Function at 0x496d10
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edi, dword [esp + 0x64]
mov dword [esp + 0x10], eax
push edi
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov esi, eax
lea ebp, [esi - 2]
push ebp
push edi
call fcn.00486290
add esp, 8
add esi, 0xfffffffe
push 0x400
push esi
push edi
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0
push 0x499602d2
push 0xc00
push ebp
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
lea eax, [esp + 0x5c]
push 0x11170
push eax
call fcn.004bc8d0
mov ecx, dword [0x546560]
mov edx, 0x54ca34
add esp, 8
mov dword [esp + 0x1c], ecx
test edx, edx
je 0x496dca
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call ebx
mov esi, eax
test esi, esi
je 0x496dd0
push esi
lea ecx, [esp + 0x20]
call fcn.00405530
test eax, eax
je 0x496dd0
mov eax, dword [esp + 0x1c]
inc esi
push esi
push 0x54ca34
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x1c]
push 0xffffffffffffffff
call fcn.00405bb0
jmp 0x496dd0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x546560]
mov edx, 0x54a270
test edx, edx
mov dword [esp + 0x18], ecx
je 0x496e19
push edx
call ebx
mov esi, eax
test esi, esi
je 0x496e19
push esi
lea ecx, [esp + 0x1c]
call fcn.00405530
test eax, eax
je 0x496e19
mov eax, dword [esp + 0x18]
inc esi
push esi
push 0x54a270
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x18]
push 0xffffffffffffffff
call fcn.00405bb0
mov ecx, dword [0x546560]
mov edx, 0x5481c4
test edx, edx
mov dword [esp + 0x64], ecx
je 0x496e62
push edx
call ebx
mov esi, eax
test esi, esi
je 0x496e62
push esi
lea ecx, [esp + 0x68]
call fcn.00405530
test eax, eax
je 0x496e62
mov eax, dword [esp + 0x64]
inc esi
push esi
push 0x5481c4
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x64]
push 0xffffffffffffffff
call fcn.00405bb0
lea ecx, [esp + 0x48]
push 0xca
push ecx
call fcn.004bc8d0
mov edx, dword [0x546560]
mov ecx, dword [esp + 0x6c]
mov eax, dword [eax]
add esp, 8
mov dword [esp + 0x24], edx
mov edx, dword [eax - 8]
push ecx
mov ecx, dword [ecx - 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x34]
call fcn.004059f0
lea eax, [esp + 0x24]
lea ecx, [esp + 0x44]
push eax
call fcn.00405440
lea ecx, [esp + 0x24]
call fcn.00405700
lea ecx, [esp + 0x4c]
push 0x14439
push ecx
call fcn.004bc8d0
mov edx, dword [0x546560]
mov eax, dword [eax]
add esp, 8
mov dword [esp + 0x28], edx
push eax
mov eax, dword [eax - 8]
push eax
mov eax, dword [esp + 0x4c]
push eax
mov ecx, dword [eax - 8]
push ecx
lea ecx, [esp + 0x38]
call fcn.004059f0
lea edx, [esp + 0x28]
lea ecx, [esp + 0x40]
push edx
call fcn.00405440
lea ecx, [esp + 0x28]
call fcn.00405700
mov eax, dword [0x546560]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax - 8]
mov eax, dword [esp + 0x44]
push ecx
push eax
mov edx, dword [eax - 8]
lea ecx, [esp + 0x38]
push edx
call fcn.004059f0
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push eax
call fcn.00405440
lea ecx, [esp + 0x2c]
call fcn.00405700
lea ecx, [esp + 0x50]
push 0x1443d
push ecx
call fcn.004bc8d0
mov edx, dword [0x546560]
mov eax, dword [eax]
add esp, 8
mov dword [esp + 0x30], edx
push eax
mov eax, dword [eax - 8]
push eax
mov eax, dword [esp + 0x44]
push eax
mov ecx, dword [eax - 8]
push ecx
lea ecx, [esp + 0x40]
call fcn.004059f0
lea edx, [esp + 0x30]
lea ecx, [esp + 0x38]
push edx
call fcn.00405440
lea ecx, [esp + 0x30]
call fcn.00405700
mov eax, dword [0x546560]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax - 8]
mov eax, dword [esp + 0x3c]
push ecx
push eax
mov edx, dword [eax - 8]
lea ecx, [esp + 0x40]
push edx
call fcn.004059f0
lea eax, [esp + 0x34]
lea ecx, [esp + 0x58]
push eax
call fcn.00405440
lea ecx, [esp + 0x34]
call fcn.00405700
mov eax, dword [esp + 0x38]
mov edx, dword [0x546564]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x496fed
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x496fed
mov edx, dword [esp + 0x38]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x3c]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497018
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497018
mov edx, dword [esp + 0x3c]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x40]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497043
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497043
mov edx, dword [esp + 0x40]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x44]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49706e
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x49706e
mov edx, dword [esp + 0x44]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x48]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497099
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497099
mov edx, dword [esp + 0x48]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x4c]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4970c4
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4970c4
