Function at 0x4530f7
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
push ebx
push esi
lea esi, [ebp + 8]
push edi
mov edi, ecx
lea eax, [ebp + 0xc]
neg esi
sbb esi, esi
lea ebx, [edi + 0x1d0]
and esi, eax
mov eax, ebx
neg eax
push dword [esi]
lea ecx, [edi + 0x1d4]
sbb eax, eax
and eax, ecx
lea ecx, [ebp - 0x28]
push dword [eax]
call fcn.00489f3d
cmp dword [0x4c7084], 0
jne 0x453402
mov eax, dword [0x4b0550]
mov esi, dword [esi]
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x1c4]
push ecx
push esi
push eax
call fcn.00468835
add esp, 0xc
test eax, eax
je 0x4533fa
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.00489fbf
push 0
push 0x4b0810
lea ecx, [ebp - 4]
call fcn.00403d34
mov esi, 0x4b1254
lea ecx, [ebp - 0xc]
push esi
mov ebx, eax
call fcn.00403927
push esi
lea ecx, [ebp - 0x10]
call fcn.00403927
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00489fbf
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00403b20
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
cmp ebx, 0xffffffff
je 0x453259
lea eax, [ebp - 0xc]
push ebx
push eax
lea ecx, [ebp - 4]
call fcn.00419b20
mov ecx, dword [ebp - 4]
lea eax, [ebx + 1]
mov ecx, dword [ecx - 8]
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x10]
lea ecx, [ebp - 4]
push eax
call fcn.0040acb2
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00453953
lea eax, [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00403a8c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push 0x4b12d8
push eax
call fcn.0040a961
mov eax, dword [eax]
lea ecx, [ebp - 0x1c]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push ecx
mov ecx, esp
push eax
call fcn.004038b5
lea eax, [ebp - 8]
push eax
call fcn.004716ba
add esp, 0xc
lea ecx, [ebp - 4]
push eax
call fcn.00403a8c
lea ecx, [ebp - 8]
call fcn.004038fb
push ebx
push 0x4b69b0
lea ecx, [ebp - 4]
call fcn.00403d34
test eax, eax
jge 0x4532a9
push ebx
push 0x4b2a7c
lea ecx, [ebp - 4]
call fcn.00403d34
test eax, eax
jl 0x4532f4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push 0x4b0efc
push eax
call fcn.0045f823
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040a915
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00403b20
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea eax, [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00403a8c
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea eax, [ebp - 4]
push eax
call fcn.004602be
pop ecx
lea ecx, [ebp - 0x48c]
call fcn.0045341b
push dword [ebp - 4]
lea ecx, [ebp - 0x48c]
call fcn.0040b0d3
mov esi, eax
cmp esi, ebx
je 0x45333a
lea eax, [ebp - 8]
lea ecx, [ebp - 0x48c]
push eax
call fcn.0040afaf
push eax
lea ecx, [ebp - 4]
call fcn.00403a8c
lea ecx, [ebp - 8]
jmp 0x45337d
push ecx
lea eax, [ebp - 4]
mov ebx, esp
push eax
push 0x4b69a8
lea eax, [ebp - 0x14]
push 0xe6
push eax
call fcn.00461770
pop ecx
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040a915
push eax
push ebx
call fcn.00403b20
mov ecx, dword [edi + 0xe4]
call fcn.00476260
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
mov eax, dword [0x4b0550]
push 0x11
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x4533a4
push str.runas
lea ecx, [ebp - 0x18]
call fcn.00403adc
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 4]
push dword [ebp - 0x18]
push dword [edi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.004038fb
lea ecx, [ebp - 0x48c]
call fcn.0040b1a0
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x28]
call fcn.0048996a
lea ecx, [ebp + 8]
call fcn.0048996a
mov eax, esi
jmp 0x453414
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x28]
call fcn.0048996a
lea ecx, [ebp + 8]
call fcn.0048996a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8