Function at 0x438941
Capabilities:
Create thread
Delete file
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x124]
sub esp, 0x1a4
mov eax, dword [0x4755d0]
xor eax, ebp
mov dword [ebp + 0x120], eax
mov eax, dword [ebp + 0x130]
push ebx
push esi
mov esi, dword [ebp + 0x12c]
push edi
mov dword [ebp - 0x80], eax
xor eax, eax
mov word [ebp - 0x74], ax
lea edi, [ebp - 0x72]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
push 0x103
stosw word es:[edi], ax
lea eax, [ebp + 0x1d]
push ebx
push eax
mov dword [ebp - 0x78], esi
mov byte [ebp + 0x1c], bl
call fcn.00448090
push 0x3f
lea eax, [ebp - 0x63]
push ebx
push eax
mov byte [ebp - 0x64], bl
call fcn.00448090
push 0x3f
lea eax, [ebp - 0x23]
push ebx
push eax
mov byte [ebp - 0x24], bl
call fcn.00448090
add esp, 0x24
mov dword [ebp - 0x7c], ebx
cmp dword [ebp + 0x140], ebx
je 0x4389cb
push dword [ebp + 0x140]
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 0x138], ebx
je 0x4389da
mov dword [esi*4 + 0x477374], ebx
cmp dword [0x477340], ebx
je 0x4389e9
xor eax, eax
jmp 0x438dc8
mov eax, dword [esi*4 + 0x477354]
cmp eax, 1
jge 0x438a0e
push 0x12040
push str.System_Message
push str.The_file_is_empty._n_nPlease_add_commands_before_using_this_feature.
push dword [ebp - 0x80]
call fcn.0040248b
jmp 0x4389e2
dec eax
cmp dword [ebp + 0x13c], eax
jg 0x4389e2
lea eax, [ebp + 0x1c]
push eax
call fcn.004208b4
push ebx
push ebx
push str.RestartLog
call fcn.0040225d
test eax, eax
je 0x438a3a
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x405
cmp word [ebp + 0x134], ax
je 0x438a5d
add eax, 2
cmp word [ebp + 0x134], ax
jne 0x438d2b
jmp 0x438be8
push ebx
push ebx
push str.ResetUserVariables
call fcn.0040225d
test eax, eax
je 0x438ad3
push str.vTaskClass
call fcn.00442b83
cmp eax, 1
jg 0x438ad3
test byte [0x477400], 2
jne 0x438ad3
push str.SOFTWARE_vTaskUserVariables
push ebx
push ebx
push ebx
push 4
call fcn.00442f38
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x14
push ebx
push ebx
push 0x1009
push 0x508
push dword [0x4771d0]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x102f
push 0x508
push dword [0x4771d0]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor edx, edx
cmp dword [esi*4 + 0x477354], ebx
jle 0x438b09
lea eax, [esi*4 + 0x478a70]
xor ecx, ecx
mov edi, dword [eax]
mov dword [ecx + edi + 0xf28], ebx
mov edi, dword [eax]
mov byte [ecx + edi + 0xf24], bl
inc edx
add ecx, 0xf54
cmp edx, dword [esi*4 + 0x477354]
jl 0x438ae7
cmp dword [0x47740c], ebx
je 0x438b30
push dword [0x4771d4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x438b30
push 1
push ebx
push dword [0x4771d4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x40
push ebx
push 0x47be70
mov dword [0x4771e8], ebx
mov dword [0x47be68], ebx
mov dword [0x47be6c], ebx
mov dword [0x47be38], ebx
mov byte [0x47b208], bl
call fcn.00448090
push 0x100
push ebx
push 0x47beb0
call fcn.00448090
mov edi, esi
push 0x40
shl edi, 6
lea eax, [edi + 0x47b3b8]
push ebx
push eax
call fcn.00448090
push 0x40
lea eax, [edi + 0x47b5b8]
push ebx
push eax
call fcn.00448090
push 0x40
lea eax, [edi + 0x47b7b8]
push ebx
push eax
call fcn.00448090
push 0x40
lea eax, [edi + 0x47b9b8]
push ebx
