Function at 0x4013e0
Capabilities:
Compare security identifiers
Create directory
Delete registry key
Delete registry value
Enumerate files on windows
Get common file path
Log keystrokes via polling
Query or enumerate registry value
Resume thread
Set current directory
Terminate thread

Disassembly:
push ecx
push 0
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
mov ecx, dword [esp]
push 1
or ecx, eax
push 0
push ecx
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_GetClassNameW]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_GetClassInfoExW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, dword [esp]
push 0
push 0
push 0
and eax, 0xffff
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp]
or ecx, eax
push ecx
push ecx
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp]
push 0
movsx eax, ax
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_LoadMenuW]
mov ecx, dword [esp]
push 0
or ecx, eax
push ecx
push ecx
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov ecx, dword [esp]
or ecx, eax
push ecx
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov edx, dword [esp]
push 1
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esp]
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x14], ecx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esp]
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x14], ecx
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.GDI32.dll_PtVisible]
or dword [esp], eax
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_GetMapMode]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.GDI32.dll_GetDIBits]
mov edx, dword [esp]
push 0
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x18], edx
call dword [sym.imp.GDI32.dll_ScaleViewportExtEx]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.GDI32.dll_OffsetViewportOrgEx]
mov edx, dword [sym.imp.GDI32.dll_CreateBitmap]
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
mov ecx, dword [0x409db0]
push ecx
push 0
call dword [sym.imp.GDI32.dll_EnumFontsA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp]
or ecx, eax
push ecx
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [sym.imp.GDI32.dll_SetMapMode]
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_GetBkColor]
mov ecx, dword [esp]
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x14], ecx
call dword [sym.imp.GDI32.dll_TextOutW]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_GetViewportExtEx]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_GetTextColor]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_SaveDC]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edx, dword [esp]
push 0
or edx, eax
mov dword [esp + 4], edx
mov edx, dword [0x409db0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [esp]
or ecx, eax
mov eax, dword [0x409db0]
push ecx
push 0
push eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov ecx, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, dword [esp]
push 0
push 0
or eax, ecx
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
mov ecx, dword [esp]
mov edx, dword [0x409db0]
or ecx, eax
push edx
push ecx
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [sym.imp.KERNEL32.dll_GetDateFormatA]
mov edx, dword [esp]
or eax, ecx
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [esp]
or ecx, eax
push ecx
push ecx
push ecx
push ecx
push 0xffffffffffffffff
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov ecx, dword [esp]
or ecx, eax
push 0
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, dword [esp]
or edx, eax
mov eax, dword [0x409db0]
push eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp]
push 0
or ecx, eax
push ecx
push 0
push ecx
push ecx
push 0
push ecx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
mov edx, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov ecx, eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
or ecx, edx
mov edx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
or ecx, eax
mov eax, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
or ecx, edx
or ecx, eax
mov eax, dword [esp]
lea edx, [esp]
or eax, ecx
push edx
lea ecx, [esp + 4]
push 0
push ecx
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
push 0
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
or eax, dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
mov edx, dword [esp]
or edx, eax
mov eax, dword [0x408848]
push eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
mov ecx, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
or eax, edx
mov edx, dword [esp]
or eax, ecx
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ecx, dword [esp]
or ecx, eax
mov dword [esp], ecx
mov ecx, dword [0x408848]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeDisplayNameW]
mov edx, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
or eax, ecx
mov ecx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
or eax, edx
mov edx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeDisplayNameA]
or eax, ecx
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSid]
mov edx, dword [esp]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x30], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
mov edx, eax
mov eax, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
or edx, ecx
or edx, eax
mov eax, dword [esp]
push 0
push 0
or eax, edx
push 0
push 0
push eax
push 0
push 0
push 0
push 0
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [esp]
or ecx, eax
push 0
mov dword [esp + 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or eax, ecx
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or eax, edx
mov edx, dword [esp]
or eax, ecx
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp]
or ecx, eax
mov eax, ecx
pop ecx
ret