Function at 0x402377
Capabilities:
Contain obfuscated stackstrings
Hide graphical window
Log keystrokes via application hook
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0xa4
mov dword [ebp - 0x32], 0x636f7250
mov dword [ebp - 0x2e], 0x48737365
mov dword [ebp - 0x2a], 0x616d7469
mov word [ebp - 0x26], 0x6e
lea edx, [ebp - 0x5c]
mov eax, 0
mov ecx, 0xa
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x58], sym.__Z10WindowProcP6HWND__jjl_16
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x32]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 6
mov dword [esp + 4], 0x65
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._LoadIconA_8
sub esp, 8
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._RegisterClassA_4
sub esp, 4
mov dword [esp], 0
call sym._GetSystemMetrics_4
sub esp, 4
mov dword [ebp - 0xc], eax
mov dword [esp], 1
call sym._GetSystemMetrics_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x190
mov dword [ebp - 0x18], 0xfa
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [ebp - 0x20], eax
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], str.Process_Hitman__Alt__F5_to_kill_processes
lea eax, [ebp - 0x32]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [0x408098], eax
mov eax, dword [0x408098]
mov edx, dword [ebp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], sym.__Z20LowLevelKeyboardProcijl_12
mov dword [esp], 0xd
call sym._SetWindowsHookExA_16
sub esp, 0x10
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x402520
mov dword [esp + 4], str.Failed_to_install_hook_
mov dword [esp], sym.imp.libstdc_6.dll_std::cerr
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
mov eax, 1
jmp 0x4025eb
mov ecx, 0
mov eax, 0x1c
and eax, 0xfffffffc
mov edx, eax
mov eax, 0
mov dword [ebp + eax - 0x78], ecx
add eax, 4
cmp eax, edx
jb 0x402534
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._GetMessageA_16
sub esp, 0x10
test eax, eax
setne al
test al, al
je 0x4025d8
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._TranslateMessage_4
sub esp, 4
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._DispatchMessageA_4
sub esp, 4
mov dword [esp], 0x11
call sym._GetAsyncKeyState_4
sub esp, 4
test ax, ax
jns 0x4025b9
mov dword [esp], 0x54
call sym._GetAsyncKeyState_4
sub esp, 4
test ax, ax
jns 0x4025b9
mov eax, 1
jmp 0x4025be
mov eax, 0
test al, al
je 0x40253f
mov eax, dword [0x408098]
mov dword [esp], eax
call sym.HideToTray_HWND___
jmp 0x40253f
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._UnhookWindowsHookEx_4
sub esp, 4
mov eax, 0
mov edi, dword [ebp - 4]
leave
ret 0x10