Function at 0x40cb99
Capabilities:
Delete file
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push ebx
push edi
or dword [0x40e014], 0x205ebc
mov word [ebp - 4], 0
mov byte [ebp - 8], 0x28
call sub.msvcrt.dll_rand
test dx, dx
je 0x40cbda
mov ah, byte [0x40e080]
push 0x401254
call sub.msvcrt.dll_strlen
pop ecx
adc dword [ebp - 0xc], 0x250
mov esi, dword [0x40e07c]
and dword [ebp - 0xc], 0xbf2de0
mov word [ebp - 0x10], 1
adc dword [ebp - 0xc], 0x3792e0
push 0x40e07c
call sub.gdi32.dll_CreatePalette
push 0x401264
call sub.msvcrt.dll_strlen
pop ecx
mov esi, dword [ebp - 0x14]
movsx esi, bl
mov dword [0x40e02c], 0x80a350
mov dword [0x40e078], 0
push 0x401274
push dword [0x40e084]
call sub.USER32.dll_LoadBitmapA
push 0x401288
call sub.msvcrt.dll_printf
pop ecx
sbb eax, edi
push 0x70
call sub.USER32.dll_GetSystemMetrics
mov byte [ebp - 8], ch
sub ebx, 0x10c
mov edx, dword [ebp - 0xc]
push 0x40129c
call sub.msvcrt.dll_strlen
pop ecx
or esi, dword [0x40e088]
push 0x40e05c
push dword [0x40e08c]
call sub.gdi32.dll_RectVisible
push dword [0x40e090]
call sub.ole32.dll_RevokeDragDrop
push 0x4012ac
push dword [0x40e094]
call sub.USER32.dll_LoadCursorA
xor dword [ebp - 0x14], eax
mov dword [0x40e02c], 0x30c720
push 0xc5
call sub.USER32.dll_GetKeyState
mov ecx, dword [ebp - 0xc]
push 0x4012c0
push dword [0x40e098]
call sub.USER32.dll_LoadBitmapA
sbb dx, 1
nop
mov ah, byte [ebp - 7]
test eax, 0xe3811518
jne 0x40ccce
mov byte [ebp - 7], ah
push dword [0x40e09c]
call sub.USER32.dll_GetParent
mov dword [0x40e078], edi
sbb dword [ebp - 0xc], 0x371a30
mov byte [ebp - 8], bh
mov edi, dword [0x40e034]
push dword [0x40e0a0]
call sub.ole32.dll_RevokeDragDrop
mov word [ebp - 4], 0xc890
mov dword [ebp - 0x18], 0x394
mov dh, byte [ebp - 6]
push 0x40e078
call sub.gdi32.dll_CreatePalette
mov dword [ebp - 0x1c], ecx
not edi
push 0
push 0x40e02c
call sub.ole32.dll_CreateBindCtx
mov byte [0x40e011], 0xbc
movzx di, dh
mov dword [ebp - 0xc], 0x238
call fcn.0040c4aa
neg dh
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], 0x372e0
mov dword [ebp - 0xc], ecx
mov byte [0x40e013], al
add word [0x40e032], ax
test dl, dh
jne 0x40cd5d
neg bh
mov byte [ebp - 5], ah
mov edi, dword [0x40e078]
mov eax, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
call sub.gdi32.dll_CreateFontIndirectA
adc esi, dword [ebp - 0x20]
adc dword [ebp - 0x14], 0x278
push dword [0x40e0a4]
call sub.USER32.dll_GetParent
push 0
push 0x40e050
call sub.ole32.dll_CreateBindCtx
mov cx, word [ebp - 0x24]
mov byte [0x40e081], dh
sbb dword [ebp - 0xc], 0xffffffff
sbb byte [0x40e011], dh
mov byte [ebp - 6], 0
push 0xd
push dword [0x40e0a8]
call sub.gdi32.dll_SetTextAlign
xor dword [ebp - 0x20], ecx
not ax
call fcn.0040c4aa
or dl, 1
mov ebx, dword [ebp - 0xc]
mov cx, word [ebp - 4]
call sub.msvcrt.dll_rand
cmp byte [ebp - 7], 0x84
jae 0x40cdde
movzx esi, ah
sbb dword [0x40e074], 0xffffff80
mov dword [0x40e0ac], 0xffffffff
mov dword [ebp - 0x18], esi
push 0x4012d0
call sub.msvcrt.dll_strlen
pop ecx
and ecx, dword [0x40e034]
push 0xf5d9b0
call sub.gdi32.dll_GetStockObject
xor dword [0x40e074], 0x25a7e8
mov cl, byte [0x40e012]
mov edi, dword [ebp - 0x28]
call sub.KERNEL32.DLL_GetTickCount
mov word [0x40e0b0], 0xaf50
lea eax, [ebp - 0x38]
push eax
call sub.KERNEL32.DLL_GetSystemTime
mov dword [ebp - 0x28], 0xffffffff
mov cx, word [ebp - 4]
sub dword [0x40e088], 0xffffffff
mov byte [ebp - 6], 0xff
sub dword [ebp - 0x28], edx
bswap edx
call fcn.0040c4aa
push 0x4012e0
call sub.msvcrt.dll_remove
test ax, 0x306b
jno 0x40ce7a
mov byte [0x40e082], 0xf8
lea eax, [ebp - 0xc]
push eax
call sub.gdi32.dll_CreateFontIndirectA
mov dword [0x40e0b4], 0x40c603
push 0x40e0b8
call sub.ole32.dll_OleRun
pop edi
pop ebx
pop esi
leave
ret