Function at 0x47e8e8
Capabilities:
Create process on windows
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, 0x37
mov ebx, ecx
push edi
mov dword [ebp - 0x38], ebx
jg 0x47e960
cmp esi, 0x34
jge 0x47e955
cmp esi, 0x13
je 0x47e936
cmp esi, 0x2e
je 0x47e92c
cmp esi, 0x30
jle 0x47e97b
cmp esi, 0x32
jle 0x47e955
cmp esi, 0x33
jne 0x47e97b
mov ecx, dword [ebx + 4]
call fcn.0046bf4f
jmp 0x47f22a
call fcn.004819fa
jmp 0x47f22a
mov ecx, dword [0x4c81e4]
test ecx, ecx
je 0x47e97b
cmp byte [ecx + 0x10], 0
jne 0x47e97b
cmp dword [ecx + 0x24], 0
jbe 0x47e97b
push 1
call fcn.004023fa
jmp 0x47e97b
push esi
call fcn.0047e66a
jmp 0x47f22a
cmp esi, 0x41
je 0x47f225
cmp esi, 0x70
je 0x47f21e
cmp esi, 0x73
je 0x47f217
mov byte [ebp - 1], 0
cmp esi, 0x28
jne 0x47e994
mov eax, dword [0x4c830c]
cmp eax, 4
jae 0x47e994
add eax, 0x17
mov dword [ebp + 8], eax
mov esi, dword [ebx + 0xc0]
mov edi, dword [esi + 0x14]
mov eax, edi
imul eax, eax, 0xc
call section..text
mov eax, edi
shl eax, 2
mov dword [ebp - 0x4c], esp
call section..text
mov esi, dword [esi + 8]
and dword [ebp - 0x20], 0
and dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], esp
push 2
push 0xffffffffffffffff
push 0x100c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x47eb1b
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc0]
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax + 0x14]
jae 0x47eb1b
mov esi, dword [ebp - 8]
mov eax, dword [ebx + 0x5c]
imul esi, esi, 0xdc
mov edi, dword [ebp - 0x18]
and dword [ebp - 0x28], 0
add eax, esi
mov ecx, dword [eax]
mov dword [edi], ecx
cmp ecx, 1
jne 0x47eabe
mov ecx, dword [eax + 0x7c]
call fcn.00435c8a
mov ecx, dword [eax + 0x20]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x3c], ecx
test ecx, ecx
jbe 0x47eabe
mov ecx, dword [ebx + 0x5c]
mov edx, dword [eax + 0x18]
add ecx, esi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 4]
mov ecx, dword [edx + 4]
mov ax, word [ecx]
cmp ax, word [edi]
jne 0x47ea6c
test ax, ax
je 0x47ea68
mov ax, word [ecx + 2]
cmp ax, word [edi + 2]
jne 0x47ea6c
add ecx, 4
add edi, 4
test ax, ax
jne 0x47ea46
xor eax, eax
jmp 0x47ea71
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47eaa8
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 0x80]
mov ecx, dword [edx + 8]
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x47ea9f
test al, al
je 0x47ea9b
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x47ea9f
inc ecx
inc ecx
inc edi
inc edi
test al, al
jne 0x47ea81
xor eax, eax
jmp 0x47eaa4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47eab8
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add edx, 0x28
cmp eax, dword [ebp - 0x3c]
jb 0x47ea3d
jmp 0x47eabb
mov dword [ebp - 0x28], edx
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x5c]
add esi, eax
cmp dword [esi], 0
jne 0x47ead3
mov eax, dword [esi + 0x78]
jmp 0x47ead5
xor eax, eax
cmp dword [edi], 0
mov dword [edi + 4], eax
jne 0x47eaec
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 0x78]
mov ecx, dword [ebp - 0x2c]
inc dword [ebp - 0x24]
mov dword [ecx + edx*4], eax
mov eax, dword [ebx + 0xc0]
mov eax, dword [eax + 8]
