Function at 0x4a15a4
Capabilities:
Create process on windows
Get graphical window text
Log keystrokes

Disassembly:
push ebx
push esi
call fcn.0049c0f4
push 1
push 0
push 0x4a1ab4
push 0x4a1ac0
push 0x4a1acc
push 0
call sub.shell32.dll_ShellExecuteA
xor esi, esi
push 0x32
call sub.kernel32.dll_Sleep_1
push 0x4a1ad4
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
inc esi
test ebx, ebx
jne 0x4a15e6
cmp esi, 0x64
jle 0x4a15c7
test ebx, ebx
je 0x4a1ab0
push ebx
call sub.user32.dll_SetForegroundWindow
call fcn.004985fc
cmp eax, 6
jne 0x4a16dd
push 0
push 0
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x49
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x49
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x49
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x49
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0x4a1ae4
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 0
push 0
push 0xd
call sub.user32.dll_MapVirtualKeyA
push eax
push 0xd
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0xd
call sub.user32.dll_MapVirtualKeyA
push eax
push 0xd
call sub.user32.dll_keybd_event
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0x4a1af4
push 0x4a1afc
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0
push 0
push 0x201
push esi
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x202
push esi
call sub.user32.dll_SendMessageA
jmp 0x4a1ab0
call fcn.004985fc
cmp eax, 7
jne 0x4a18c6
push 0
push 0
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x44
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x44
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x44
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x44
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0x4a1b04
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 0
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x4f
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x4f
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x4f
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x4f
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0x4a1ae4
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 0
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x59
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x59
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x59
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x59
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0x4a1b04
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 0
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x43
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x43
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x43
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x43
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0x4a1af4
push 0x4a1afc
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0
push 0x201
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x202
push ebx
call sub.user32.dll_SendMessageA
jmp 0x4a1ab0
call fcn.004985fc
cmp eax, 8
je 0x4a18de
call fcn.004985fc
cmp eax, 9
jne 0x4a1ab0
push 0
push 0
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x44
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x44
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x44
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x44
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0x4a1b04
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
push esi
call sub.user32.dll_SetForegroundWindow
push 0
push 0
push 0xf1
push 0x4a1b18
push 0x4a1afc
push 0
push esi
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_SendMessageA
push 0
push 0
push 0xf1
push 0x4a1b30
push 0x4a1afc
push 0
push esi
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_SendMessageA
push 0
push 0
push 0xf1
push 0x4a1b40
push 0x4a1afc
push 0
push esi
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_SendMessageA
push 0
push 0
push 0xf1
push 0x4a1b50
push 0x4a1afc
push 0
push esi
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_SendMessageA
push 0
push 0
push 0xf1
push 0x4a1b5c
push 0x4a1afc
push 0
push esi
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_SendMessageA
push 0
push 1
push 0xf1
push 0x4a1b74
push 0x4a1afc
push 0
push esi
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_SendMessageA
push 0x7d0
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x44
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x44
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x44
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x44
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0x4a1af4
push 0x4a1afc
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0
push 0x201
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x202
push ebx
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret