Function at 0x444020
Capabilities:
Clear file content
Create directory
Create process on windows
Create thread
Get disk information
Get file system object information
Get system information on windows
Log keystrokes via polling
Set current directory
Write and execute a file

Disassembly:
push ecx
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [esp]
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x14], ecx
call dword [sym.imp.GDI32.dll_Escape]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x20], ecx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp]
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x14], ecx
call dword [sym.imp.GDI32.dll_TextOutW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_GetTextColor]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
mov edx, dword [sym.imp.GDI32.dll_GetWindowExtEx]
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_GetMapMode]
mov ecx, dword [esp]
or ecx, eax
push ecx
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [esp]
or ecx, eax
push 0
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [sym.imp.GDI32.dll_CreateBitmap]
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_GetViewportExtEx]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_GetBkColor]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.GDI32.dll_RestoreDC]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [sym.imp.GDI32.dll_SetMapMode]
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
mov edx, dword [esp]
push 0
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x18], edx
call dword [sym.imp.GDI32.dll_ScaleViewportExtEx]
mov ecx, dword [esp]
push 0
or ecx, eax
mov eax, dword [0x4eccb8]
mov dword [esp + 4], ecx
push 0
push eax
push 0
call dword [sym.imp.GDI32.dll_EnumFontsA]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.GDI32.dll_PtVisible]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x18], ecx
call dword [sym.imp.GDI32.dll_ScaleWindowExtEx]
mov edx, dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov ecx, dword [esp]
push 0
push 0
push 0
or eax, edx
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.GDI32.dll_GetDIBits]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_SaveDC]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.GDI32.dll_OffsetViewportOrgEx]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.GDI32.dll_GetClipBox]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov ecx, dword [esp]
or ecx, eax
push ecx
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_LoadBitmapA]
or dword [esp], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [esp]
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x14], ecx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_SetCursor]
or dword [esp], eax
call dword [sym.imp.USER32.dll_GetMessagePos]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_EndPaint]
mov edx, dword [esp]
push 1
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esp]
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x14], edx
call dword [sym.imp.USER32.dll_DrawTextA]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
push 0x28
push 0x1e
or ecx, eax
push 0x14
push 0xa
push ecx
push 0
push 0
push ecx
mov dword [esp + 0x30], ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
or dword [esp], eax
push 0
push 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_SetClassLongW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
or dword [esp], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ecx, dword [esp]
or ecx, eax
mov dword [esp], ecx
lea ecx, [esp]
push ecx
push 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esp]
or eax, ecx
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_LoadMenuW]
mov edx, dword [esp]
push 0
or edx, eax
mov dword [esp + 4], edx
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov dx, ax
mov eax, dword [esp]
and edx, 0xffff
push 1
or eax, edx
push 0
push eax
push 0
mov dword [esp + 0x10], eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
or dword [esp], eax
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_MessageBoxIndirectA]
mov ecx, dword [esp]
push 0
or ecx, eax
push ecx
push ecx
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_BeginPaint]
or dword [esp], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp]
push 0
movsx eax, ax
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov ecx, dword [esp]
push 0
or ecx, eax
push ecx
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esp]
push 0
or edx, eax
mov dword [esp + 4], edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, eax
mov eax, dword [sym.imp.USER32.dll_CheckDlgButton]
or ecx, eax
mov eax, dword [esp]
or eax, ecx
push eax
push 0
mov dword [esp + 8], eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_GetClassInfoExW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esp]
or ecx, eax
push ecx
push ecx
push 0
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
push ecx
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov edx, dword [esp]
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x14], edx
call dword [sym.imp.SETUPAPI.dll_SetupGetFileCompressionInfoW]
mov edx, dword [esp]
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x14], edx
call dword [sym.imp.SETUPAPI.dll_SetupGetFileCompressionInfoA]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
push 0
push ecx
push 0
mov dword [esp + 0x14], ecx
call dword [sym.imp.SETUPAPI.dll_SetupGetBinaryField]
mov ecx, dword [sym.imp.SETUPAPI.dll_SetupDecompressOrCopyFileW]
mov edx, dword [esp]
push 0
or eax, ecx
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x14], edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edx, dword [esp]
push 0
push edx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [esp]
push 0xffffffffffffffff
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edx, dword [esp]
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x10], edx
call dword [sym.imp.KERNEL32.dll_RaiseException]