inc dword [ebp - 0x20]
push 2
push dword [ebp - 8]
add edi, 0xc
push 0x100c
push eax
mov dword [ebp - 0x18], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x47e9e4
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
sub eax, edi
xor ebx, ebx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x20], ebx
je 0x47f22a
mov esi, dword [ebp + 8]
push 0x24
pop eax
cmp edi, ebx
jbe 0x47eb97
cmp esi, 0x17
je 0x47eb45
cmp esi, 0x18
jne 0x47eb61
cmp byte [0x4c81ed], bl
je 0x47eb61
mov dword [ebp - 0x84], 9
mov dword [ebp - 0x70], 0x4c81ed
push ebx
jmp 0x47eb75
cmp esi, 0x19
je 0x47eb6b
cmp esi, 0x1a
jne 0x47eb97
xor ecx, ecx
inc ecx
mov dword [ebp - 0x84], ecx
push ecx
mov dword [ebp - 0x80], eax
mov eax, edi
call fcn.004785a5
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00450a20
pop ecx
pop ecx
cmp eax, 6
jne 0x47f22a
call fcn.00429592
cmp esi, 0x22
jne 0x47ebbe
xor eax, eax
cmp edi, ebx
jbe 0x47ebb8
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx + eax*4]
test byte [ecx + 0x3c], 0x20
je 0x47ebf1
inc eax
cmp eax, edi
jb 0x47eba7
push 0x23
pop esi
mov dword [ebp + 8], esi
cmp esi, 0x13
jne 0x47ebdf
cmp dword [0x4c81e4], ebx
je 0x47ebf1
mov ecx, str.a4d77a09_10ea_4574_8c09_9b6e1a21c95f
call fcn.00412bb6
push 0xa
mov edx, eax
pop ecx
call fcn.0043a6ac
cmp esi, 0x1c
je 0x47f1c6
cmp esi, 0x1b
je 0x47f1c6
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x20], ebx
jbe 0x47f158
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
imul eax, eax, 0xc
add eax, ecx
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
mov eax, dword [eax]
test eax, eax
jne 0x47f0ff
mov ecx, esi
call fcn.00411f30
test al, al
je 0x47f13a
cmp dword [ebp + 8], 0x6c
jg 0x47f13a
mov eax, dword [ebp + 8]
cmp eax, 0x6c
je 0x47f0ee
cmp eax, 0x24
jg 0x47edb2
je 0x47eda6
cmp eax, 0x1f
jg 0x47ed6e
cmp eax, 0x1d
jge 0x47ed56
cmp eax, 0x13
je 0x47ed13
cmp eax, 0x14
je 0x47ed07
cmp eax, 0x15
je 0x47ecf1
cmp eax, 0x16
je 0x47f0a8
jle 0x47f13a
cmp eax, 0x1a
jg 0x47f13a
movzx eax, byte [0x4c8323]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
add ecx, 0xffffffe9
and eax, 4
or eax, ecx
push eax
mov ecx, esi
call fcn.0040e23b
mov edi, dword [ebp - 0x38]
cmp esi, dword [edi + 0xb8]
jne 0x47ecc8
push 0
mov ecx, edi
call fcn.00478291
cmp esi, dword [edi + 0x84]
jne 0x47ed9d
mov eax, dword [edi + 0xc0]
push 0
push 0xffffffffffffffff
push 0x1076
push dword [eax + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x47ed9d
test byte [esi + 0x3c], 0x40
jne 0x47ed9d
mov ecx, esi
call fcn.0040ea64
jmp 0x47ed9d
mov ecx, esi
call fcn.0040d22c
jmp 0x47ed9d
cmp dword [0x4c81e4], 0
je 0x47f13a
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0xc0]
mov eax, dword [ecx + 0x2c]
mov al, byte [eax + 0xa]
shr al, 7
not al
test al, 1
jne 0x47ed41
push 0
push 0xa
call fcn.0044b052
mov ecx, dword [0x4c81e4]
push 0
push 0xffffffffffffffff
push esi
call fcn.00402844
jmp 0x47f13a
add eax, 0xffffffe3
push eax
mov ecx, esi
call fcn.004074c8
push 0x1e
pop ecx
call fcn.00411a59
jmp 0x47f13a
sub eax, 0x20
je 0x47f196
dec eax
je 0x47ed96
dec eax
je 0x47ed8d
dec eax
jne 0x47f13a
mov ecx, esi
call fcn.0040e983
