Function at 0x474850
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edx, eax
add edx, 0xffffff6a
cmp edx, 0x16
ja case.default.0x474870
jmp dword [edx*4 + 0x474877]
cmp esi, dword [0x4d42ac]
jne 0x474916
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 4]
push edx
push str.status
call fcn.004b6480
test eax, eax
jne 0x47496b
push 0
call sub.USER32.dll_MessageBeep
mov eax, 1
jmp 0x474ee4
push esi
call fcn.004b7934
test eax, eax
jne 0x474931
push 0
call sub.USER32.dll_MessageBeep
mov eax, 1
jmp 0x474ee4
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
add eax, 4
push eax
call fcn.004b6480
test eax, eax
jne 0x47496b
push 0
call sub.USER32.dll_MessageBeep
mov eax, 1
jmp 0x474ee4
push esi
call fcn.004b5f6c
test eax, eax
je 0x474987
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [0x4d42a0]
push ecx
call sub.USER32.dll_GetClientRect
jmp 0x474996
lea eax, [ebp - 0x2c]
push eax
call sub.USER32.dll_GetDesktopWindow
push eax
call sub.USER32.dll_GetClientRect
push esi
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x4749b4
push esi
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4749b4
push esi
call sub.USER32.dll_IsZoomed
test eax, eax
je 0x4749bc
push 9
push esi
call sub.USER32.dll_ShowWindow
cmp dword [ebp - 4], 0
jge 0x4749c7
xor edx, edx
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 0
jge 0x4749d2
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
cmp edx, eax
jl 0x4749e4
sub edx, eax
sub dword [ebp - 4], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x20]
cmp ecx, edx
jl 0x4749f6
sub ecx, edx
sub dword [ebp - 0xc], ecx
cmp dword [ebp - 4], 0
jge 0x474a01
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xc], 0
jge 0x474a0c
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
cmp eax, ecx
jg 0x474a1b
sub ecx, eax
sub dword [ebp - 8], ecx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
cmp edx, eax
jg 0x474a2a
sub eax, edx
sub dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0x32
jge 0x474a37
mov dword [ebp - 8], 0x32
cmp dword [ebp - 0x10], 0x64
jge 0x474a44
mov dword [ebp - 0x10], 0x64
push 1
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
push ecx
push esi
call sub.USER32.dll_MoveWindow
mov eax, 1
jmp 0x474ee4
push esi
call fcn.004b7934
test eax, eax
jne 0x474a7a
mov eax, 1
jmp 0x474ee4
cmp byte [eax + 0x4cc], 0
jne 0x474a92
push 0xffffffffffffffff
push 0x4d1117
push esi
call fcn.004b6214
jmp 0x474ac0
cmp byte [eax + 0x4cc], 1
jne 0x474aaa
push 0xffffffffffffffff
push 0x4d111b
push esi
call fcn.004b6214
jmp 0x474ac0
cmp byte [eax + 0x4cc], 2
jne 0x474ac0
push 0xffffffffffffffff
push 0x4d111f
push esi
call fcn.004b6214
mov eax, 1
jmp 0x474ee4
push esi
call fcn.004b66f4
mov eax, 1
jmp 0x474ee4
push 1
push 0
push esi
call fcn.00471664
mov eax, 1
jmp 0x474ee4
push esi
call fcn.004712e0
mov eax, 1
jmp 0x474ee4
push 0
push 1
push 1
push esi
call fcn.00470da0
mov eax, 1
jmp 0x474ee4
push esi
call fcn.0044a3b0
mov eax, 1
jmp 0x474ee4
push esi
call fcn.004b7174
mov eax, 1
jmp 0x474ee4
push esi
call fcn.004b72f8
mov eax, 1
jmp 0x474ee4
push 0xffffffffffffffff
push esi
call fcn.004b5f90
mov eax, 1
jmp 0x474ee4
push 0xffffffffffffffff
push esi
call fcn.004b7730
mov eax, 1
jmp 0x474ee4
push 0xffffffffffffffff
push esi
call fcn.004b69d0
mov eax, 1
jmp 0x474ee4
push esi
call fcn.00409860
mov eax, 1
jmp 0x474ee4
push esi
call fcn.00409aa8
mov eax, 1
jmp 0x474ee4
push 0
push esi
call fcn.0040a4a4
mov eax, 1
jmp 0x474ee4
push 1
push esi
call fcn.0040a4a4
mov eax, 1
jmp 0x474ee4
push 2
push esi
