Function at 0x4ed9b0
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x28], edi
mov eax, dword [edi + 0xf0]
mov ebx, ecx
cmp eax, ebp
mov dword [esp + 0x18], ebx
je 0x4edcd4
cmp ecx, ebp
je 0x4edcd4
push ecx
lea ecx, [esp + 0x34]
mov dword [eax + 0xd8], 1
call fcn.00510710
lea eax, [esp + 0x30]
lea ecx, [esp + 0x34]
neg eax
sbb eax, eax
lea edx, [esp + 0x20]
and eax, ecx
lea ecx, [esp + 0x1c]
push edx
push ecx
mov eax, dword [eax]
lea ecx, [edi + 0x1fc]
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.004d8e90
test al, al
je 0x4edae7
mov eax, dword [0x555b44]
mov esi, dword [esp + 0x1c]
cmp eax, ebp
mov dword [esp + 0x10], ebp
jne 0x4eda47
push 0x555b44
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
jmp 0x4eda4d
mov edx, dword [eax]
push eax
call dword [edx + 4]
cmp esi, ebp
je 0x4eda67
cmp word [esi], bp
jne 0x4eda67
mov eax, dword [0x555b44]
lea ecx, [esp + 0x10]
push eax
call fcn.00424b80
jmp 0x4eda7e
mov eax, dword [0x555b44]
lea edx, [esp + 0x10]
push edx
push 0x543354
mov ecx, dword [eax]
push ebp
push esi
push eax
call dword [ecx + 0x14]
lea ecx, [esp + 0x2c]
call fcn.00424b60
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x38]
push eax
call fcn.00510710
lea eax, [esp + 0x38]
lea ecx, [esp + 0x3c]
neg eax
sbb eax, eax
lea edx, [esp + 0x24]
and eax, ecx
mov ecx, dword [edi + 0xf0]
push edx
add ecx, 0x20
mov eax, dword [eax]
mov dword [esp + 0x28], ebp
push eax
mov eax, dword [esp + 0x18]
push eax
call fcn.00509390
test al, al
je 0x4edad0
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
mov ebx, ecx
lea ecx, [esp + 0x38]
call fcn.00510740
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x4edae7
mov edx, dword [eax]
push eax
call dword [edx + 8]
push ebx
lea ecx, [esp + 0x44]
call fcn.00510710
lea eax, [esp + 0x50]
lea ecx, [esp + 0x40]
push eax
call fcn.00511000
mov eax, dword [esp + 0x50]
push ecx
mov ebx, esp
cmp dword [eax - 0xc], ebp
jl 0x4edb1d
mov dword [ebx], eax
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4edb6d
mov edx, dword [0x547570]
mov dword [ebx], edx
mov eax, dword [esp + 0x54]
cmp eax, ebp
mov esi, eax
je 0x4edb38
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
push ebp
mov ecx, ebx
call fcn.00405660
test eax, eax
je 0x4edb6b
mov edi, dword [ebx]
lea eax, [ebp + ebp]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov edi, dword [esp + 0x2c]
mov dword [ecx - 8], ebp
mov edx, dword [ebx]
mov word [eax + edx], 0
xor ebp, ebp
lea eax, [esp + 0x18]
push eax
call fcn.004ba830
mov eax, dword [esp + 0x58]
add esp, 4
mov esi, esp
cmp dword [eax - 0xc], ebp
jl 0x4edb97
mov dword [esi], eax
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4edbbd
mov edx, dword [0x547570]
mov dword [esi], edx
mov eax, dword [esp + 0x54]
cmp eax, ebp
mov ebx, eax
jne 0x4edbad
xor eax, eax
jmp 0x4edbb4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
push eax
mov ecx, esi
call fcn.00405870
call fcn.004ba530
add esp, 4
cmp eax, 1
jne 0x4edc62
mov ecx, dword [edi + 4]
push eax
mov eax, dword [esp + 0x54]
push ebp
push ebp
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x547574]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4edc16
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4edc16
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x50]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4edc41
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4edc41
mov edx, dword [esp + 0x50]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
lea ecx, [esp + 0x40]
call fcn.00510740
lea ecx, [esp + 0x30]
call fcn.00510740
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10
mov eax, dword [esp + 0x14]
mov edx, dword [0x547574]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4edc93
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4edc93
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x50]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4edcbe
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4edcbe
mov edx, dword [esp + 0x50]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
lea ecx, [esp + 0x40]
call fcn.00510740
lea ecx, [esp + 0x30]
call fcn.00510740
mov ebx, dword [esp + 0x18]
mov esi, 1
push 0x10
mov dword [edi + 0x44], esi
mov dword [0x55f2a0], ebp
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
cmp eax, 0x8000
jne 0x4edcfc
mov dword [0x55f2a0], esi
lea eax, [edi + 0x4a8]
test eax, eax
je 0x4edd0e
lea eax, [edi + 0x4ac]
jmp 0x4edd10
xor eax, eax
mov ecx, dword [esp + 0x54]
mov edx, dword [eax]
cmp ecx, edx
je 0x4edd22
cmp ecx, dword [0x55bb94]
jne 0x4edd88
mov dword [edi + 0x44], ebp
mov eax, dword [0x55f2a0]
cmp eax, ebp
je 0x4edd4e
push 0xffffffffffffffff
sub esp, 8
mov ecx, esp
push ebx
call fcn.00510710
mov ecx, edi
call fcn.004ef830
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10
mov eax, dword [edi + 0xf0]
cmp eax, ebp
je 0x4edd62
mov dword [eax + 0xd8], 2
mov dword [0x55f2a0], ebp
push esi
push ebp
sub esp, 8
mov ecx, esp
push ebx
call fcn.00510710
mov ecx, edi
call fcn.004e5440
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10
cmp dword [0x55f2a0], ebp
je 0x4edd68
push 0xffffffffffffffff
sub esp, 8
mov ecx, esp
push ebx
call fcn.00510710
mov ecx, edi
call fcn.004ef830
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10