jmp 0x47ed9d
mov ecx, esi
call fcn.0040e9f1
jmp 0x47ed9d
mov ecx, esi
call fcn.0040f878
mov byte [ebp - 1], 1
jmp 0x47f13a
mov ecx, esi
call fcn.00407847
jmp 0x47f13a
cmp eax, 0x2b
jg 0x47f090
je 0x47f089
sub eax, 0x25
je 0x47f072
dec eax
je 0x47ee01
dec eax
je 0x47edf5
dec eax
dec eax
je 0x47ede9
dec eax
jne 0x47f13a
mov dl, 1
mov ecx, esi
call fcn.0046fc4b
jmp 0x47f13a
mov ecx, esi
call fcn.0040a416
jmp 0x47f13a
mov ecx, esi
call fcn.00407492
jmp 0x47f13a
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
xor dl, dl
mov ecx, esi
mov byte [ebp - 9], 0
mov byte [ebp - 0x10], 1
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x80], 0x23
mov dword [ebp - 0x28], 0x4a44d0
call fcn.004724da
mov bl, al
mov eax, dword [esi]
neg bl
sbb bl, bl
inc bl
mov dword [ebp - 0x28], 0x4a3fd0
cmp byte [eax + 0x24], 0
mov edi, 0x48e94c
je 0x47ee85
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0x20]
test ecx, ecx
jne 0x47ee5e
mov ecx, edi
mov edx, eax
call fcn.0043a9d8
test al, al
jne 0x47ee85
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
test ecx, ecx
jne 0x47ee77
mov ecx, edi
call fcn.00444f48
push eax
lea ecx, [ebp - 0x14]
call fcn.004019c6
test bl, bl
je 0x47f05b
mov eax, dword [esi]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp dword [eax + 8], ecx
jbe 0x47ef77
mov dword [ebp - 8], ecx
and dword [ebp - 0x34], 0
cmp byte [eax + 0x24], 0
mov byte [ebp - 0x30], 1
je 0x47eecf
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ebp - 8]
test ecx, ecx
jne 0x47eebc
mov ecx, edi
mov edx, dword [eax + 0x18]
call fcn.00444f48
push eax
lea ecx, [ebp - 0x34]
call fcn.00439f78
jmp 0x47eeda
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.004019c6
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x47eee3
mov ecx, edi
call fcn.004458fa
test al, al
jne 0x47ef0c
cmp byte [ebp - 0x30], al
je 0x47eef9
mov ecx, dword [ebp - 0x34]
call fcn.00444521
inc dword [ebp - 0x1c]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x1c]
add dword [ebp - 8], 0x34
cmp ecx, dword [eax + 8]
jb 0x47eea0
jmp 0x47ef77
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x34], eax
je 0x47ef1f
mov edi, dword [ebp - 0x34]
push edi
push dword [0x4ce658]
lea eax, [ebp - 0x64]
push eax
call fcn.00444067
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.0044403f
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00450a20
pop ecx
pop ecx
mov ecx, dword [ebp - 0x64]
mov edi, eax
call fcn.00444521
and dword [ebp - 0x5c], 0
cmp edi, 6
sete bl
cmp edi, 7
sete byte [ebp - 9]
cmp byte [ebp - 0x30], 0
je 0x47ef72
mov ecx, dword [ebp - 0x34]
call fcn.00444521
mov edi, 0x48e94c
test bl, bl
je 0x47ef9d
cmp dword [ebp - 0x14], 0
je 0x47ef84
mov edi, dword [ebp - 0x14]
push 0
push 0
push edi
mov ecx, esi
call fcn.0040ec80
push 0x1e
pop ecx
call fcn.00411a59
jmp 0x47f05b
cmp byte [ebp - 9], 0
je 0x47f05b
mov ecx, dword [esi]
cmp byte [ecx + 0x24], 0
je 0x47efc3
cmp dword [ebp - 0x14], 0
je 0x47efb8
mov edi, dword [ebp - 0x14]
push edi
call fcn.0041fad3
jmp 0x47f05b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], ecx
cmp eax, ecx
jne 0x47efd7
mov eax, edi
