Function at 0x478f88
Capabilities:
Log keystrokes via polling
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov esi, eax
mov ebx, dword [ebp + 8]
movsx eax, byte [esi + 0x55d]
mov edx, dword [0x48d340]
cmp byte [edx + eax - 1], 0xff
jne 0x47925e
call fcn.0040f494
cmp byte [0x49c0dc], 0
jne 0x479172
mov edx, dword [0x48d550]
add edx, 0x400
mov eax, dword [0x48d370]
call fcn.00405c48
mov eax, dword [0x48d370]
call fcn.0040fb40
push 0x49c0e0
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_lstrcatA
call fcn.0040f494
mov al, 1
call fcn.0042aef4
test al, al
je 0x4795dd
mov eax, dword [0x48d370]
call fcn.00412584
test al, al
je 0x479027
mov eax, dword [0x48d370]
xor edx, edx
call fcn.00411180
test al, al
je 0x478ff5
mov ax, 0x2ff
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
mov eax, dword [0x48d268]
push eax
mov eax, dword [0x48d948]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d948]
mov dl, 1
call fcn.0040e810
mov edx, dword [esi + 0x170]
lea eax, [esi + 0x4a4]
call fcn.0041eb50
mov edx, dword [0x48d57c]
mov dword [edx], eax
mov eax, dword [0x48d57c]
cmp dword [eax], 0xffffffff
je 0x4790a4
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x4790a4
mov eax, dword [0x48d370]
push eax
mov edx, dword [0x48d57c]
mov edx, dword [edx]
mov eax, esi
xor ecx, ecx
call fcn.00471898
jmp 0x479168
cmp byte [0x49c0dd], 0
je 0x4790e7
push 1
fild qword [0x49c0cc]
call fcn.004028a0
push eax
push dword [0x49c0d0]
push dword [0x49c0cc]
push 0
mov ecx, dword [esi + 0x160]
movzx eax, word [0x49c1e0]
add ecx, eax
mov edx, dword [0x48d370]
mov eax, esi
call fcn.00477df0
jmp 0x479118
push 0
push 0x400
push dword [0x49c0d0]
push dword [0x49c0cc]
push 0
mov ecx, dword [esi + 0x160]
movzx eax, word [0x49c1e0]
add ecx, eax
mov edx, dword [0x48d370]
mov eax, esi
call fcn.00477df0
mov eax, dword [esi + 0x160]
movzx edx, word [0x49c1e2]
add eax, edx
add eax, 0x18
mov edx, eax
add edx, 0x18
push edx
mov edx, eax
add edx, 8
push edx
mov ecx, eax
mov edx, dword [0x48d370]
mov al, 1
call fcn.004147cc
mov eax, dword [esi + 0x160]
movzx edx, word [0x49c1e2]
add eax, edx
add eax, 0x18
add eax, 0x20
mov eax, dword [eax]
push eax
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_SetFileAttributesA
call fcn.0040eb04
jmp 0x4795dd
mov eax, dword [0x48d2a0]
mov byte [eax], bl
mov eax, dword [0x48d4c8]
mov byte [eax], 0
lea edx, [esi + 0x1d0]
mov eax, dword [0x48d348]
call fcn.00405c48
mov eax, dword [0x48d348]
call fcn.0040fb40
cmp byte [0x49c0e0], 0x2e
je 0x4791b4
push 0x49c0e0
mov eax, dword [0x48d348]
push eax
call sub.kernel32.dll_lstrcatA
mov dl, 0xf
mov ax, 0x2a
call fcn.0042d52c
test eax, eax
je 0x4795dd
mov eax, dword [0x48d624]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x48db5c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x48d480]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov eax, dword [0x48d8e8]
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
mov ax, 0x2ff
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
mov eax, dword [0x48d268]
push eax
mov eax, dword [0x48d948]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d948]
mov dl, 1
call fcn.0040e810
mov edx, dword [esi + 0x170]
lea eax, [esi + 0x4a4]
call fcn.0041eb50
mov edx, eax
mov ecx, dword [0x48d550]
add ecx, 0x400
mov eax, esi
call fcn.00478700
call fcn.0040eb04
call fcn.0046c244
jmp 0x4795dd
mov eax, dword [0x48dacc]
push eax
push 0x49c0e0
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x479296
cmp dword [0x49c0d4], 0
jne 0x479296
mov eax, dword [esi + 0x4b4]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
fild qword [ebp - 0xc]
mov eax, dword [0x48d318]
fistp qword [eax]
wait
jmp 0x4792b9
lea edx, [esi + 0x4a4]
mov eax, dword [0x49c0d4]
call fcn.0041ea80
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
fild qword [ebp - 0xc]
mov eax, dword [0x48d318]
fistp qword [eax]
wait
movzx eax, word [esi + 0x4a4]
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
mov eax, dword [0x48d318]
fild qword [eax]
fmulp st(1)
mov eax, dword [0x48d318]
fistp qword [eax]
wait
cmp byte [0x49c0dc], 0
jne 0x479312
mov eax, dword [0x48d318]
mov edx, dword [eax]
mov dword [esi + 0x48c], edx
mov edx, dword [eax + 4]
mov dword [esi + 0x490], edx
mov eax, dword [0x48d318]
fild qword [eax]
fild qword [0x49c0cc]
faddp st(1)
fsub dword [0x4795e8]
fistp qword [esi + 0x494]
wait
cmp byte [ebp - 1], 0
je 0x47932b
mov eax, dword [0x48d318]
push dword [eax + 4]
push dword [eax]
mov eax, esi
mov dl, 1
call fcn.0047e0e8
cmp byte [ebp - 2], 0
je 0x4795dd
mov eax, dword [0x48d2a0]
mov byte [eax], bl
test bl, bl
je 0x47938b
push 0
mov eax, dword [0x48d348]
push eax
mov ecx, dword [esi + 0x170]
lea edx, [esi + 0x4a4]
mov al, byte [esi + 0x55d]
call fcn.0041e8f0
mov eax, dword [0x48d348]
cmp byte [eax], 0x3f
jne 0x479376
mov edx, dword [esi + 0x14]
mov eax, dword [0x48d348]
call fcn.00405c48
mov dl, 0xf
mov ax, 0x2a
call fcn.0042d52c
test eax, eax
je 0x4795dd
jmp 0x4793af
mov ax, 0x30b
call fcn.0040bc04
mov edx, 2
call fcn.00411d74
test al, al
sete al
mov edx, dword [0x48d550]
mov byte [edx + 0x18a1], al
mov eax, dword [0x48d550]
cmp byte [eax + 0x1947], 0
jne 0x47943a
mov eax, dword [0x48d550]
cmp byte [eax + 0x18a1], 0
je 0x4793f2
mov ax, 0x30a
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48da44]
call fcn.00405c48
push 0x4795ec
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
jmp 0x4793fa
mov eax, dword [0x48da44]
mov byte [eax], 0
mov ax, 0x309
call fcn.0040bc04
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48da44]
mov edx, 0x34
call fcn.00411d74
mov edx, dword [0x48d91c]
mov dl, byte [edx]
mov ecx, dword [0x48d550]
mov byte [ecx + 0x1947], dl
test al, al
je 0x4795dd
call fcn.0040f494
test bl, bl
jne 0x479514
mov edx, dword [0x48d550]
add edx, 0x400
mov eax, dword [0x48d370]
call fcn.00405c48
mov eax, dword [0x48d370]
call fcn.0040fb40
push 0x49c0e0
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_lstrcatA
call fcn.0040f494
mov al, 1
call fcn.0042aef4
test al, al
je 0x4795dd
mov eax, dword [0x48d370]
call fcn.00412584
test al, al
je 0x4794a9
mov eax, dword [0x48d370]
xor edx, edx
call fcn.00411180
test al, al
je 0x479477
mov ax, 0x2ff
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
mov eax, dword [0x48d268]
push eax
mov eax, dword [0x48d948]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d948]
mov dl, 1
call fcn.0040e810
push dword [0x49c0d0]
push dword [0x49c0cc]
mov edx, dword [0x48d370]
mov eax, esi
mov ecx, dword [0x49c0d4]
call fcn.00478244
mov eax, dword [0x48d370]
mov edx, dword [0x49c0d8]
call fcn.004705ec
call fcn.0040eb04
jmp 0x4795dd
mov eax, dword [0x48d550]
cmp byte [eax + 0x18a1], 0
je 0x479537
lea eax, [esi + 0x4a4]
mov dl, 1
call fcn.0041f698
test eax, eax
je 0x4795dd
mov eax, dword [0x48d624]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x48db5c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x48d480]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov eax, dword [0x48d8e8]
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
lea eax, [esi + 0xc]
call fcn.00428760
test al, al
je 0x4795dd
mov ax, 0x2ff
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
mov eax, dword [0x48d268]
push eax
mov eax, dword [0x48d948]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d948]
mov dl, 1
call fcn.0040e810
lea edx, [esi + 0x4a4]
mov eax, dword [esi + 0x170]
call fcn.0041ea20
mov edx, eax
mov ecx, dword [0x48d550]
add ecx, 0x400
mov eax, esi
call fcn.0047872c
lea eax, [esi + 0xc]
call fcn.00428820
call fcn.0040eb04
call fcn.0046c244
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4