Function at 0x47d111
Capabilities:
Create process on windows
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, 0x37
push edi
mov dword [ebp - 8], ecx
jg 0x47d184
cmp esi, 0x34
jge 0x47d179
cmp esi, 0x13
je 0x47d15a
cmp esi, 0x2e
je 0x47d150
cmp esi, 0x30
jle 0x47d19f
cmp esi, 0x32
jle 0x47d179
cmp esi, 0x33
jne 0x47d19f
mov ecx, dword [ecx + 4]
call fcn.0046ab81
jmp 0x47d832
call fcn.0047ffff
jmp 0x47d832
mov ecx, dword [0x4c60bc]
test ecx, ecx
je 0x47d19f
cmp byte [ecx + 0x10], 0
jne 0x47d19f
cmp dword [ecx + 0x24], 0
jbe 0x47d19f
push 1
call fcn.004025d9
jmp 0x47d19f
push esi
call fcn.0047ce8f
jmp 0x47d832
cmp esi, 0x41
je 0x47d82d
cmp esi, 0x70
je 0x47d826
cmp esi, 0x73
je 0x47d81f
mov byte [ebp - 1], 0
cmp esi, 0x28
jne 0x47d1b8
mov eax, dword [0x4c61e4]
cmp eax, 4
jae 0x47d1b8
add eax, 0x17
mov dword [ebp + 8], eax
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0xc0]
mov edi, dword [esi + 0x14]
mov eax, edi
imul eax, eax, 0xc
call section..text
mov eax, edi
shl eax, 2
mov dword [ebp - 0x30], esp
call section..text
mov esi, dword [esi + 8]
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push 2
push 0xffffffffffffffff
mov ebx, 0x100c
push ebx
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x47d346
mov eax, dword [ebp - 0x30]
mov edi, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0xc0]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax + 0x14]
jae 0x47d346
mov esi, dword [ebp - 0x20]
mov eax, dword [edi + 0x5c]
imul esi, esi, 0xdc
mov edx, dword [ebp - 0x18]
and dword [ebp - 0x28], 0
add eax, esi
mov ecx, dword [eax]
mov dword [edx], ecx
cmp ecx, 1
jne 0x47d2ec
mov ecx, dword [eax + 0x7c]
call fcn.00434c4d
mov ecx, dword [eax + 0x20]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x34], ecx
test ecx, ecx
jbe 0x47d2ec
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x5c]
mov edi, dword [eax + 0x18]
add ecx, esi
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 4]
mov ecx, dword [edi + 4]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x47d29a
test ax, ax
je 0x47d296
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x47d29a
add ecx, 4
add edx, 4
test ax, ax
jne 0x47d274
xor eax, eax
jmp 0x47d29f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47d2d6
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 0x80]
mov ecx, dword [edi + 8]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x47d2cd
test al, al
je 0x47d2c9
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x47d2cd
inc ecx
inc ecx
inc edx
inc edx
test al, al
jne 0x47d2af
xor eax, eax
jmp 0x47d2d2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47d2e6
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add edi, 0x28
cmp eax, dword [ebp - 0x34]
jb 0x47d26b
jmp 0x47d2e9
mov dword [ebp - 0x28], edi
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov dword [edx + 8], eax
mov eax, dword [edi + 0x5c]
add eax, esi
cmp dword [eax], 0
jne 0x47d304
mov ecx, dword [eax + 0x78]
jmp 0x47d306
xor ecx, ecx
cmp dword [edx], 0
mov dword [edx + 4], ecx
jne 0x47d31d
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x10]
mov dword [ecx + edx*4], eax
mov eax, dword [edi + 0xc0]
mov eax, dword [eax + 8]