push eax
call fcn.00448090
add esp, 0x48
push 0x40
lea eax, [edi + 0x47bbb8]
push ebx
push eax
call fcn.00448090
push 8
push ebx
push 0x47c258
call fcn.00448090
push 8
push ebx
push 0x47c260
call fcn.00448090
push 8
push ebx
push 0x47c268
call fcn.00448090
add esp, 0x30
push str.SOFTWARE_vTaskFailStep
push ebx
push ebx
push ebx
push 4
call fcn.00442f38
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
lea eax, [ebp + 0x1c]
push str.SOFTWARE_vTaskInterStepDelay__d
push eax
mov dword [0x47c470], ebx
call edi
add esp, 0x20
lea eax, [ebp + 0x1c]
push eax
call fcn.0040676e
push str.__r_n
call fcn.00421b06
lea eax, [ebp + 0x1c]
mov dword [esp], str._____START_OF_RUN
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + 0x1c]
push eax
call esi
push 0x3c
pop ecx
sub ecx, eax
jns 0x438c4d
xor ecx, ecx
jmp 0x438c58
lea eax, [ebp + 0x1c]
push eax
call esi
push 0x3c
pop ecx
sub ecx, eax
push ecx
push 0x2d
lea eax, [ebp + 0x1c]
push eax
call esi
lea eax, [ebp + eax + 0x1c]
push eax
call fcn.00448090
lea eax, [ebp + 0x1c]
push eax
mov byte [ebp + 0x58], bl
call fcn.00421b06
mov eax, dword [ebp - 0x78]
imul eax, eax, 0x104
add eax, 0x4775d8
push eax
lea eax, [ebp + 0x1c]
push str.SCRIPT:___s_
push eax
call edi
lea eax, [ebp + 0x1c]
push eax
call fcn.00421b06
add esp, 0x20
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x64]
push eax
movzx eax, word [ebp - 0x70]
push 1
push eax
call fcn.00417d7b
lea eax, [ebp - 0x24]
push eax
movzx eax, word [ebp - 0x72]
push 3
push eax
call fcn.00417d7b
movzx eax, word [ebp - 0x74]
push eax
lea eax, [ebp - 0x24]
push eax
movzx eax, word [ebp - 0x6e]
push eax
lea eax, [ebp - 0x64]
push eax
movzx eax, word [ebp - 0x68]
push eax
movzx eax, word [ebp - 0x6a]
push eax
movzx eax, word [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1c]
push str.TIME:____d:_02d:_02d_on__s___d__s__d
push eax
call edi
lea eax, [ebp + 0x1c]
push eax
call fcn.00421b06
add esp, 0x40
cmp byte [0x47b0e0], 2
jb 0x438d13
push str.LOG_LEVEL_HIGH
call fcn.00421b06
pop ecx
lea eax, [ebp + 0x1c]
push eax
push ebx
push 1
push dword [0x4771b4]
call fcn.00420796
mov esi, dword [ebp - 0x78]
add esp, 0x10
push ebx
push ebx
push str.DisableScreenSaver
call fcn.0040225d
test eax, eax
je 0x438d72
mov edi, str.HKEY_CURRENT_USERControl_PanelDesktopScreenSaveActive
push edi
push 0xf
lea eax, [ebp + 0x1c]
push eax
push ebx
push 3
call fcn.00442f38
push edi
push 2
push 0x45e8b4
push 1
push 2
call fcn.00442f38
push str.ScreenSaverHolder
lea eax, [ebp + 0x1c]
push ebx
push eax
call fcn.00445d9a
add esp, 0x34
movzx eax, byte [0x47500c]
push eax
mov dword [0x477418], ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp dword [ebp + 0x13c], ebx
jge 0x438d92
xor eax, eax
jmp 0x438da8
mov eax, dword [esi*4 + 0x477354]
dec eax
cmp dword [ebp + 0x13c], eax
jg 0x438da8
mov eax, dword [ebp + 0x13c]
shl esi, 0x1c
add esi, eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push esi
push 0x43807d
push ebx
push ebx
mov dword [ebp - 0x7c], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x477340], eax
mov ecx, dword [ebp + 0x120]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448080
add ebp, 0x124
leave
ret 0x18