mov edx, dword [esp + 0x4c]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x50]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4970ef
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4970ef
mov edx, dword [esp + 0x50]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x64]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49711a
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x49711a
mov edx, dword [esp + 0x64]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497145
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497145
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x1c]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497170
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497170
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [0x546560]
mov ecx, 0x54ca30
test ecx, ecx
mov dword [esp + 0x64], eax
je 0x4971bc
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x4971bc
push esi
lea ecx, [esp + 0x68]
call fcn.00405530
test eax, eax
je 0x4971bc
mov edx, dword [esp + 0x64]
inc esi
push esi
push 0x54ca30
push edx
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x64]
push 0xffffffffffffffff
call fcn.00405bb0
lea eax, [esp + 0x50]
push 0xca
push eax
call fcn.004bc8d0
mov ecx, dword [0x546560]
mov eax, dword [eax]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x6c]
add esp, 8
mov edx, dword [ecx - 8]
push ecx
push edx
push eax
mov eax, dword [eax - 8]
push eax
lea ecx, [esp + 0x54]
call fcn.004059f0
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x58]
call fcn.00405440
lea ecx, [esp + 0x44]
call fcn.00405700
mov eax, dword [esp + 0x50]
mov ecx, dword [0x546564]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x497233
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497233
mov eax, dword [esp + 0x50]
add eax, 0xfffffff4
push eax
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x64]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49725e
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x49725e
mov edx, dword [esp + 0x64]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [0x546560]
push 0x49960278
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
push 0x1b207
lea eax, [esp + 0x1c]
push 0x54ca24
push eax
call fcn.00405cb0
mov ecx, dword [0x546560]
mov edx, 0x5481c4
add esp, 0x10
mov dword [esp + 0x64], ecx
test edx, edx
je 0x4972d4
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x4972d4
push esi
lea ecx, [esp + 0x68]
call fcn.00405530
test eax, eax
je 0x4972d4
mov eax, dword [esp + 0x64]
inc esi
push esi
push 0x5481c4
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x64]
push 0xffffffffffffffff
call fcn.00405bb0
mov ecx, dword [0x546560]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x44], ecx
push eax
mov edx, dword [eax - 8]
mov eax, dword [esp + 0x18]
push edx
push eax
mov eax, dword [eax - 8]
lea ecx, [esp + 0x50]
push eax
call fcn.004059f0
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x44]
call fcn.00405440
lea ecx, [esp + 0x44]
call fcn.00405700
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
mov edx, dword [eax - 8]
push edx
call fcn.00405a90
mov eax, dword [esp + 0x40]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49734d
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x49734d
mov edx, dword [esp + 0x40]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x64]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497378
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497378
mov edx, dword [esp + 0x64]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
push 0x49960278
push 0x1b209
lea eax, [esp + 0x1c]
push 0x54ca24
push eax
call fcn.00405cb0
mov ecx, dword [0x546560]
mov edx, 0x5481c4
add esp, 0x10
mov dword [esp + 0x64], ecx
test edx, edx
je 0x4973e1
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x4973e1
push esi
lea ecx, [esp + 0x68]
call fcn.00405530
test eax, eax
je 0x4973e1
mov eax, dword [esp + 0x64]
inc esi
push esi
push 0x5481c4
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x64]
push 0xffffffffffffffff
call fcn.00405bb0
mov ecx, dword [0x546560]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x44], ecx
push eax
mov edx, dword [eax - 8]
mov eax, dword [esp + 0x18]
push edx
push eax
mov eax, dword [eax - 8]
lea ecx, [esp + 0x50]
push eax
call fcn.004059f0
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x44]
call fcn.00405440
lea ecx, [esp + 0x44]
call fcn.00405700
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
mov edx, dword [eax - 8]
push edx
call fcn.00405a90
mov eax, dword [esp + 0x40]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x49745a
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x49745a
mov edx, dword [esp + 0x40]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x64]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x497485
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x497485
