eax]
push eax
call dword [edx + 8]
push ebx
lea ecx, [esp + 0x44]
call fcn.0050fe10
lea eax, [esp + 0x50]
lea ecx, [esp + 0x40]
push eax
call fcn.00510700
mov eax, dword [esp + 0x50]
push ecx
mov ebx, esp
cmp dword [eax - 0xc], ebp
jl 0x4ecf5d
mov dword [ebx], eax
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4ecfad
mov edx, dword [0x546560]
mov dword [ebx], edx
mov eax, dword [esp + 0x54]
cmp eax, ebp
mov esi, eax
je 0x4ecf78
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
push ebp
mov ecx, ebx
call fcn.00405660
test eax, eax
je 0x4ecfab
mov edi, dword [ebx]
lea eax, [ebp + ebp]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov edi, dword [esp + 0x2c]
mov dword [ecx - 8], ebp
mov edx, dword [ebx]
mov word [eax + edx], 0
xor ebp, ebp
lea eax, [esp + 0x18]
push eax
call fcn.004b9770
mov eax, dword [esp + 0x58]
add esp, 4
mov esi, esp
cmp dword [eax - 0xc], ebp
jl 0x4ecfd7
mov dword [esi], eax
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4ecffd
mov edx, dword [0x546560]
mov dword [esi], edx
mov eax, dword [esp + 0x54]
cmp eax, ebp
mov ebx, eax
jne 0x4ecfed
xor eax, eax
jmp 0x4ecff4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
push eax
mov ecx, esi
call fcn.00405870
call fcn.004b9470
add esp, 4
cmp eax, 1
jne 0x4ed0a2
mov ecx, dword [edi + 4]
push eax
mov eax, dword [esp + 0x54]
push ebp
push ebp
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x546564]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4ed056
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4ed056
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x50]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4ed081
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4ed081
mov edx, dword [esp + 0x50]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
lea ecx, [esp + 0x40]
call fcn.0050fe40
lea ecx, [esp + 0x30]
call fcn.0050fe40
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10
mov eax, dword [esp + 0x14]
mov edx, dword [0x546564]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4ed0d3
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4ed0d3
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x50]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4ed0fe
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4ed0fe
mov edx, dword [esp + 0x50]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
lea ecx, [esp + 0x40]
call fcn.0050fe40
lea ecx, [esp + 0x30]
call fcn.0050fe40
mov ebx, dword [esp + 0x18]
mov esi, 1
push 0x10
mov dword [edi + 0x44], esi
mov dword [0x55e1e8], ebp
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
cmp eax, 0x8000
jne 0x4ed13c
mov dword [0x55e1e8], esi
lea eax, [edi + 0x4a8]
test eax, eax
je 0x4ed14e
lea eax, [edi + 0x4ac]
jmp 0x4ed150
xor eax, eax
mov ecx, dword [esp + 0x54]
mov edx, dword [eax]
cmp ecx, edx
je 0x4ed162
cmp ecx, dword [0x55aaf4]
jne 0x4ed1c8
mov dword [edi + 0x44], ebp
mov eax, dword [0x55e1e8]
cmp eax, ebp
je 0x4ed18e
push 0xffffffffffffffff
sub esp, 8
mov ecx, esp
push ebx
call fcn.0050fe10
mov ecx, edi
call fcn.004eec70
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10
mov eax, dword [edi + 0xf0]
cmp eax, ebp
je 0x4ed1a2
mov dword [eax + 0xd8], 2
mov dword [0x55e1e8], ebp
push esi
push ebp
sub esp, 8
mov ecx, esp
push ebx
call fcn.0050fe10
mov ecx, edi
call fcn.004e4880
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10
cmp dword [0x55e1e8], ebp
je 0x4ed1a8
push 0xffffffffffffffff
sub esp, 8
mov ecx, esp
push ebx
call fcn.0050fe10
mov ecx, edi
call fcn.004eec70
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10