Function at 0x476dbc
Capabilities:
Create process on windows
Get graphical window text
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov ebx, eax
xor esi, esi
push 8
lea eax, [esp + 4]
push eax
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_GetClassNameA
mov eax, dword [0x4bec18]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x476e0c
push edi
movzx eax, bx
push eax
push 0x111
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_SendMessageA
test eax, eax
je 0x477d4e
cmp bx, 0x12c
jbe 0x476e23
cmp bx, 0x136
jae 0x476e23
mov eax, ebx
sub al, 0x2c
call fcn.00476aa8
cmp bx, 0x4a
jbe 0x476e3b
cmp bx, 0x4f
jae 0x476e3b
mov edx, ebx
sub dl, 0x4a
xor eax, eax
call fcn.004b39d8
movzx eax, bx
add eax, 0xfffffff8
cmp eax, 0xcf
ja case.0x476e52.8
mov al, byte [eax + 0x476e59]
jmp dword [eax*4 + 0x476f29]
mov dl, 0x2f
mov ax, 0x19
call fcn.0048841c
jmp 0x477d35
call fcn.00434d04
jmp 0x477d35
call fcn.0044b1b8
jmp 0x477d35
xor eax, eax
call fcn.00473774
jmp 0x477d35
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0044b7ac
jmp 0x477d35
xor ecx, ecx
xor edx, edx
mov al, 2
call fcn.0044b7ac
jmp 0x477d35
push 0xff
mov eax, dword [0x4bedb0]
push eax
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x477155
mov eax, dword [0x4be9a8]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x47713c
push 0x477d58
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x47713c
mov eax, dword [0x4be740]
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x47713c
push 0x477d68
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x477155
push 0
push 0xd
push pe_nt_image_headers32
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_SendMessageA
jmp 0x477d35
mov eax, dword [0x4be784]
cmp byte [eax + 0x18d2], 0
je 0x4771df
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be4ec]
movsx edx, word [edx]
cmp eax, edx
jg 0x4771df
mov eax, dword [0x4bec7c]
cmp dword [eax], 0
jle 0x4771df
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
cmp dword [edx + eax*4 - 4], 0
je 0x4771df
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4771df
push 0
push 0xd
push 0x102
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x477d35
call fcn.00476c50
jmp 0x477d35
push 0
push 0
push 0x10
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x477d35
mov al, 0xe
call fcn.00421294
test al, al
je 0x477d4e
mov edx, dword [0x4be538]
mov eax, dword [0x4bedb0]
call fcn.004b81b0
push 1
push 0x477d78
push 0x477d78
mov eax, dword [0x4bedb0]
push eax
push 0
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [0x4be438]
mov dword [edx], eax
mov eax, dword [0x4be438]
cmp dword [eax], 0x20
ja 0x477d35
mov eax, dword [0x4be438]
cmp dword [eax], 0
jbe 0x477d35
mov edx, dword [0x4bedb0]
mov ax, 7
call fcn.004acdac
jmp 0x477d35
call fcn.00475e98
jmp 0x477d35
call fcn.00434e54
jmp 0x477d35
call fcn.0043526c
jmp 0x477d35
call fcn.00435f34
jmp 0x477d35
push 0
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00436880
jmp 0x477d35
push 0
mov cl, 1
xor edx, edx
xor eax, eax
call fcn.00436880
jmp 0x477d35
mov al, 1
call fcn.0042a67c
jmp 0x477d35
mov al, 1
call fcn.00435ad4
jmp 0x477d35
mov al, 1
call fcn.00435628
jmp 0x477d35
mov dl, 1
xor eax, eax
call fcn.00476670
jmp 0x477d35
call fcn.0044b3d8
mov eax, dword [0x4bef04]
mov byte [eax], 1
call fcn.0044b1b8
jmp 0x477d35
call fcn.0044d1a8
jmp 0x477d35
mov eax, dword [0x4be744]
cmp dword [eax], 0
jle 0x47733f
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov dl, 1
call fcn.00473c98
jmp 0x477d35
mov eax, dword [0x4be7dc]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov eax, dword [0x4be9d4]
mov edx, dword [0x4be560]
mov dword [edx], eax
mov dl, 0x42
mov ax, 0x13
call fcn.0048841c
jmp 0x477d35
call fcn.0044ecd8
jmp 0x477d35
mov al, 1
call fcn.00424f80
jmp 0x477d35
mov dl, 0x3f
mov ax, 0xe
call fcn.0048841c
dec eax
jne 0x477d35
call fcn.004b1bd0
jmp 0x477d35
xor eax, eax
call fcn.00457ff0
jmp 0x477d35
mov al, 1
call fcn.00457ff0
jmp 0x477d35
mov eax, dword [0x4be744]
cmp dword [eax], 0
jle 0x4773d9
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov dl, 1
call fcn.00473ab0
jmp 0x477d35
call fcn.0044ef5c
jmp 0x477d35
mov eax, dword [0x4be744]
cmp dword [eax], 0
