Function at 0x10048398
Capabilities:
Get file attributes
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x118], 0x658a6001
mov dword [ebp - 0xc], 0
jmp 0x100483c9
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x100483df
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xf4], 0x10c93b4e
jmp 0x100483c2
mov dword [ebp - 0xc], 0
jmp 0x100483ef
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x10048405
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe4], 3
jmp 0x100483e8
mov dword [ebp - 4], 2
jmp 0x10048415
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x1004857c
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xf4]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xf4], ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 4]
jle 0x1004846a
mov dword [ebp - 0x6c], 1
jmp 0x1004846e
and dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x3c], eax
jle 0x10048488
mov dword [ebp - 0xd8], 1
jmp 0x1004848f
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jl 0x100484b2
mov dword [ebp - 0x74], 1
jmp 0x100484b6
and dword [ebp - 0x74], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
add eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 4]
cmp eax, dword [ebp + ecx*4 - 0xf4]
je 0x100484db
mov dword [ebp - 0x7c], 1
jmp 0x100484df
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xf4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe0]
mov dword [ebp + eax - 0xe4], ecx
mov eax, dword [ebp - 0xe0]
sub eax, dword [ebp - 0x7c]
cmp eax, 8
jg 0x10048522
mov dword [ebp - 0xd4], 1
jmp 0x10048529
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xd4]
jle 0x10048540
mov dword [ebp - 0x84], 1
jmp 0x10048547
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x84]
jle 0x1004855e
mov dword [ebp - 0xb4], 1
jmp 0x10048565
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x118], eax
jmp 0x1004840e
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10048897
mov dword [ebp - 0x44], 0x57976326
mov dword [ebp - 0x54], 0
jmp 0x1004859f
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x100485b5
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x124], 1
jmp 0x10048598
mov dword [ebp - 0x44], 0
jmp 0x100485c5
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x100486e0
mov dword [ebp - 0x14], 0
jmp 0x100485df
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x100485f2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x28], 0xffffffff
jmp 0x100485d8
mov dword [ebp - 0x14], 0
jmp 0x10048602
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10048618
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x178], 0xf6f97812
jmp 0x100485fb
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x28], 0
jmp 0x1004863d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x28], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 1
jg 0x100486db
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x124], 1
jle 0x1004866a
mov dword [ebp - 0x8c], 1
jmp 0x10048671
and dword [ebp - 0x8c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x124]
imul ecx, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0x124], ecx
jne 0x100486a8
mov dword [ebp - 0xcc], 1
jmp 0x100486af
and dword [ebp - 0xcc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcc]
mov dword [ebp + eax - 0x178], ecx
mov byte [ebp - 0x19], 0
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x100486d6
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10048628
jmp 0x100485be
mov eax, dword [ebp + 8]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x24], 0x82062403
mov dword [ebp - 0x11c], 0xfffffffd
mov dword [ebp - 0x134], 0xfffffffc
mov byte [ebp - 0x1a], 0
movzx eax, byte [ebp - 0x1a]
test eax, eax
je 0x1004871b
push 0x1aac
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [ebp - 0x24], 0
jmp 0x1004872b
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xd
jne 0x1004880e
mov dword [ebp - 0x30], 0x307b
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jg 0x10048750
mov dword [ebp - 0x94], 1
jmp 0x10048757
and dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 0xfffffff7
jne 0x1004876c
mov dword [ebp - 0x9c], 1
jmp 0x10048773
and dword [ebp - 0x9c], 0
cmp dword [ebp - 0x24], 0
jne 0x10048791
cmp dword [ebp - 0x24], 0
jne 0x10048791
mov eax, 0x60d2f38
test eax, eax
jne 0x10048791
and dword [ebp - 0xbc], 0
jmp 0x1004879b
mov dword [ebp - 0xbc], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xbc], eax
jl 0x100487b2
mov dword [ebp - 0xdc], 1
jmp 0x100487b9
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0xdc]
jge 0x100487d0
mov dword [ebp - 0x64], 1
jmp 0x100487d4
and dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x64]
add ecx, 0x39c7c6f1
add eax, ecx
je 0x100487f6
cmp dword [ebp - 0x30], 0
je 0x100487f6