mov edx, dword [esp + 0x64]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
push 0x49960278
push 0x1b20d
lea eax, [esp + 0x1c]
push 0x54ca24
push eax
call fcn.00405cb0
add esp, 0x10
lea ecx, [esp + 0x64]
push 0x5481c4
call fcn.00405730
lea ecx, [esp + 0x64]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x54]
push edx
push eax
call fcn.00412dc0
push eax
lea ecx, [esp + 0x24]
call fcn.00413220
lea ecx, [esp + 0x50]
call fcn.00405700
lea ecx, [esp + 0x64]
call fcn.00405700
push 0x1b208
lea ecx, [esp + 0x18]
push 0x547b34
push ecx
call fcn.00405cb0
add esp, 0xc
lea ecx, [esp + 0x64]
push 0x5481c4
call fcn.00405730
lea edx, [esp + 0x64]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x54]
push eax
push ecx
call fcn.00412dc0
push eax
lea ecx, [esp + 0x24]
call fcn.00413220
lea ecx, [esp + 0x50]
call fcn.00405700
lea ecx, [esp + 0x64]
call fcn.00405700
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
push edx
lea esi, [ebp + 1]
push eax
push 0x410
push esi
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
push esi
push 0x49960278
push edi
call fcn.004861f0
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
add esp, 0xc
push ecx
push 0x1b207
push 0
push edx
call esi
lea eax, [esp + 0x64]
push 0x7e5
push eax
call fcn.004bc8d0
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
add esp, 8
push eax
push 0x1b209
push 0
push ecx
call esi
lea ecx, [esp + 0x64]
call fcn.00405700
lea edx, [esp + 0x64]
push 0x3ea
push edx
call fcn.004bc8d0
mov eax, dword [eax]
add esp, 8
push eax
mov eax, dword [esp + 0x14]
push 0x1b20d
push 0
push eax
call esi
lea ecx, [esp + 0x64]
call fcn.00405700
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0xc00
push ecx
call esi
lea edx, [esp + 0x64]
push 0x11174
push edx
call fcn.004bc8d0
mov eax, dword [eax]
add esp, 8
push eax
mov eax, dword [esp + 0x14]
push 0x1b218
push 0
push eax
call esi
lea ecx, [esp + 0x64]
call fcn.00405700
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0xc00
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.SHA256
push 0x1b213
push 0
push edx
call esi
mov eax, dword [esp + 0x10]
push str.SHA256__PS_
push 0x1b214
push 0
push eax
call esi
lea ecx, [esp + 0x64]
push 0x4e24
push ecx
call fcn.004bc8d0
mov eax, dword [eax]
add esp, 8
lea ebx, [ebp + 2]
push eax
push 0x1b208
push 0x400
push ebx
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
lea ecx, [esp + 0x64]
call fcn.00405700
push 0
push 0x499602d3
add ebp, 3
push 0xc00
push ebp
mov ebp, dword [sym.imp.USER32.dll_InsertMenuW]
push edi
call ebp
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x497804
mov dword [esp + 0x64], 0
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x54ca30
lea ecx, [esp + 0x54]
mov dword [esp + 0x68], eax
call fcn.00405730
lea edx, [esp + 0x50]
lea eax, [esp + 0x48]
push edx
push 0x11170
push eax
call fcn.004bc8d0
add esp, 8
lea ecx, [esp + 0x50]
push eax
push ecx
call fcn.00412dc0
lea ecx, [esp + 0x48]
call fcn.00405700
lea ecx, [esp + 0x50]
call fcn.00405700
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x64]
push edx
push eax
push 0x410
push ebx
push edi
call ebp
mov ecx, dword [esp + 0x64]
push str.Ceate_Hard_Link_to_this
push 0x1b20a
push 0
push ecx
call esi
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x64]
push edx
push 0x1b20b
push 0
push eax
call esi
mov ecx, dword [esp + 0x64]
push str.Media_test_1
push 0x1b20e
push 0
push ecx
call esi
mov edx, dword [esp + 0x64]
push str.Base64
push 0x10f48d
push 0
push edx
call esi
mov eax, dword [esp + 0x64]
push str.Properity_Test
push 0x10f48e
push 0
push eax
call esi
mov ecx, dword [esp + 0x64]
push str.File2Array
push 0x10f48f
push 0
push ecx
call esi
mov edx, dword [esp + 0x64]
push 0
push 0x499602d3
push 0xc00
push edx
call esi
mov eax, dword [esp + 0x64]
push str.regsvr32.exe
push 0x1b20f
push 0
push eax
call esi
push str.regsvr32.exe__u
push 0x1b210
push 0
mov ecx, dword [esp + 0x70]
push ecx
call esi
mov edx, dword [esp + 0x64]
push 0
push 0x499602d3
push 0xc00
push edx
call esi
mov eax, dword [esp + 0x64]
push str.regsvr32.exe__WOW64_
push 0x1b211
push 0
push eax
call esi
mov ecx, dword [esp + 0x64]
push str.regsvr32.exe__u__WOW64_
push 0x1b212
push 0
push ecx
call esi
mov edx, dword [esp + 0x64]
push str.SHA256
push 0x1b213
push 0
push edx
call esi
lea ecx, [esp + 0x4c]
call fcn.00405700
mov eax, dword [0x55cfbc]
test eax, eax
jne 0x49782b
push 0x24
call fcn.00531ba5
add esp, 4
test eax, eax
je 0x497824
mov ecx, eax
call fcn.00485b90
jmp 0x497826
xor eax, eax
mov dword [0x55cfbc], eax
push 0x499602d3
push 0x499602d2
push edi
mov ecx, eax
call fcn.00486150
mov eax, dword [0x55cfbc]
lea ecx, [esp + 0x20]
mov dword [eax + 0x1c], edi
call fcn.00405700
lea ecx, [esp + 0x14]
call fcn.00405700
lea ecx, [esp + 0x54]
call fcn.00405700
lea ecx, [esp + 0x58]
call fcn.00405700
lea ecx, [esp + 0x5c]
call fcn.00405700
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4