Function at 0x421d99
Capabilities:
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov eax, 0x41b0
lea ebp, [esp - 0x74]
call fcn.0047a810
push ebx
push esi
mov dword [ebp + 0x58], ecx
push edi
lea ecx, [ebp + 0x7c]
call fcn.0040b430
and dword [ebp + 0x44], 0
and dword [ebp + 0x5c], 0
mov dword [ebp + 0x6c], 1
mov byte [ebp + 0x71], 0
mov byte [ebp + 0x72], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 0x7c]
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x38], 0x3e8
mov ax, word [ecx]
cmp ax, 0x2d
mov byte [ebp + 0x64], 0
mov byte [ebp + 0x73], 0
mov bl, 0x2a
jne 0x421df5
mov bl, al
movsx esi, bl
movzx eax, ax
cmp esi, eax
jne 0x422133
push 0x40
pop edi
cmp bl, 0x2d
jne 0x421e22
xor eax, eax
mov ax, word [ecx + 2]
push eax
call fcn.0041030b
add esp, 4
test al, al
jne 0x421f62
push 3
lea eax, [ebp + 0x7c]
inc ecx
push eax
inc ecx
push 0x492554
mov dword [ebp + 0x7c], ecx
call fcn.004349fd
add esp, 0xc
test al, al
je 0x421e47
mov byte [ebp + 0x73], 1
jmp 0x421f54
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x492550
call fcn.004349fd
add esp, 0xc
test al, al
je 0x421e67
mov byte [ebp + 0x64], 1
jmp 0x421f54
push 4
lea eax, [ebp + 0x7c]
push eax
push str.sys0
call fcn.004349fd
add esp, 0xc
test al, al
je 0x421e87
mov byte [ebp + 0x64], 0x41
jmp 0x421f54
push 6
lea eax, [ebp + 0x7c]
push eax
push str.syscmd
call fcn.004349fd
add esp, 0xc
test al, al
je 0x421ea7
mov byte [ebp + 0x64], 0x10
jmp 0x421f54
push 7
lea eax, [ebp + 0x7c]
push eax
push str.sys0cmd
call fcn.004349fd
add esp, 0xc
test al, al
je 0x421ec7
mov byte [ebp + 0x64], 0x50
jmp 0x421f54
push 4
lea eax, [ebp + 0x7c]
push eax
push str.cont
call fcn.004349fd
add esp, 0xc
test al, al
je 0x421ee7
mov dword [ebp + 0x44], 0x10000
jmp 0x421f54
push 7
lea eax, [ebp + 0x7c]
push eax
push str.scanall
call fcn.004349fd
add esp, 0xc
test al, al
je 0x421f04
mov byte [ebp + 0x72], 1
jmp 0x421f54
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x491930
call fcn.004349fd
add esp, 0xc
test al, al
je 0x421f20
mov dword [ebp + 0x5c], edi
jmp 0x421f54
push 4
push dword [ebp + 0x7c]
push str.cur:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x421f4a
add dword [ebp + 0x7c], 8
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004358e8
pop ecx
jmp 0x421f53
lea eax, [ebp + 0x7c]
push eax
call fcn.0040417e
pop ecx
mov ecx, dword [ebp + 0x7c]
movzx eax, word [ecx]
cmp esi, eax
je 0x421e06
cmp byte [ebp + 0x64], 0
je 0x42207f
push 0x4a6658
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.GlobalPECMD:main:lock
call fcn.0040b837
mov ebx, dword [ebp + 0x64]
and ebx, edi
push ebx
mov dword [ebp + 0x68], eax
call fcn.0040d8f2
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
pop ecx
pop ecx
push dword [ebp + 0x7c]
mov dword [ebp + 0x5c], eax
call edi
mov esi, eax
add esi, 0x10
lea eax, [esi + 0x65]
push eax
lea ecx, [ebp + 0x6c]
call fcn.00432cd5
mov eax, dword [ebp + 0x6c]
and word [eax], 0
test byte [ebp + 0x64], 0x10
jne 0x421fd1
push dword [ebp + 0x28]
push str.THREAD_WAIT__cur:_lu
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp + 0x6c]
call edi
mov ecx, dword [ebp + 0x6c]
inc esi
push esi
push dword [ebp + 0x7c]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov esi, dword [ebp + 0x6c]
push esi
call edi
shl eax, 1
push eax
push esi
push 1
push str.HOTKEY9000000
push str.SOFTWAREPELOGON
push 0x80000002
call fcn.0042eb45
add esp, 0x18
cmp dword [ebp + 0x5c], 0
jne 0x422023
push ebx
push dword [ebp + 0x58]
call fcn.00413d37
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x5c], eax
je 0x422053
push 0
push 0x895440
push 0x312
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp + 0x6c]
mov esi, eax
call fcn.0042dd2d
