Function at 0x401000
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check os version
Enumerate gui resources
Get common file path
Get graphical window text
Log keystrokes via polling
Terminate process

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
mov edi, str.KHProgramCabFix
push edi
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x401032
push 0x64
push ebx
push 0x8104
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x401422
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40107e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessDPIAware
push ebp
call esi
cmp eax, ebx
je 0x401057
call eax
push str.ChangeWindowMessageFilter
push ebp
call esi
mov esi, eax
cmp esi, ebx
je 0x401077
push 1
push 0x8104
call esi
push 1
push 0x8500
call esi
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call sub.IMM32.dll_ImmDisableIME
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x8b
push eax
mov dword [0x405b28], eax
call esi
push 0x7f00
push ebx
mov dword [0x405b14], eax
call esi
push 0x30
pop ebp
mov dword [0x405b10], eax
mov eax, dword [0x405b28]
mov esi, 0x405860
push esi
mov dword [0x405860], ebp
mov dword [0x405864], 0x20
mov dword [0x405868], 0x40142d
mov dword [0x405874], eax
mov dword [0x405880], 0x10
mov dword [0x405888], edi
call dword [sym.imp.USER32.dll_RegisterClassExA]
push esi
push 0x3c
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [0x405860]
cmp eax, ebx
jge 0x401110
neg eax
push ebx
push dword [0x405b28]
inc eax
push ebx
push ebx
push ebp
push 0x60
push ebx
push ebx
push 0x80000000
push ebx
push edi
inc eax
push ebx
mov dword [0x405b50], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [0x40500c], eax
je 0x401422
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push dword [0x40500c]
call dword [sym.imp.USER32.dll_GetDC]
push 0x71
push dword [0x405b28]
mov dword [0x405b24], eax
call dword [sym.imp.USER32.dll_LoadMenuA]
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push 1
pop ebp
mov edi, eax
push ebp
push edi
mov dword [esp + 0x18], edi
call esi
push ebx
push edi
mov dword [0x405b30], eax
call esi
push 0xa
push eax
mov dword [0x405b2c], eax
call esi
push 6
push dword [0x405b2c]
mov dword [0x405b34], eax
call esi
mov dword [0x405b38], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0x22
jne 0x4011b7
inc esi
cmp byte [esi], 0x22
jne 0x4011af
jmp 0x4011bd
inc esi
cmp byte [esi], 0x20
ja 0x4011b7
mov ecx, esi
mov al, byte [esi]
cmp al, 0x20
je 0x4011c9
cmp al, 0x22
jne 0x4011cc
inc esi
jmp 0x4011bf
mov dword [ecx - 3], 0x6d6863
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x17700000
jge 0x40120b
mov dword [0x405b20], ebp
mov ebp, 0x40517c
xor edi, edi
push ebp
push esi
call fcn.00403a2e
test eax, eax
pop ecx
pop ecx
je 0x401200
mov dword [section..data], edi
add ebp, 4
inc edi
cmp edi, 3
jle 0x4011ed
jmp 0x401223
push 0x400
push 7
push dword [0x405b2c]
call dword [sym.imp.USER32.dll_RemoveMenu]
mov ebp, 0x40518c
xor edi, edi
push ebp
push esi
call fcn.00403a2e
cmp eax, ebx
pop ecx
pop ecx
mov dword [esp + 0x14], eax
je 0x401257
cmp edi, 4
jne 0x401249
push eax
call fcn.00403632
pop ecx
mov dword [0x405ad0], eax
jmp 0x401262
cmp edi, 0xa
jne 0x401262
or dword [0x405ad4], 1
jmp 0x401262
mov dword [edi*4 + 0x405ac0], 0x80000000
add ebp, 4
inc edi
cmp edi, 0xa
jle 0x401225
xor dword [0x405ad4], 0x80000001
cmp byte [0x405ad0], bl
jne 0x401284
mov byte [0x405ad0], 0x11
push ebp
push esi
mov dword [0x405aec], ebx
call fcn.00403a2e
cmp eax, ebx
pop ecx
pop ecx
mov dword [0x405b00], eax
je 0x4012b5
mov dword [0x405b04], eax
cmp byte [eax], bl
je 0x4012b5
mov cl, byte [eax]
inc eax
cmp cl, 0x2f
mov dword [0x405b04], eax
jne 0x4012a1
mov byte [eax - 1], bl
mov al, byte [esi]
cmp al, bl
je 0x401364
inc esi
cmp al, 0x2f
jne 0x4012b5
mov al, byte [esi]
cmp al, 0x2f
je 0x4012b5
jle 0x4012ed
cmp al, 0x39
jg 0x4012ed
push esi
call fcn.00403632
pop ecx
mov dword [0x405ae8], eax
mov al, byte [esi]
cmp al, bl
je 0x4012b5
cmp al, 0x2a
je 0x401350
cmp al, 0x2f
je 0x40134a
inc esi
jmp 0x4012dc
cmp al, 0x4d
jne 0x4012fa
or byte [0x405b6d], 1
jmp 0x40134a
cmp al, 0x4f
jne 0x401307
or byte [0x405b6d], 2
jmp 0x40134a
cmp al, 0x57
jne 0x401314
or byte [0x405b6d], 4
jmp 0x40134a
cmp al, 0x49
jne 0x401321
or byte [0x405b6d], 8
jmp 0x40134a
cmp al, 0x4c
jne 0x40132e
or byte [0x405b6d], 0x10
jmp 0x40134a
cmp al, 0x46
jne 0x40133b
or byte [0x405b6d], 0x20
jmp 0x40134a
cmp al, 0x4e
jne 0x4012b5
or byte [0x405b6d], 0x40
inc esi
jmp 0x4012c4
lea eax, [esi + 1]
push eax
call fcn.00403632
pop ecx
mov dword [0x405aec], eax
jmp 0x4012b5
cmp dword [0x405ae8], ebx
jg 0x401376
mov dword [0x405ae8], 0x80000000
push 0x10
mov esi, 0x405654
pop edi
push ebx
push edi
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4013a3
cmp byte [esi], bl
mov eax, esi
je 0x401397
inc eax
cmp byte [eax], bl
jne 0x401392
mov dword [eax], 0x5c
inc eax
mov dword [esi - 4], eax
jmp 0x4013a6
mov dword [esi - 4], ebx
add edi, 9
add esi, 0x108
cmp edi, 0x19
jle 0x40137e
push 0xfffffffffffffff0
push 0x8027
call fcn.00402503
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
pop ecx
pop ecx
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
je 0x401406
cmp dword [esp + 0x18], 0x8500
je 0x4013ed
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4013fc
push dword [esp + 0x20]
push dword [esp + 0x20]
push ebx
push ebx
call fcn.00401b60
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
jmp 0x4013d0
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_DestroyMenu]
push dword [0x405b68]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]