inc dword [ebp - 0xc]
add dword [ebp - 0x18], 0xc
push 2
push dword [ebp - 0x20]
push ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
jne 0x47d20f
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
sub eax, edi
xor ebx, ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0xc], ebx
je 0x47d832
mov esi, dword [ebp + 8]
cmp edi, ebx
jbe 0x47d3ba
cmp esi, 0x17
je 0x47d36d
cmp esi, 0x18
jne 0x47d386
cmp byte [0x4c60c5], bl
je 0x47d386
mov dword [ebp - 0x60], 9
mov dword [ebp - 0x4c], 0x4c60c5
push ebx
jmp 0x47d397
cmp esi, 0x19
je 0x47d390
cmp esi, 0x1a
jne 0x47d3ba
xor eax, eax
inc eax
mov dword [ebp - 0x60], eax
push eax
mov eax, edi
mov dword [ebp - 0x5c], 0x24
call fcn.00477187
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0044f78b
pop ecx
pop ecx
cmp eax, 6
jne 0x47d832
call fcn.00428703
cmp esi, 0x22
jne 0x47d3e1
xor eax, eax
cmp edi, ebx
jbe 0x47d3db
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + eax*4]
test byte [ecx + 0x3c], 0x20
je 0x47d414
inc eax
cmp eax, edi
jb 0x47d3ca
push 0x23
pop esi
mov dword [ebp + 8], esi
cmp esi, 0x13
jne 0x47d402
cmp dword [0x4c60bc], ebx
je 0x47d414
mov ecx, str.a4d77a09_10ea_4574_8c09_9b6e1a21c95f
call fcn.0041287b
push 0xa
mov edx, eax
pop ecx
call fcn.00439637
cmp esi, 0x1c
je 0x47d7ce
cmp esi, 0x1b
je 0x47d7ce
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0xc], ebx
jbe 0x47d762
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
xor ebx, ebx
jmp 0x47d436
mov eax, dword [ebp - 0x20]
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
mov eax, dword [eax]
cmp eax, ebx
jne 0x47d705
mov ecx, esi
call fcn.00411c00
test al, al
je 0x47d740
mov eax, dword [ebp + 8]
cmp eax, 0x6c
jg 0x47d740
je 0x47d6f6
cmp eax, 0x24
jg 0x47d5cb
je 0x47d5bf
cmp eax, 0x1f
jg 0x47d587
cmp eax, 0x1d
jge 0x47d56f
cmp eax, 0x13
je 0x47d52f
cmp eax, 0x14
je 0x47d523
cmp eax, 0x15
je 0x47d50d
cmp eax, 0x16
je 0x47d6b2
jle 0x47d740
cmp eax, 0x1a
jg 0x47d740
movzx ecx, byte [0x4c61fb]
neg ecx
sbb ecx, ecx
and ecx, 4
add eax, 0xffffffe9
or ecx, eax
push ecx
mov ecx, esi
call fcn.0040e028
mov edi, dword [ebp - 8]
cmp esi, dword [edi + 0xb8]
jne 0x47d4e5
push ebx
mov ecx, edi
call fcn.00476eb2
cmp esi, dword [edi + 0x84]
jne 0x47d5b6
mov eax, dword [edi + 0xc0]
push ebx
push 0xffffffffffffffff
push 0x1076
push dword [eax + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x47d5b6
test byte [esi + 0x3c], 0x40
jne 0x47d5b6
mov ecx, esi
call fcn.0040e84b
jmp 0x47d5b6
mov ecx, esi
call fcn.0040d07f
jmp 0x47d5b6
cmp dword [0x4c60bc], ebx
je 0x47d740
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc0]
mov eax, dword [ecx + 0x2c]
mov al, byte [eax + 0xa]
shr al, 7
not al
test al, 1
jne 0x47d55b
push ebx
push 0xa
call fcn.00449dad
mov ecx, dword [0x4c60bc]
push ebx
push 0xffffffffffffffff
push esi
call fcn.00402a23
jmp 0x47d740
add eax, 0xffffffe3
push eax
mov ecx, esi
call fcn.0040745c
push 0x1e
pop ecx
call fcn.00411729
jmp 0x47d740
sub eax, 0x20
je 0x47d79e
dec eax
je 0x47d5af
dec eax
je 0x47d5a6
dec eax
jne 0x47d740
mov ecx, esi
call fcn.0040e76a
jmp 0x47d5b6
mov ecx, esi
call fcn.0040e7d8
jmp 0x47d5b6
mov ecx, esi
call fcn.0040f61a
mov byte [ebp - 1], 1
