Function at 0x47eb1e
Capabilities:
Create process on windows
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, 0x37
mov ebx, ecx
push edi
mov dword [ebp - 0x38], ebx
jg 0x47eb96
cmp esi, 0x34
jge 0x47eb8b
cmp esi, 0x13
je 0x47eb6c
cmp esi, 0x2e
je 0x47eb62
cmp esi, 0x30
jle 0x47ebb1
cmp esi, 0x32
jle 0x47eb8b
cmp esi, 0x33
jne 0x47ebb1
mov ecx, dword [ebx + 4]
call fcn.0046c193
jmp 0x47f460
call fcn.00481c30
jmp 0x47f460
mov ecx, dword [0x4c9204]
test ecx, ecx
je 0x47ebb1
cmp byte [ecx + 0x10], 0
jne 0x47ebb1
cmp dword [ecx + 0x24], 0
jbe 0x47ebb1
push 1
call fcn.00402454
jmp 0x47ebb1
push esi
call fcn.0047e8a0
jmp 0x47f460
cmp esi, 0x41
je 0x47f45b
cmp esi, 0x70
je 0x47f454
cmp esi, 0x73
je 0x47f44d
mov byte [ebp - 1], 0
cmp esi, 0x28
jne 0x47ebca
mov eax, dword [0x4c932c]
cmp eax, 4
jae 0x47ebca
add eax, 0x17
mov dword [ebp + 8], eax
mov esi, dword [ebx + 0xc0]
mov edi, dword [esi + 0x14]
mov eax, edi
imul eax, eax, 0xc
call section..text
mov eax, edi
shl eax, 2
mov dword [ebp - 0x4c], esp
call section..text
mov esi, dword [esi + 8]
and dword [ebp - 0x20], 0
and dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], esp
push 2
push 0xffffffffffffffff
push 0x100c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x47ed51
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc0]
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax + 0x14]
jae 0x47ed51
mov esi, dword [ebp - 8]
mov eax, dword [ebx + 0x5c]
imul esi, esi, 0xdc
mov edi, dword [ebp - 0x18]
and dword [ebp - 0x28], 0
add eax, esi
mov ecx, dword [eax]
mov dword [edi], ecx
cmp ecx, 1
jne 0x47ecf4
mov ecx, dword [eax + 0x7c]
call fcn.00435cb7
mov ecx, dword [eax + 0x20]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x3c], ecx
test ecx, ecx
jbe 0x47ecf4
mov ecx, dword [ebx + 0x5c]
mov edx, dword [eax + 0x18]
add ecx, esi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 4]
mov ecx, dword [edx + 4]
mov ax, word [ecx]
cmp ax, word [edi]
jne 0x47eca2
test ax, ax
je 0x47ec9e
mov ax, word [ecx + 2]
cmp ax, word [edi + 2]
jne 0x47eca2
add ecx, 4
add edi, 4
test ax, ax
jne 0x47ec7c
xor eax, eax
jmp 0x47eca7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47ecde
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 0x80]
mov ecx, dword [edx + 8]
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x47ecd5
test al, al
je 0x47ecd1
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x47ecd5
inc ecx
inc ecx
inc edi
inc edi
test al, al
jne 0x47ecb7
xor eax, eax
jmp 0x47ecda
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47ecee
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add edx, 0x28
cmp eax, dword [ebp - 0x3c]
jb 0x47ec73
jmp 0x47ecf1
mov dword [ebp - 0x28], edx
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x5c]
add esi, eax
cmp dword [esi], 0
jne 0x47ed09
mov eax, dword [esi + 0x78]
jmp 0x47ed0b
xor eax, eax
cmp dword [edi], 0
mov dword [edi + 4], eax
jne 0x47ed22
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 0x78]
mov ecx, dword [ebp - 0x2c]
inc dword [ebp - 0x24]
mov dword [ecx + edx*4], eax
mov eax, dword [ebx + 0xc0]
mov eax, dword [eax + 8]
