Function at 0x4f07f0
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
sub esp, 0x50
push ebx
mov eax, dword [0x546560]
push ebp
push esi
mov esi, dword [0x55a208]
mov ebp, ecx
xor ecx, ecx
cmp esi, 2
sete cl
test ecx, ecx
push edi
mov dword [esp + 0x10], eax
je 0x4f086d
mov eax, 0x548084
test eax, eax
jne 0x4f0821
xor ebx, ebx
jmp 0x4f082e
push 0x548084
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00405660
test eax, eax
je 0x4f0869
mov edi, dword [esp + 0x10]
lea eax, [ebx + ebx]
mov ecx, eax
mov esi, 0x548084
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], ebx
mov edx, dword [esp + 0x10]
mov word [eax + edx], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x68]
test ecx, ecx
je 0x4f08d4
mov ecx, 0x5488a0
test ecx, ecx
je 0x4f088d
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, dword [esp + 0x10]
jmp 0x4f088f
xor esi, esi
cmp dword [eax - 0xc], 1
jg 0x4f089a
cmp esi, dword [eax - 4]
jle 0x4f08b5
lea ecx, [esp + 0x10]
call fcn.00412670
push esi
lea ecx, [esp + 0x14]
call fcn.00405530
test eax, eax
mov eax, dword [esp + 0x10]
je 0x4f08d4
inc esi
push esi
push 0x5488a0
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x10]
push 0xffffffffffffffff
call fcn.00405bb0
mov eax, dword [esp + 0x10]
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
jl 0x4f08eb
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4f090d
mov edx, dword [0x546560]
mov esi, eax
test eax, eax
mov dword [esp + 0x18], edx
je 0x4f0902
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [esp + 0x20]
call fcn.00405870
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, ebp
call fcn.004daa00
mov ecx, eax
call fcn.00510700
lea ecx, [esp + 0x1c]
call fcn.0050fe40
call fcn.0046fed0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
jne 0x4f0946
push 0x11
call esi
test ah, 0x80
jne 0x4f0953
push 0x10
call esi
test ah, 0x80
je 0x4f0a0d
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x24]
mov edx, dword [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], 0x200
mov dword [esp + 0x34], edx
lea ebx, [eax - 0xc]
mov dword [esp + 0x40], 1
xor ecx, ecx
cmp dword [ebx], 1
jg 0x4f099c
mov edx, dword [eax - 4]
test edx, edx
jge 0x4f09f4
mov ebp, dword [eax - 8]
test ebp, ebp
jle 0x4f09a5
mov ecx, ebp
push ecx
lea ecx, [esp + 0x18]
call fcn.00405530
test eax, eax
je 0x4f09f4
mov edi, dword [esp + 0x14]
lea ecx, [ebp + ebp + 2]
mov edx, ecx
lea esi, [ebx + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
mov dword [eax - 8], ebp
mov eax, dword [0x546564]
cmp ebx, eax
je 0x4f09f0
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4f09f0
push ebx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
push ecx
mov dword [esp + 0x34], 0x547140
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x4f0a2a
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 4]
push 1
push edx
push 0
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x546564]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4f0a5d
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4f0a63
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00531732
add esp, 4
jmp 0x4f0a63
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esp + 0x18]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4f0a8e
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4f0a8e
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4f0ab9
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4f0ab9
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x50
ret 8