jle 0x47740a
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov dl, 2
call fcn.00473ab0
jmp 0x477d35
call fcn.0044f004
jmp 0x477d35
call fcn.0044f2b0
jmp 0x477d35
push 1
push 0x477d7c
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x477d35
mov edx, 0x477d7c
mov ax, 7
call fcn.004acdac
jmp 0x477d35
call fcn.0046eb78
jmp 0x477d35
call fcn.0044f184
jmp 0x477d35
mov dl, 0x48
mov ax, 0x1d
call fcn.0048841c
dec eax
jne 0x477d35
call fcn.00424530
mov eax, dword [0x4bec8c]
mov byte [eax], 0
jmp 0x477d35
xor edx, edx
xor eax, eax
call fcn.00450448
jmp 0x477d35
xor eax, eax
call fcn.0044cb10
jmp 0x477d35
mov al, 1
call fcn.0044cb10
jmp 0x477d35
mov al, 2
call fcn.0044cb10
jmp 0x477d35
call fcn.0044f708
jmp 0x477d35
mov dl, 0x40
mov ax, 0x1b
call fcn.0048841c
jmp 0x477d35
call fcn.00451424
jmp 0x477d35
xor eax, eax
call fcn.00442f74
jmp 0x477d35
push 5
push 0
push 0
mov eax, dword [0x4be690]
mov eax, dword [eax]
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x477d35
push 5
push 0
push 0
mov ax, 0x28c
call fcn.004aa600
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x477d35
mov al, 1
call fcn.004b0608
jmp 0x477d35
test edi, edi
jne 0x47753d
mov dl, 2
mov ax, 0x13
call fcn.0048841c
test eax, eax
je 0x477d4e
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov edi, dword [edx + eax*4 - 4]
mov eax, dword [0x4bedd0]
push dword [eax + 4]
push dword [eax]
mov eax, dword [0x4bec94]
mov cl, 1
xor edx, edx
call fcn.0043b018
dec eax
jl 0x477d4e
mov eax, edi
call fcn.0044f5d0
mov eax, edi
call fcn.0046fbdc
mov eax, dword [0x4bedd0]
fistp qword [eax]
wait
mov eax, dword [0x4bedd0]
push dword [eax + 4]
push dword [eax]
mov eax, dword [0x4bec94]
mov cl, 1
mov dl, 1
call fcn.0043b018
mov esi, eax
test esi, esi
jle 0x4775c2
call fcn.0043e2c4
test al, al
jne 0x4775bb
mov eax, dword [0x4bef58]
cmp byte [eax], 0
jne 0x4775bb
mov eax, edi
call fcn.004739dc
mov eax, edi
call fcn.0046d694
call fcn.0043b398
jmp 0x477d35
call fcn.004b16e8
jmp 0x477d35
mov eax, dword [0x4be530]
cmp byte [eax], 2
jne 0x4775ed
xor ecx, ecx
xor edx, edx
mov ax, 0x81
call fcn.00476dbc
mov eax, dword [0x4be530]
cmp byte [eax], 1
je 0x47768e
mov eax, dword [0x4be530]
cmp byte [eax], 0
jne 0x477644
call fcn.00468cdc
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x47762e
push 0
push 0
push 0x226
mov eax, dword [0x4bed7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x477644
push 0
push 1
push 0x226
mov eax, dword [0x4bed7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0x4be530]
mov byte [eax], 1
mov al, 1
call fcn.00468d20
push 0
push 0
push 0x415
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 8
push 0x80
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
jmp 0x477d35
push 0
push 0x80
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x4be530]
mov byte [eax], 0
jmp 0x477d35
mov eax, dword [0x4be530]
cmp byte [eax], 1
jne 0x4776c6
xor ecx, ecx
xor edx, edx
mov ax, 0x80
call fcn.00476dbc
mov eax, dword [0x4be530]
cmp byte [eax], 2
je 0x477771
mov eax, dword [0x4be530]
cmp byte [eax], 0
jne 0x47771d
call fcn.00468cdc
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x477707
push 0
push 0
push 0x226
mov eax, dword [0x4bed7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x47771d
push 0
push 1
push 0x226
mov eax, dword [0x4bed7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0x4be530]
mov byte [eax], 2
mov al, 1
call fcn.00468d20
mov eax, dword [0x4be744]
cmp dword [eax], 2
jle 0x477758
push 0
push 0
push 0x415
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 8
push 0x81
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
jmp 0x477d35
push 0
push 0x81
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
call fcn.00468bf4
mov eax, dword [0x4be530]
mov byte [eax], 0
jmp 0x477d35
push 0
push 0
push 0x227
mov eax, dword [0x4bed7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x477d35
push 0
push 1
push 0x226
mov eax, dword [0x4bed7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x477d35
push 0
push 0
push 0x226
mov eax, dword [0x4bed7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x477d35
call fcn.0044b3d8
jmp 0x477d35
push 0
push 0
push 0x228