mov dword [ebp - 0xc4], 1
jmp 0x100487fd
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x11c], eax
jmp 0x10048724
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x34], 0
jmp 0x1004882f
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10048845
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x168], 0x8bbca631
jmp 0x10048828
mov dword [ebp - 0x4c], 1
jmp 0x10048855
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1004886a
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
jmp 0x1004884e
mov byte [ebp - 0x18], 0
movzx eax, byte [ebp - 0x18]
test eax, eax
je 0x1004887e
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
jmp 0x10048c57
mov dword [ebp - 8], 7
mov dword [ebp - 0x104], 0x25429297
mov dword [ebp - 0xa8], 0x493876a4
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x38], 0
jmp 0x100488cc
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x100488e2
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x160], 0xa32f
jmp 0x100488c5
mov eax, dword [ebp - 8]
add eax, dword [ebp - 8]
cmp dword [ebp - 8], eax
jge 0x100488f9
mov dword [ebp - 0x114], 1
jmp 0x10048900
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 8], 0x26d8d383
jl 0x1004891b
mov dword [ebp - 0x80], 1
jmp 0x1004891f
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
dec eax
cmp eax, dword [ebp - 8]
jne 0x10048931
mov dword [ebp - 0x58], 1
jmp 0x10048935
and dword [ebp - 0x58], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp + eax - 0x160], ecx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x58]
cmp eax, 0x785b
jg 0x1004895e
mov dword [ebp - 0x88], 1
jmp 0x10048965
and dword [ebp - 0x88], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 8]
jg 0x1004897c
mov eax, 0x238e486a
test eax, eax
jne 0x1004898e
cmp dword [ebp - 0x104], 0
jne 0x1004898e
and dword [ebp - 0x90], 0
jmp 0x10048998
mov dword [ebp - 0x90], 1
mov eax, dword [ebp - 0x90]
add eax, 0xf9732ac
je 0x100489be
mov dword [ebp - 0x98], 0xe6fc2e60
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
jmp 0x10048a19
mov dword [ebp - 0xa0], 0xb26d5d64
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 8]
imul eax, dword [ebp - 0xa8]
test eax, eax
je 0x100489f4
mov dword [ebp - 0xb0], 1
jmp 0x100489fb
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x16], 0
movzx eax, byte [ebp - 0x16]
test eax, eax
je 0x10048a19
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov byte [ebp - 0x17], 0
movzx eax, byte [ebp - 0x17]
test eax, eax
je 0x10048a34
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x10c], 0xfff8
mov dword [ebp - 0x60], 0xcc013cef
mov dword [ebp - 0x5c], 0x4a2c6eb8
mov dword [ebp - 0x150], 0xfffffff9
mov dword [ebp - 0x40], 0
jmp 0x10048a7b
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10048a91
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x130], 0xcafa32fd
jmp 0x10048a74
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfa
jl 0x10048b5a
xor eax, eax
inc eax
sub eax, dword [ebp - 0x20]
je 0x10048ac1
mov eax, 0xc93cc254
test eax, eax
je 0x10048ac1
mov dword [ebp - 0xc0], 1
jmp 0x10048ac8
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xb8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb8]
mov dword [ebp + eax - 0x130], ecx
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xc0]
je 0x10048b04
mov dword [ebp - 0xc8], 1
jmp 0x10048b0b
and dword [ebp - 0xc8], 0
cmp dword [ebp - 0xc8], 1
je 0x10048b20
mov dword [ebp - 0xd0], 1
jmp 0x10048b27
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xd0], eax
jge 0x10048b41
mov dword [ebp - 0xe8], 1
jmp 0x10048b48
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x20], 0x9387
jge 0x10048b63
mov eax, 0xffff
test eax, eax
je 0x10048b73
xor eax, eax
je 0x10048b73
mov dword [ebp - 0xf8], 1
jmp 0x10048b7a
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x60], 0x593f6a08
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x10]
cmp dword [ebp - 0x5c], eax
je 0x10048bad
mov dword [ebp - 0x68], 1
jmp 0x10048bb1
and dword [ebp - 0x68], 0
cmp dword [ebp - 0x68], 0xfffffffc
je 0x10048bc3
mov dword [ebp - 0x100], 1
jmp 0x10048bca
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x60]
jg 0x10048bee
mov dword [ebp - 0x108], 1
jmp 0x10048bf5
and dword [ebp - 0x108], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x130]
mov dword [ebp - 0x110], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x110]
mov dword [ebp + eax - 0x130], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x20], 0
je 0x10048c39
cmp dword [ebp - 0x20], 0
je 0x10048c39
mov dword [ebp - 0x70], 1
jmp 0x10048c3d
and dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x15], 0
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x10048c57
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esp, ebp
pop ebp
ret