cmp dword [ebp + 0x68], 0
je 0x42206d
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x42206d
lea ecx, [ebp + 0x6c]
call fcn.0042dd2d
cmp dword [ebp + 0x68], 0
je 0x42206a
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor esi, esi
inc esi
push 0x4a6658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x4227cc
cmp byte [ebp + 0x72], 0
je 0x422133
lea ecx, [ebp + 0x5c]
mov ebx, 0x49130c
call fcn.00432cb7
mov eax, dword [ebp + 0x7c]
xor esi, esi
cmp word [eax], si
je 0x4220b5
push 0x2c
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043541b
mov ebx, dword [ebp + 0x5c]
add esp, 0xc
push 0x3f
xor eax, eax
mov byte [ebp - 0x138], 0
pop ecx
lea edi, [ebp - 0x137]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov word [ebp - 0x413c], si
lea edi, [ebp - 0x413c]
movzx eax, byte [ebp + esi - 0x138]
push eax
push 0x4924c8
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add edi, 0xa
cmp esi, 0x100
jl 0x4220e6
mov ecx, dword [ebp + 0x58]
and word [ebp - 0x373e], 0
lea eax, [ebp - 0x413c]
push eax
push ebx
call fcn.00432698
lea ecx, [ebp + 0x5c]
call fcn.0042dd2d
and dword [ebp + 0x6c], 0
jmp 0x4227bf
mov esi, 0x80000000
mov dword [ebp + 0x60], esi
cmp word [ecx], 0x2d
jne 0x422169
lea eax, [ecx + 2]
mov dx, word [eax]
or dx, 0x20
cmp dx, 0x63
je 0x422169
cmp dx, 0x64
je 0x422169
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x7c], eax
mov byte [ebp + 0x71], 1
call fcn.0040b430
mov ecx, dword [ebp + 0x7c]
cmp word [ecx], 0x3d
jne 0x422178
mov bl, byte [ecx]
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
jmp 0x42217a
xor bl, bl
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.0041030b
add esp, 4
test al, al
je 0x42219e
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004358e8
pop ecx
pop ecx
mov ecx, dword [ebp + 0x7c]
cmp word [ecx], 0x2a
je 0x422311
cmp dword [ebp + 0x60], esi
je 0x422311
xor edi, edi
lea ecx, [ebp + 0x68]
mov word [ebp - 0x36], di
mov word [ebp - 0x38], di
mov dword [ebp + 0x64], 0x49130c
call fcn.00432cb7
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2c
jne 0x4221f4
add dword [ebp + 0x7c], 2
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043541b
mov eax, dword [ebp + 0x68]
add esp, 0xc
cmp word [eax], di
je 0x4221f4
mov dword [ebp + 0x64], eax
cmp byte [ebp + 0x71], 0
mov ecx, dword [ebp + 0x60]
jne 0x42224b
cmp ecx, edi
je 0x422246
jl 0x4222f7
test bl, bl
push ecx
je 0x422233
mov dword [ebp + 0x6c], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x60], esi
cmp word [eax], di
jne 0x4222f7
lea ecx, [ebp + 0x68]
call fcn.0042dd2d
xor eax, eax
jmp 0x4227cc
mov ecx, dword [ebp + 0x58]
call fcn.0040ce62
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x60], esi
jmp 0x4222f7
push 2
pop eax
jmp 0x42224e
xor eax, eax
inc eax
or eax, dword [ebp + 0x44]
push eax
push ecx
call fcn.004169bc
cmp byte [ebp + 0x73], 0
pop ecx
mov ebx, eax
pop ecx
mov dword [ebp + 0x6c], ebx
jne 0x422275
cmp ebx, 0x60
jl 0x422275
cmp ebx, 0x69
jg 0x422275
sub ebx, 0x30
mov dword [ebp + 0x6c], ebx
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, str.0x_X
jle 0x422294
push ebx
lea eax, [ebp - 0x38]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x38]
jmp 0x422299
mov eax, 0x4924c0
mov ecx, dword [ebp + 0x58]
push eax
push str.PressKey.Hex
call fcn.00432698
test ebx, ebx
jle 0x4222dc
cmp ebx, 0x41
jl 0x4222b5
cmp ebx, 0x5a
jle 0x4222c2
push ebx
call fcn.0041030b
add esp, 4
test al, al
je 0x4222d1
and word [ebp - 0x36], 0
movsx ax, bl
mov word [ebp - 0x38], ax
jmp 0x4222dc
push ebx
lea eax, [ebp - 0x38]
push edi
push eax
call esi
add esp, 0xc
mov ecx, dword [ebp + 0x58]
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x64]
call fcn.00432698
mov dword [ebp + 0x60], 0x80000000
