Function at 0x402db0
Capabilities:
Create thread
Enumerate gui resources
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404fd5
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x408040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 0x20000
push 1
call ebx
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
push eax
call edi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
add esp, 8
push eax
call esi
add esp, 8
push 0x20000
push 0
call ebx
push eax
call edi
add esp, 8
push eax
call esi
add esp, 8
push 0x20000
push 2
call ebx
push eax
call edi
add esp, 8
push eax
call esi
add esp, 8
call fcn.00401690
mov ecx, dword [0x4084ac]
mov eax, dword [0x4084b0]
push 0x403510
cmp ecx, eax
jne 0x402e7e
mov edx, 0x406424
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.004032e0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403f97
mov esp, ebp
pop ebp
ret
sub eax, ecx
mov edx, 0x406460
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
sar eax, 2
push eax
call fcn.004032e0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0
push 0x401750
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [0x4084dc]
mov eax, dword [0x4084e0]
push 0x403510
cmp ecx, eax
jne 0x402ecf
mov edx, 0x40649c
jmp 0x402e4a
sub eax, ecx
mov edx, 0x4064c8
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
sar eax, 2
push eax
call fcn.004032e0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0
push 0
push 0x401880
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov ebx, eax
mov dword [ebp - 0x44], ebx
push 0x403510
test ebx, ebx
jne 0x402f24
mov edx, 0x4064f8
jmp 0x402e50
mov edx, 0x406548
call fcn.004032e0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 4
call fcn.00403fa5
mov dword [ebp - 0x24], eax
mov dword [eax], 0x401a10
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
push ecx
push 0
push eax
push 0x403c20
push 0
push 0
call esi
add esp, 0x1c
mov dword [ebp - 0x20], eax
test eax, eax
je 0x40309c
push 4
mov dword [ebp - 4], 1
call fcn.00403fa5
mov dword [ebp - 0x24], eax
mov dword [eax], 0x4024c0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x403c20
push 0
push 0
call esi
add esp, 0x1c
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40308d
push 0
push 0
push 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push eax
call esi
test eax, eax
je 0x402ff3
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x40]
push eax
call edi
lea eax, [ebp - 0x40]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x40]
push eax
call esi
test eax, eax
jne 0x402fd4
mov ebx, dword [ebp - 0x44]
cmp dword [ebp - 0x1c], 0
mov byte [0x408098], 0
je 0x403085
mov esi, dword [sym.imp.MSVCP140.dll__Thrd_id]
call esi
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
je 0x40307d
mov edi, dword [sym.imp.MSVCP140.dll__Thrd_join]
push 0
push ecx
push dword [ebp - 0x20]
call edi
add esp, 0xc
test eax, eax
jne 0x403075
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
cmp dword [ebp - 0x14], eax
je 0x403085
call esi
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
je 0x40307d
push 0
push ecx
push dword [ebp - 0x18]
call edi
add esp, 0xc
test eax, eax
jne 0x403075
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp dword [ebp - 0x14], 0
jne 0x40306f
cmp dword [ebp - 0x1c], 0
jne 0x40306f
xor eax, eax
jmp 0x402e62
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 2
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x14], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x1c], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3