jmp 0x47d740
mov ecx, esi
call fcn.004077db
jmp 0x47d740
cmp eax, 0x2b
jg 0x47d69a
je 0x47d693
sub eax, 0x25
je 0x47d67c
dec eax
je 0x47d61a
dec eax
je 0x47d60e
dec eax
dec eax
je 0x47d602
dec eax
jne 0x47d740
mov dl, 1
mov ecx, esi
call fcn.0046e843
jmp 0x47d740
mov ecx, esi
call fcn.0040a398
jmp 0x47d740
mov ecx, esi
call fcn.00407426
jmp 0x47d740
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
xor dl, dl
mov ecx, esi
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x28], 1
mov dword [ebp - 0x30], 0x4a32ac
call fcn.004710e3
neg al
sbb al, al
inc al
mov dword [ebp - 0x30], 0x4a2e60
je 0x47d65e
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
jne 0x47d654
mov eax, 0x492538
push ebx
push ebx
push eax
mov ecx, esi
call fcn.0040ea65
push 0x1e
pop ecx
call fcn.00411729
cmp byte [ebp - 0x28], bl
je 0x47d740
mov ecx, dword [ebp - 0x2c]
call fcn.004433ab
jmp 0x47d740
mov eax, dword [esi]
xor edx, edx
cmp byte [eax + 0x24], bl
mov ecx, esi
sete dl
dec edx
call fcn.004797db
jmp 0x47d740
xor dl, dl
jmp 0x47d5f6
sub eax, 0x2c
je 0x47d6e9
dec eax
je 0x47d7c7
sub eax, 0xb
je 0x47d6be
dec eax
jne 0x47d740
mov ecx, esi
call fcn.0040f6c9
jmp 0x47d5b6
cmp dword [ebp - 0x38], ebx
jbe 0x47d6d0
push 0x48ff60
lea ecx, [ebp - 0x40]
call fcn.00442d22
mov ecx, esi
call fcn.0040537f
mov ecx, eax
call fcn.00439cf8
push eax
lea ecx, [ebp - 0x40]
call fcn.00442d22
jmp 0x47d740
push ebx
or edx, 0xffffffff
mov ecx, esi
call fcn.00479544
jmp 0x47d740
push 1
push ebx
push ebx
push dword [esi + 0x1c0]
jmp 0x47d794
cmp eax, 1
jne 0x47d740
mov ecx, dword [edi + 0x20]
call fcn.00434c4d
mov ecx, dword [ebp + 8]
sub ecx, 0x16
je 0x47d72b
sub ecx, 0x19
je 0x47d78d
dec ecx
je 0x47d77f
dec ecx
dec ecx
je 0x47d76f
sub ecx, 8
jne 0x47d740
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x34]
mov ecx, edi
sbb eax, eax
and eax, 4
push eax
xor edx, edx
call fcn.004366e5
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x20], 0xc
cmp eax, dword [ebp - 0xc]
jb 0x47d433
mov edx, dword [ebp - 0x38]
cmp edx, ebx
jbe 0x47d762
mov ecx, dword [ebp - 0x40]
call fcn.00467f46
mov ecx, dword [ebp - 0x40]
call fcn.004433ab
jmp 0x47d802
push dword [edi + 8]
mov edx, dword [edi + 4]
mov ecx, dword [eax + 0x10]
call fcn.00435a93
jmp 0x47d740
mov ecx, edi
call fcn.004369f1
call fcn.0047ffff
jmp 0x47d740
push 1
push ebx
push ebx
push dword [edi + 8]
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x47d740
call fcn.00428714
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
test ax, ax
jge 0x47d7c0
call fcn.00477046
jmp 0x47d832
call fcn.0048b497
jmp 0x47d832
call fcn.00428714
jmp 0x47d832
xor eax, eax
cmp esi, 0x1b
sete al
push 0x10
add eax, 4
mov esi, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x47d7eb
or esi, 2
mov ecx, dword [ebp - 0x14]
push esi
mov edx, edi
call fcn.00412d3a
push 0x1e
pop ecx
call fcn.00411729
mov byte [ebp - 1], 1
call fcn.00428714
cmp byte [ebp - 1], 0
je 0x47d815
mov ecx, dword [ebp - 8]
call fcn.0047c284
mov ecx, dword [ebp - 8]
call fcn.0047983a
jmp 0x47d832
call fcn.0047a17d
jmp 0x47d832
call fcn.0047bc1e
jmp 0x47d832
call fcn.004740a8
lea esp, [ebp - 0x6c]
pop edi
pop esi
pop ebx
leave
ret 4