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x47f00d
mov eax, dword [ebp - 0x14]
mov ecx, eax
test eax, eax
jne 0x47eff4
mov ecx, edi
jmp 0x47eff6
mov edi, eax
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x58]
call fcn.00443f1c
inc ebx
inc ebx
mov dword [ebp - 8], ebx
jmp 0x47f028
call fcn.00445128
push eax
lea ecx, [ebp - 0x58]
call fcn.00443e98
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
test eax, eax
jne 0x47f028
mov dword [ebp - 8], edi
mov ebx, dword [esi]
lea ecx, [ebp - 0x58]
call fcn.0044403f
push eax
mov ecx, ebx
call fcn.0041fad3
mov esi, dword [esi]
mov ecx, dword [ebp - 8]
mov ebx, dword [esi]
call fcn.00444d11
push eax
push ebx
mov ecx, esi
call fcn.0041faed
mov ecx, dword [ebp - 0x58]
call fcn.00444521
and dword [ebp - 0x50], 0
cmp byte [ebp - 0x10], 0
je 0x47f13a
mov ecx, dword [ebp - 0x14]
call fcn.00444521
jmp 0x47f13a
mov eax, dword [esi]
xor edx, edx
cmp byte [eax + 0x24], dl
mov ecx, esi
sete dl
dec edx
call fcn.0047c910
jmp 0x47f13a
xor dl, dl
jmp 0x47eddd
sub eax, 0x2c
je 0x47f0e0
dec eax
je 0x47f1bf
sub eax, 0xb
je 0x47f0b4
dec eax
jne 0x47f13a
mov ecx, esi
call fcn.0040f929
jmp 0x47ed9d
cmp dword [ebp - 0x40], 0
jbe 0x47f0c7
push 0x490f70
lea ecx, [ebp - 0x48]
call fcn.00443e98
mov ecx, esi
call fcn.004052ef
mov ecx, eax
call fcn.0043ad70
push eax
lea ecx, [ebp - 0x48]
call fcn.00443e98
jmp 0x47f13a
push 0
or edx, 0xffffffff
mov ecx, esi
call fcn.0047aa0e
jmp 0x47f13a
push 1
xor eax, eax
push eax
push eax
push dword [esi + 0x1c4]
jmp 0x47f18c
cmp eax, 1
jne 0x47f13a
mov ecx, dword [edi + 0x20]
call fcn.00435c8a
mov ecx, dword [ebp + 8]
sub ecx, 0x16
je 0x47f125
sub ecx, 0x19
je 0x47f183
dec ecx
je 0x47f175
dec ecx
dec ecx
je 0x47f165
sub ecx, 8
jne 0x47f13a
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x3c]
mov ecx, edi
sbb eax, eax
and eax, 4
push eax
xor edx, edx
call fcn.00437764
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jb 0x47ec06
mov edx, dword [ebp - 0x40]
test edx, edx
jbe 0x47f158
mov ecx, dword [ebp - 0x48]
call fcn.004692a5
mov ecx, dword [ebp - 0x48]
call fcn.00444521
jmp 0x47f1fa
push dword [edi + 8]
mov edx, dword [edi + 4]
mov ecx, dword [eax + 0x10]
call fcn.00436a96
jmp 0x47f13a
mov ecx, edi
call fcn.00437a70
call fcn.004819fa
jmp 0x47f13a
push 1
xor eax, eax
push eax
push eax
push dword [edi + 8]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x47f13a
call fcn.004295a3
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
test ax, ax
jge 0x47f1b8
call fcn.00478464
jmp 0x47f22a
call fcn.0048ceb0
jmp 0x47f22a
call fcn.004295a3
jmp 0x47f22a
xor eax, eax
cmp esi, 0x1b
sete al
push 0x10
add eax, 4
mov esi, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x47f1e3
or esi, 2
mov ecx, dword [ebp - 0x2c]
push esi
mov edx, edi
call fcn.00413075
push 0x1e
pop ecx
call fcn.00411a59
mov byte [ebp - 1], 1
call fcn.004295a3
cmp byte [ebp - 1], 0
je 0x47f20d
mov ecx, dword [ebp - 0x38]
call fcn.0047d862
mov ecx, dword [ebp - 0x38]
call fcn.0047ad1f
jmp 0x47f22a
call fcn.0047b680
jmp 0x47f22a
call fcn.0047d200
jmp 0x47f22a
call fcn.00475677
lea esp, [ebp - 0x90]
pop edi
pop esi
pop ebx
leave
ret 4