Function at 0x10004aa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x50f4f4]
push ebx
push esi
mov esi, dword [0x1004e6b0]
push edi
test ecx, ecx
je 0x10004edb
cmp byte [esi + 8], 0
je 0x10004ae5
mov eax, dword [esi + 0x18]
mov dword [ecx + 0xf8], eax
mov ecx, dword [0x50f4f4]
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0xfc], eax
cmp byte [esi + 9], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
je 0x10004b2a
mov eax, dword [0x50f4f4]
push 0
mov eax, dword [eax + 0x374]
mov ecx, dword [eax + 0x14]
mov eax, dword [esi + 0x20]
mov dword [ecx], eax
mov eax, dword [0x50f4f4]
mov eax, dword [eax + 0x374]
mov ecx, dword [eax + 0x10]
mov eax, dword [esi + 0x20]
mov dword [ecx], eax
call ebx
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x24]
mov dword [ecx + 0x158], eax
cmp byte [esi + 0xf], 0
je 0x10004bcc
push 0
call ebx
push 0
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x160], eax
call ebx
push 0
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x164], eax
call ebx
push 0
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x168], eax
call ebx
push 0
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x16c], eax
call ebx
push 0
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x170], eax
call ebx
push 0
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x174], eax
call ebx
push 0
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x178], eax
call ebx
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x180], eax
cmp byte [esi + 3], 0
je 0x10004bf1
push 4
push 0x10047bc0
push 0x57
mov edi, 0x4204b0
call edi
add esp, 0xc
push 0x10047bc4
push 0x20
call edi
add esp, 8
cmp byte [esi + 0x10], 0
je 0x10004c1d
push 0
call ebx
push 0
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x38]
mov dword [ecx + 0x1f0], eax
call ebx
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x34]
mov dword [ecx + 0x1ec], eax
cmp byte [esi + 0xc], 0
mov eax, dword [0x50f4f4]
je 0x10004c34
mov dword [eax + 0x82], 0xb
jmp 0x10004c47
cmp dword [eax + 0x82], 0xb
jne 0x10004c47
mov dword [eax + 0x82], 0
cmp byte [esi + 0xb], 0
lea eax, [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 5
push 0x463ceb
je 0x10004c73
call edi
mov eax, 0x463ceb
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
jmp 0x10004c89
call edi
mov eax, dword [0x10047bc8]
mov ecx, 0x463ceb
mov dword [ecx], eax
mov al, byte [0x10047bcc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x463ceb
call edi
cmp byte [esi + 0x11], 0
je 0x10004cd4
mov ecx, dword [0x50f4f4]
mov eax, dword [esi + 0x6c]
mov dword [ecx + 0x40], eax
mov ecx, dword [0x50f4f4]
mov eax, dword [esi + 0x70]
mov dword [ecx + 0x44], eax
mov ecx, dword [0x50f4f4]
mov eax, dword [esi + 0x74]
mov dword [ecx + 0x48], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100407ae
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0xe], 0
mov eax, dword [0x50f4f4]
mov eax, dword [eax + 0x40]
mov dword [esi + 0x6c], eax
mov eax, dword [0x50f4f4]
mov eax, dword [eax + 0x44]
mov dword [esi + 0x70], eax
mov eax, dword [0x50f4f4]
mov eax, dword [eax + 0x48]
mov dword [esi + 0x74], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x4096a1
je 0x10004d4b
call edi
mov eax, 0x4096a1
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push 0x4096a1
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x409fb3
call edi
mov eax, 0x409fb3
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
jmp 0x10004d96
call edi
mov eax, dword [0x10047bd0]
mov ecx, 0x4096a1
mov dword [ecx], eax
movzx eax, word [0x10047bd4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x409fb3
call edi
mov eax, dword [0x10047bd8]
mov ecx, 0x409fb3
mov dword [ecx], eax
movzx eax, word [0x10047bdc]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push 0x409fb3
call edi
cmp byte [esi + 5], 0
push 0
je 0x10004dbf
call ebx
mov dword [ebp - 8], 0x90
lea ebx, [eax + 0x63786]
jmp 0x10004dcf
call ebx
lea ebx, [eax + 0x63786]
mov eax, 0x10047be0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0xa
push ebx
call edi
cmp byte [esi + 5], 0
jne 0x10004df1
mov eax, dword [ebp - 8]
movq xmm0, qword [eax]
movq qword [ebx], xmm0
mov ax, word [eax + 8]
jmp 0x10004dfb
mov eax, 0x90909090
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov word [ebx + 8], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 0xa
push ebx
call edi
movzx eax, byte [esi + 0xd]
mov dword [0x510a4c], eax
cmp byte [esi + 0x12], 0
je 0x10004e2e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [eax + 0x10f4f4]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x54], eax
mov eax, dword [esi + 0x84]
cmp byte [eax + 0x18], 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x45add8
je 0x10004e52
call edi
mov byte [0x45add8], 1
jmp 0x10004e5b
call edi
mov byte [0x45add8], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 1
push 0x45add8
call edi
cmp byte [esi + 7], 0
je 0x10004ea4
call dword [0x1004e63c]
test eax, eax
je 0x10004e98
mov ecx, dword [0x50f4f4]
mov al, byte [eax + 0x32c]
cmp al, byte [ecx + 0x32c]
je 0x10004ea4
mov byte [ecx + 0x224], 1
jmp 0x10004ea4
mov eax, dword [0x50f4f4]
mov byte [eax + 0x224], 0
cmp byte [esi + 6], 0
je 0x10004eca
mov edi, dword [esi + 0x8c]
cmp byte [edi + 4], 0
jne 0x10004ec3
push dword [edi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10004eca
mov ecx, edi
call fcn.100010b0
cmp byte [esi + 4], 0
je 0x10004edb
mov ecx, dword [esi + 0x88]
call fcn.10002670
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100407ae
mov esp, ebp
pop ebp
ret