inc dword [ebp - 0x20]
push 2
push dword [ebp - 8]
add edi, 0xc
push 0x100c
push eax
mov dword [ebp - 0x18], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x47ec1a
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
sub eax, edi
xor ebx, ebx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x20], ebx
je 0x47f460
mov esi, dword [ebp + 8]
push 0x24
pop eax
cmp edi, ebx
jbe 0x47edcd
cmp esi, 0x17
je 0x47ed7b
cmp esi, 0x18
jne 0x47ed97
cmp byte [0x4c920d], bl
je 0x47ed97
mov dword [ebp - 0x84], 9
mov dword [ebp - 0x70], 0x4c920d
push ebx
jmp 0x47edab
cmp esi, 0x19
je 0x47eda1
cmp esi, 0x1a
jne 0x47edcd
xor ecx, ecx
inc ecx
mov dword [ebp - 0x84], ecx
push ecx
mov dword [ebp - 0x80], eax
mov eax, edi
call fcn.004787ad
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00450a13
pop ecx
pop ecx
cmp eax, 6
jne 0x47f460
call fcn.00429550
cmp esi, 0x22
jne 0x47edf4
xor eax, eax
cmp edi, ebx
jbe 0x47edee
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx + eax*4]
test byte [ecx + 0x3c], 0x20
je 0x47ee27
inc eax
cmp eax, edi
jb 0x47eddd
push 0x23
pop esi
mov dword [ebp + 8], esi
cmp esi, 0x13
jne 0x47ee15
cmp dword [0x4c9204], ebx
je 0x47ee27
mov ecx, str.a4d77a09_10ea_4574_8c09_9b6e1a21c95f
call fcn.00412bbe
push 0xa
mov edx, eax
pop ecx
call fcn.0043a6ee
cmp esi, 0x1c
je 0x47f3fc
cmp esi, 0x1b
je 0x47f3fc
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x20], ebx
jbe 0x47f38e
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
imul eax, eax, 0xc
add eax, ecx
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
mov eax, dword [eax]
test eax, eax
jne 0x47f335
mov ecx, esi
call fcn.00411f38
test al, al
je 0x47f370
cmp dword [ebp + 8], 0x6c
jg 0x47f370
mov eax, dword [ebp + 8]
cmp eax, 0x6c
je 0x47f324
cmp eax, 0x24
jg 0x47efe8
je 0x47efdc
cmp eax, 0x1f
jg 0x47efa4
cmp eax, 0x1d
jge 0x47ef8c
cmp eax, 0x13
je 0x47ef49
cmp eax, 0x14
je 0x47ef3d
cmp eax, 0x15
je 0x47ef27
cmp eax, 0x16
je 0x47f2de
jle 0x47f370
cmp eax, 0x1a
jg 0x47f370
movzx eax, byte [0x4c9343]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
add ecx, 0xffffffe9
and eax, 4
or eax, ecx
push eax
mov ecx, esi
call fcn.0040e27a
mov edi, dword [ebp - 0x38]
cmp esi, dword [edi + 0xb8]
jne 0x47eefe
push 0
mov ecx, edi
call fcn.00478499
cmp esi, dword [edi + 0x84]
jne 0x47efd3
mov eax, dword [edi + 0xc0]
push 0
push 0xffffffffffffffff
push 0x1076
push dword [eax + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x47efd3
test byte [esi + 0x3c], 0x40
jne 0x47efd3
mov ecx, esi
call fcn.0040eaa3
jmp 0x47efd3
mov ecx, esi
call fcn.0040d26b
jmp 0x47efd3
cmp dword [0x4c9204], 0
je 0x47f370
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0xc0]
mov eax, dword [ecx + 0x2c]
mov al, byte [eax + 0xa]
shr al, 7
not al
test al, 1
jne 0x47ef77
push 0
push 0xa
call fcn.0044b048
mov ecx, dword [0x4c9204]
push 0
push 0xffffffffffffffff
push esi
call fcn.0040289e
jmp 0x47f370
add eax, 0xffffffe3
push eax
mov ecx, esi
call fcn.00407541
push 0x1e
pop ecx
call fcn.00411a61
jmp 0x47f370
sub eax, 0x20
je 0x47f3cc
dec eax
je 0x47efcc
dec eax
je 0x47efc3
dec eax
jne 0x47f370
mov ecx, esi
call fcn.0040e9c2
jmp 0x47efd3
mov ecx, esi
call fcn.0040ea30
jmp 0x47efd3
mov ecx, esi
call fcn.0040f8b7
mov byte [ebp - 1], 1
jmp 0x47f370
mov ecx, esi
call fcn.004078c0
jmp 0x47f370
cmp eax, 0x2b
jg 0x47f2c6
je 0x47f2bf
sub eax, 0x25
je 0x47f2a8
dec eax
je 0x47f037
dec eax
je 0x47f02b
dec eax
dec eax
je 0x47f01f
dec eax
jne 0x47f370
mov dl, 1
mov ecx, esi
call fcn.0046fe70
jmp 0x47f370
mov ecx, esi
call fcn.0040a456
jmp 0x47f370
mov ecx, esi
call fcn.0040750b
jmp 0x47f370
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
xor dl, dl
mov ecx, esi
mov byte [ebp - 9], 0
mov byte [ebp - 0x10], 1
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x80], 0x23
mov dword [ebp - 0x28], 0x4a5560
call fcn.004726e0
mov bl, al
mov eax, dword [esi]
neg bl
sbb bl, bl
inc bl
mov dword [ebp - 0x28], 0x4a5060
cmp byte [eax + 0x24], 0
mov edi, 0x48f94c
je 0x47f0bb
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0x20]
test ecx, ecx
jne 0x47f094
mov ecx, edi
mov edx, eax
call fcn.0043aa1a
test al, al
jne 0x47f0bb
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
test ecx, ecx
jne 0x47f0ad
mov ecx, edi
call fcn.00444f25
push eax
lea ecx, [ebp - 0x14]
call fcn.004019ea
test bl, bl
je 0x47f291
mov eax, dword [esi]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp dword [eax + 8], ecx
jbe 0x47f1ad
mov dword [ebp - 8], ecx
and dword [ebp - 0x34], 0
cmp byte [eax + 0x24], 0
mov byte [ebp - 0x30], 1
je 0x47f105
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ebp - 8]
test ecx, ecx
jne 0x47f0f2
mov ecx, edi
mov edx, dword [eax + 0x18]
call fcn.00444f25
push eax
lea ecx, [ebp - 0x34]
call fcn.004019c6
jmp 0x47f110
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.004019ea
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x47f119
mov ecx, edi
call fcn.004458d7
test al, al
jne 0x47f142
cmp byte [ebp - 0x30], al
je 0x47f12f
mov ecx, dword [ebp - 0x34]
call fcn.004444fe
inc dword [ebp - 0x1c]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x1c]
add dword [ebp - 8], 0x34
cmp ecx, dword [eax + 8]
jb 0x47f0d6
jmp 0x47f1ad
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x34], eax
je 0x47f155
mov edi, dword [ebp - 0x34]
push edi
push dword [0x4cf678]
lea eax, [ebp - 0x64]
push eax
call fcn.00444044
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.0044401c
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00450a13
pop ecx
pop ecx
mov ecx, dword [ebp - 0x64]
mov edi, eax
call fcn.004444fe
and dword [ebp - 0x5c], 0
cmp edi, 6
sete bl
cmp edi, 7
sete byte [ebp - 9]
cmp byte [ebp - 0x30], 0
je 0x47f1a8
mov ecx, dword [ebp - 0x34]
call fcn.004444fe
mov edi, 0x48f94c
test bl, bl
je 0x47f1d3
cmp dword [ebp - 0x14], 0
je 0x47f1ba
mov edi, dword [ebp - 0x14]
push 0
push 0
push edi
mov ecx, esi
call fcn.0040ecbf
push 0x1e
pop ecx
call fcn.00411a61
jmp 0x47f291
cmp byte [ebp - 9], 0
je 0x47f291
mov ecx, dword [esi]
cmp byte [ecx + 0x24], 0
je 0x47f1f9
cmp dword [ebp - 0x14], 0
je 0x47f1ee
mov edi, dword [ebp - 0x14]
push edi
call fcn.0041fad7
jmp 0x47f291
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], ecx
cmp eax, ecx
jne 0x47f20d
mov eax, edi
