Function at 0x4f13b0
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
sub esp, 0x50
push ebx
mov eax, dword [0x547570]
push ebp
push esi
mov esi, dword [0x55b2a8]
mov ebp, ecx
xor ecx, ecx
cmp esi, 2
sete cl
test ecx, ecx
push edi
mov dword [esp + 0x10], eax
je 0x4f142d
mov eax, 0x5490a4
test eax, eax
jne 0x4f13e1
xor ebx, ebx
jmp 0x4f13ee
push 0x5490a4
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00405660
test eax, eax
je 0x4f1429
mov edi, dword [esp + 0x10]
lea eax, [ebx + ebx]
mov ecx, eax
mov esi, 0x5490a4
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], ebx
mov edx, dword [esp + 0x10]
mov word [eax + edx], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x68]
test ecx, ecx
je 0x4f1494
mov ecx, 0x5498c0
test ecx, ecx
je 0x4f144d
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, dword [esp + 0x10]
jmp 0x4f144f
xor esi, esi
cmp dword [eax - 0xc], 1
jg 0x4f145a
cmp esi, dword [eax - 4]
jle 0x4f1475
lea ecx, [esp + 0x10]
call fcn.004124c0
push esi
lea ecx, [esp + 0x14]
call fcn.00405530
test eax, eax
mov eax, dword [esp + 0x10]
je 0x4f1494
inc esi
push esi
push 0x5498c0
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x10]
push 0xffffffffffffffff
call fcn.00405bb0
mov eax, dword [esp + 0x10]
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
jl 0x4f14ab
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4f14cd
mov edx, dword [0x547570]
mov esi, eax
test eax, eax
mov dword [esp + 0x18], edx
je 0x4f14c2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [esp + 0x20]
call fcn.00405870
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, ebp
call fcn.004db5c0
mov ecx, eax
call fcn.00511000
lea ecx, [esp + 0x1c]
call fcn.00510740
call fcn.004707a0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
jne 0x4f1506
push 0x11
call esi
test ah, 0x80
jne 0x4f1513
push 0x10
call esi
test ah, 0x80
je 0x4f15cd
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x24]
mov edx, dword [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], 0x200
mov dword [esp + 0x34], edx
lea ebx, [eax - 0xc]
mov dword [esp + 0x40], 1
xor ecx, ecx
cmp dword [ebx], 1
jg 0x4f155c
mov edx, dword [eax - 4]
test edx, edx
jge 0x4f15b4
mov ebp, dword [eax - 8]
test ebp, ebp
jle 0x4f1565
mov ecx, ebp
push ecx
lea ecx, [esp + 0x18]
call fcn.00405530
test eax, eax
je 0x4f15b4
mov edi, dword [esp + 0x14]
lea ecx, [ebp + ebp + 2]
mov edx, ecx
lea esi, [ebx + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
mov dword [eax - 8], ebp
mov eax, dword [0x547574]
cmp ebx, eax
je 0x4f15b0
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4f15b0
push ebx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
push ecx
mov dword [esp + 0x34], 0x548150
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x4f15ea
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 4]
push 1
push edx
push 0
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x547574]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4f161d
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4f1623
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00532222
add esp, 4
jmp 0x4f1623
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esp + 0x18]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4f164e
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4f164e
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4f1679
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4f1679
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x50
ret 8