mov esi, 0x80000000
lea ecx, [ebp + 0x7c]
call fcn.0040b430
lea ecx, [ebp + 0x68]
mov dword [ebp + 0x60], esi
mov byte [ebp + 0x71], 0
call fcn.0042dd2d
mov ecx, dword [ebp + 0x7c]
cmp word [ecx], 0
je 0x4227bf
xor ebx, ebx
mov dword [ebp + 0x54], ebx
or esi, 0xffffffff
cmp word [ecx], 0x2a
mov byte [ebp + 0x73], bl
jne 0x422345
mov eax, dword [ebp + 0x28]
inc ecx
xor esi, esi
inc ecx
inc esi
mov dword [ebp + 0x54], eax
jmp 0x42233c
inc esi
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
cmp word [ecx], 0x2a
je 0x422339
cmp esi, ebx
jle 0x42239f
mov ax, word [ecx]
cmp ax, 0x2d
jne 0x42235c
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x54], ebx
jmp 0x42239f
cmp ax, 0x3d
jne 0x42236b
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov byte [ebp + 0x73], 1
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.0041030b
add esp, 4
test al, al
je 0x42238d
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004358e8
pop ecx
pop ecx
dec esi
cmp esi, ebx
jle 0x42239f
push esi
push dword [ebp + 0x54]
call fcn.0040e6d2
pop ecx
pop ecx
mov dword [ebp + 0x54], eax
or dword [ebp + 0x40], 0xffffffff
lea ecx, [ebp + 0x7c]
call fcn.0040b430
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x3d
jne 0x4223c0
mov cl, byte [eax]
inc eax
inc eax
mov byte [ebp + 0x72], cl
mov dword [ebp + 0x7c], eax
jmp 0x4223c4
mov byte [ebp + 0x72], 0
movzx eax, word [eax]
push eax
call fcn.0041030b
add esp, 4
test al, al
je 0x4223e3
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004358e8
pop ecx
pop ecx
cmp dword [ebp + 0x54], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x6c], ebx
je 0x42241b
cmp byte [ebp + 0x73], 0
push dword [ebp + 0x54]
push ebx
push 0x100000
je 0x422405
call dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x42240b
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp + 0x50], eax
jne 0x42241b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x6c], eax
push 0x209
lea ecx, [ebp + 0x48]
call fcn.00432cd5
mov eax, dword [ebp + 0x48]
mov word [eax], bx
push dword [ebp + 0x48]
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp + 0x48]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0043cd4d
push 0x5c
push dword [ebp + 0x3c]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov eax, dword [ebp + 0x48]
push esi
mov word [eax], bx
push dword [ebp + 0x48]
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp + 0x3c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp + 0x7c]
call fcn.0040b430
lea ecx, [ebp + 0x2c]
call fcn.00432f23
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
mov dword [ebp + 0x24], ebx
je 0x4225c1
push 4
pop edi
cmp byte [0x4a4290], 0
jle 0x4225c1
push 7
lea eax, [ebp + 0x7c]
push eax
push str._delms:
call fcn.004349fd
add esp, 0xc
test al, al
je 0x4224d8
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004358e8
cmp dword [ebp + 0x38], ebx
pop ecx
pop ecx
jge 0x4225ad
mov dword [ebp + 0x38], ebx
jmp 0x4225ad
push edi
lea eax, [ebp + 0x7c]
push eax
push str._del
call fcn.004349fd
add esp, 0xc
test al, al
je 0x42258d
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x4c], eax
push 1
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x4c]
push eax
mov dword [ebp + 0x44], ebx
call fcn.00414db6
add esp, 0xc
lea ecx, [ebp + 0x68]
mov dword [ebp + 0x7c], eax
call fcn.00432cb7
lea ecx, [ebp + 0x64]
call fcn.00432cb7
push dword [ebp + 0x44]
lea ecx, [ebp + 0x64]
push dword [ebp + 0x4c]
call fcn.00432ddd
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x64]
call fcn.0040ede9
pop ecx
pop ecx
lea ecx, [ebp + 0x64]
call fcn.0042dd2d
cmp dword [ebp + 0x44], ebx
jle 0x42257b
push edi
call fcn.00479ff8
cmp eax, ebx
pop ecx
je 0x422560