call fcn.0040a4a4
mov eax, 1
jmp 0x474ee4
push 3
push esi
call fcn.0040a4a4
mov eax, 1
jmp 0x474ee4
push 4
push esi
call fcn.0040a4a4
mov eax, 1
jmp 0x474ee4
push 5
push esi
call fcn.0040a4a4
mov eax, 1
jmp 0x474ee4
push 2
push esi
call fcn.004b7934
push eax
call fcn.00409600
mov eax, 1
jmp 0x474ee4
push esi
call fcn.004b67a0
mov eax, 1
jmp 0x474ee4
push esi
call fcn.004b7934
mov ebx, eax
test ebx, ebx
je 0x474d0a
cmp dword [ebx + 0x524], 0
je 0x474d0a
mov eax, dword [ebx + 0x528]
push eax
push 0
push 0
mov edx, dword [ebx + 0x524]
push edx
call fcn.00437854
mov edi, eax
test edi, edi
je 0x474d01
add ebx, 4
push ebx
push 0x4e23ec
push str._s_s.bmp
push 0x4eca78
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 4
push 0
push 0xf0b
call fcn.0040a8fc
push eax
push 3
push esi
call fcn.004a1d64
test eax, eax
je 0x474cf3
push edi
mov esi, 0x4e4b90
mov edi, 0x4eca78
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push 0x4ecb78
push 0x4e4b90
call fcn.004bcdd0
add esp, 8
push edi
push 0x4e4b90
call fcn.004377b0
test eax, eax
jne 0x474cf3
push 0
call sub.USER32.dll_MessageBeep
push edi
call sub.KERNEL32.dll_GlobalUnlock
push edi
call sub.KERNEL32.dll_GlobalFree
jmp 0x474d11
push 0
call sub.USER32.dll_MessageBeep
jmp 0x474d11
push 0
call sub.USER32.dll_MessageBeep
mov eax, 1
jmp 0x474ee4
and eax, 0xfff0
sub eax, 0xf020
je 0x474d37
sub eax, 0x100
je 0x474e29
jmp 0x474ee2
cmp dword [0x4d42f4], 0
je 0x474d95
push esi
call fcn.004b5f6c
test eax, eax
jne 0x474d95
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x474d95
push 6
push esi
call sub.USER32.dll_ShowWindow
push 0
push esi
call sub.USER32.dll_ShowWindow
cmp esi, dword [0x4d42a8]
jne 0x474d76
xor edx, edx
mov dword [0x4d42a8], edx
cmp dword [0x4d3774], 0
je 0x474d8b
push esi
call fcn.004b7934
push eax
call fcn.004a78e4
mov eax, 1
jmp 0x474ee4
cmp dword [0x4d3774], 0
je 0x474e22
push esi
call fcn.004b5f6c
test eax, eax
je 0x474e06
push esi
call fcn.004a7598
test eax, eax
je 0x474dc8
push 1
push esi
call fcn.004a8378
mov eax, 1
jmp 0x474ee4
mov eax, dword [0x4d42b4]
cmp esi, eax
jne 0x474de7
push 0
push 0
push 0x10
push eax
call sub.USER32.dll_PostMessageA
mov eax, 1
jmp 0x474ee4
mov eax, dword [0x4d42b8]
cmp esi, eax
jne 0x474e16
push 0
push 0
push 0x10
push eax
call sub.USER32.dll_PostMessageA
mov eax, 1
jmp 0x474ee4
cmp esi, dword [0x4d42a8]
jne 0x474e16
xor edx, edx
mov dword [0x4d42a8], edx
push esi
call fcn.004b7934
push eax
call fcn.004a78e4
xor eax, eax
jmp 0x474ee4
cmp dword [0x4d3774], 0
je 0x474ede
mov ebx, dword [0x4d4294]
test ebx, ebx
je 0x474ede
mov edi, dword [ebx]
cmp esi, edi
je 0x474ed0
push edi
call fcn.004b5f6c
test eax, eax
je 0x474ed0
mov eax, dword [ebx]
push eax
call fcn.004a7598
test eax, eax
je 0x474ed0
mov edx, dword [ebx]
push edx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x474e7c
mov ecx, dword [ebx]
push ecx
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x474e88
push 0
mov eax, dword [ebx]
push eax
call fcn.004a8378
jmp 0x474ed0
cmp dword [ebx + 0x524], 0
je 0x474ed0
push 0
lea edx, [ebp - 0x3c]
push edx
mov ecx, dword [ebx]
push ecx
call fcn.004b7b68
mov eax, dword [ebx + 0x52c]
cmp eax, dword [ebp - 0x34]
jne 0x474eb5
mov edx, dword [ebx + 0x530]
cmp edx, dword [ebp - 0x30]
je 0x474ed0
cmp byte [ebx + 0x4e5], 0
je 0x474ec6
push ebx
call fcn.004392a4
jmp 0x474ed0
push 0
mov ecx, dword [ebx]
push ecx
call fcn.00409b84
mov ebx, dword [ebx + 0x744]
test ebx, ebx
jne 0x474e44
xor eax, eax
jmp 0x474ee4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8