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x47f243
mov eax, dword [ebp - 0x14]
mov ecx, eax
test eax, eax
jne 0x47f22a
mov ecx, edi
jmp 0x47f22c
mov edi, eax
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x58]
call fcn.00443ef9
inc ebx
inc ebx
mov dword [ebp - 8], ebx
jmp 0x47f25e
call fcn.00445105
push eax
lea ecx, [ebp - 0x58]
call fcn.00443e75
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
test eax, eax
jne 0x47f25e
mov dword [ebp - 8], edi
mov ebx, dword [esi]
lea ecx, [ebp - 0x58]
call fcn.0044401c
push eax
mov ecx, ebx
call fcn.0041fad7
mov esi, dword [esi]
mov ecx, dword [ebp - 8]
mov ebx, dword [esi]
call fcn.00444cee
push eax
push ebx
mov ecx, esi
call fcn.0041faf1
mov ecx, dword [ebp - 0x58]
call fcn.004444fe
and dword [ebp - 0x50], 0
cmp byte [ebp - 0x10], 0
je 0x47f370
mov ecx, dword [ebp - 0x14]
call fcn.004444fe
jmp 0x47f370
mov eax, dword [esi]
xor edx, edx
cmp byte [eax + 0x24], dl
mov ecx, esi
sete dl
dec edx
call fcn.0047cb49
jmp 0x47f370
xor dl, dl
jmp 0x47f013
sub eax, 0x2c
je 0x47f316
dec eax
je 0x47f3f5
sub eax, 0xb
je 0x47f2ea
dec eax
jne 0x47f370
mov ecx, esi
call fcn.0040f968
jmp 0x47efd3
cmp dword [ebp - 0x40], 0
jbe 0x47f2fd
push 0x491f70
lea ecx, [ebp - 0x48]
call fcn.00443e75
mov ecx, esi
call fcn.00405368
mov ecx, eax
call fcn.0043adb2
push eax
lea ecx, [ebp - 0x48]
call fcn.00443e75
jmp 0x47f370
push 0
or edx, 0xffffffff
mov ecx, esi
call fcn.0047ac47
jmp 0x47f370
push 1
xor eax, eax
push eax
push eax
push dword [esi + 0x1c4]
jmp 0x47f3c2
cmp eax, 1
jne 0x47f370
mov ecx, dword [edi + 0x20]
call fcn.00435cb7
mov ecx, dword [ebp + 8]
sub ecx, 0x16
je 0x47f35b
sub ecx, 0x19
je 0x47f3b9
dec ecx
je 0x47f3ab
dec ecx
dec ecx
je 0x47f39b
sub ecx, 8
jne 0x47f370
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x3c]
mov ecx, edi
sbb eax, eax
and eax, 4
push eax
xor edx, edx
call fcn.004377ca
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jb 0x47ee3c
mov edx, dword [ebp - 0x40]
test edx, edx
jbe 0x47f38e
mov ecx, dword [ebp - 0x48]
call fcn.004694e8
mov ecx, dword [ebp - 0x48]
call fcn.004444fe
jmp 0x47f430
push dword [edi + 8]
mov edx, dword [edi + 4]
mov ecx, dword [eax + 0x10]
call fcn.00436ac4
jmp 0x47f370
mov ecx, edi
call fcn.00437ad6
call fcn.00481c30
jmp 0x47f370
push 1
xor eax, eax
push eax
push eax
push dword [edi + 8]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x47f370
call fcn.00429561
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
test ax, ax
jge 0x47f3ee
call fcn.0047866c
jmp 0x47f460
call fcn.0048d107
jmp 0x47f460
call fcn.00429561
jmp 0x47f460
xor eax, eax
cmp esi, 0x1b
sete al
push 0x10
add eax, 4
mov esi, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x47f419
or esi, 2
mov ecx, dword [ebp - 0x2c]
push esi
mov edx, edi
call fcn.0041307d
push 0x1e
pop ecx
call fcn.00411a61
mov byte [ebp - 1], 1
call fcn.00429561
cmp byte [ebp - 1], 0
je 0x47f443
mov ecx, dword [ebp - 0x38]
call fcn.0047da98
mov ecx, dword [ebp - 0x38]
call fcn.0047af58
jmp 0x47f460
call fcn.0047b8b9
jmp 0x47f460
call fcn.0047d439
jmp 0x47f460
call fcn.0047587e
lea esp, [ebp - 0x90]
pop edi
pop esi
pop ebx
leave
ret 4