mov ecx, dword [ebp + 0x68]
mov dword [eax], ecx
mov dword [ebp + 0x68], ebx
mov esi, eax
jmp 0x422562
xor esi, esi
push edi
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 0x34]
call fcn.00432ee6
add esp, 0x10
mov dword [eax], esi
inc dword [ebp + 0x34]
lea ecx, [ebp + 0x7c]
call fcn.0040b430
lea ecx, [ebp + 0x68]
call fcn.0042dd2d
jmp 0x4225ad
push edi
lea eax, [ebp + 0x7c]
push eax
push str._cmd
call fcn.004349fd
add esp, 0xc
test al, al
jne 0x4225bb
lea eax, [ebp + 0x7c]
push eax
call fcn.0040417e
pop ecx
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
jne 0x422494
jmp 0x4225c1
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x24], eax
cmp byte [ebp + 0x71], 0
je 0x4225ca
neg dword [ebp + 0x60]
cmp dword [ebp + 0x5c], ebx
jne 0x4225dd
cmp dword [ebp + 0x50], ebx
je 0x4225dd
push dword [ebp + 0x48]
call fcn.0040d55e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
add esi, dword [ebp + 0x60]
cmp dword [ebp + 0x50], ebx
je 0x422698
cmp byte [0x4a4290], 0
jle 0x422698
mov ebx, 0x3e8
cmp dword [ebp + 0x60], 0
je 0x422698
mov edi, ebx
jle 0x422626
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
sub ecx, eax
mov dword [ebp + 0x60], ecx
js 0x422698
cmp ecx, ebx
jge 0x422626
mov edi, ecx
push 0x4ff
push edi
push 0
lea eax, [ebp + 0x50]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x422698
cmp byte [0x4a4290], 0
mov dword [ebp + 0x4c], 0x64
jle 0x422698
xor edi, edi
push 1
push edi
push edi
push edi
lea eax, [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x42268b
dec dword [ebp + 0x4c]
je 0x42268b
cmp dword [ebp + 0xc], 0x12
je 0x42268b
lea eax, [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4a4290], 0
jg 0x422650
cmp byte [0x4a4290], 0
jg 0x422603
xor ebx, ebx
cmp dword [ebp + 0x40], ebx
jl 0x4226b7
cmp byte [ebp + 0x72], bl
push dword [ebp + 0x40]
je 0x4226af
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4226b7
mov ecx, dword [ebp + 0x58]
call fcn.0040ce62
cmp dword [ebp + 0x34], ebx
jle 0x422771
cmp byte [0x4a4290], 0
jle 0x422771
cmp dword [ebp + 0x5c], ebx
jne 0x4226db
push dword [ebp + 0x48]
call fcn.0040d55e
pop ecx
cmp dword [ebp + 0x34], ebx
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x44], eax
jle 0x422771
cmp byte [0x4a4290], 0
jle 0x422771
mov eax, dword [ebp + 0x34]
xor edi, edi
cmp eax, ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x68], eax
jle 0x422771
cmp byte [0x4a4290], 0
jle 0x422757
mov eax, dword [ebp + 0x44]
lea esi, [eax + edi*4]
mov eax, dword [esi]
cmp eax, ebx
je 0x42274f
push 0
push dword [eax]
call fcn.00420b5f
mov eax, dword [esi]
push dword [eax]
call fcn.00479684
add esp, 0xc
test eax, eax
jne 0x422749
mov ebx, dword [esi]
test ebx, ebx
je 0x422744
mov ecx, ebx
call fcn.0042dd2d
push ebx
call fcn.00479e34
pop ecx
and dword [esi], 0
jmp 0x42274f
lea eax, [edi + 1]
mov dword [ebp + 0x4c], eax
inc edi
xor ebx, ebx
cmp edi, dword [ebp + 0x68]
jl 0x422702
mov esi, dword [ebp + 0x4c]
cmp esi, ebx
jle 0x422771
push dword [ebp + 0x38]
mov ecx, dword [ebp + 0x58]
call fcn.0040ce62
mov dword [ebp + 0x34], esi
jmp 0x4226ea
cmp dword [ebp + 0x5c], ebx
jne 0x422784
cmp dword [ebp + 0x50], ebx
je 0x422784
push dword [ebp + 0x3c]
call fcn.0040d55e
pop ecx
mov eax, dword [ebp + 0x24]
cmp eax, ebx
je 0x42279f
cmp word [eax], bx
je 0x42279f
mov ecx, dword [ebp + 0x58]
push ebx
push ebx
push ebx
push eax
call fcn.0042442a
mov dword [ebp + 0x6c], eax
lea ecx, [ebp + 0x2c]
call fcn.004469a5
lea ecx, [ebp + 0x3c]
call fcn.0042dd2d
lea ecx, [ebp + 0x48]
call fcn.0042dd2d
lea ecx, [ebp + 0x50]
call fcn.00402ad9
mov ecx, dword [ebp + 0x58]
push 0
call fcn.00443dd2
mov eax, dword [ebp + 0x6c]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4