mov eax, dword [0x4bed7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
jmp 0x477d35
push 5
push 0
push 0
push 0x477d88
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x477d35
call fcn.00476c50
jmp 0x477d35
call fcn.004b067c
jmp 0x477d35
mov eax, dword [0x4be784]
mov al, byte [eax + 0x190f]
xor al, 1
mov edx, dword [0x4be784]
mov byte [edx + 0x190f], al
call fcn.00424530
mov eax, dword [0x4bec8c]
mov byte [eax], 0
jmp 0x477d35
mov eax, dword [0x4be784]
mov al, byte [eax + 0x18ee]
xor al, 1
mov edx, dword [0x4be784]
mov byte [edx + 0x18ee], al
mov edx, dword [0x4be784]
test al, al
je 0x4778b5
push 8
push 0x8e
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x4beba8]
mov byte [eax], 0x18
push 5
mov eax, dword [0x4be9bc]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4778e0
push 0
push 0x8e
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x4beba8]
mov byte [eax], 0
push 0
mov eax, dword [0x4be9bc]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
call fcn.004288d0
call fcn.0044b420
jmp 0x477d35
mov eax, dword [0x4be784]
mov al, byte [eax + 0x193c]
xor al, 1
mov edx, dword [0x4be784]
mov byte [edx + 0x193c], al
mov edx, dword [0x4be784]
test al, al
je 0x477930
push 8
push 0x8f
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x4beacc]
mov byte [eax], 0x19
jmp 0x47794c
push 0
push 0x8f
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x4beacc]
mov byte [eax], 0
mov al, 1
call fcn.0044ec28
call fcn.004288d0
call fcn.0044b420
jmp 0x477d35
mov eax, dword [0x4be784]
mov al, byte [eax + 0x1939]
xor al, 1
mov edx, dword [0x4be784]
mov byte [edx + 0x1939], al
mov edx, dword [0x4be784]
test al, al
je 0x47799b
push 8
push 0x90
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
jmp 0x4779af
push 0
push 0x90
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
call fcn.00428aa4
call fcn.004281d8
call fcn.004288d0
call fcn.0044b420
jmp 0x477d35
mov al, 2
call fcn.00435628
jmp 0x477d35
push 5
push 0
push 0
mov eax, dword [0x4becb0]
mov eax, dword [eax]
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x477d35
mov edx, 0x477db4
mov eax, dword [0x4bedb0]
call fcn.004b81b0
mov eax, dword [0x4be784]
mov al, byte [eax + 0x188c]
test al, al
jne 0x477a20
push 0x477ddc
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
jmp 0x477a3a
mov edx, dword [0x4be784]
cmp al, 2
jne 0x477a3a
push 0x477de0
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
push 0x477de4
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
push 5
push 0
push 0
mov eax, dword [0x4bedb0]
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x477d35
mov al, 2
call fcn.00435ad4
jmp 0x477d35
xor eax, eax
call fcn.0044c7b4
jmp 0x477d35
call fcn.00436a48
jmp 0x477d35
call fcn.00464e04
jmp 0x477d35
mov al, 1
call fcn.0044f0b4
jmp 0x477d35
mov al, 2
call fcn.0044f0b4
jmp 0x477d35
mov dl, 0x37
mov ax, 0x2c
call fcn.0048841c
dec eax
jne 0x477d35
mov eax, dword [0x4bebd4]
cmp byte [eax], 0
je 0x477af9
push 0
push 0x89
mov eax, dword [0x4bed90]
mov eax, dword [eax]
push eax
call sub.user32.dll_DeleteMenu
mov eax, dword [0x4becf4]
mov al, byte [eax + 0xb7]
mov edx, dword [0x4be784]
mov byte [edx + 0x1860], al
call fcn.00427d08
jmp 0x477d35
call fcn.004b16e8
jmp 0x477d35
mov eax, dword [0x4be784]
cmp byte [eax + 0xa3b], 0
je 0x477b6f
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00481b08
test al, al
je 0x477d4e
mov eax, dword [0x4be784]
mov byte [eax + 0xa3b], 0
mov eax, dword [0x4bef50]
cmp dword [eax], 0
je 0x477b4f
mov eax, dword [0x4bef50]
mov eax, dword [eax]
call fcn.004a9cd0
mov eax, dword [0x4bef50]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4be588]
mov word [eax], 0
push 0
push 0xb4
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
jmp 0x477bb6
mov eax, dword [0x4be784]
mov byte [eax + 0xa3b], 1
mov eax, dword [0x4be588]
mov word [eax], 0xc8
push 8
push 0xb4
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x4bee68]
cmp byte [eax], 6
jae 0x477bb6
mov ax, 0x349
call fcn.004aa600
mov edx, 4
call fcn.004b12a8
call fcn.00428aa4
call fcn.00484fd8
call fcn.004288d0
call fcn.0044b420
jmp 0x477d35
mov eax, dword [0x4be784]
cmp byte [eax + 0xa3a], 0
je 0x477c02
mov eax, dword [0x4be784]
mov byte [eax + 0xa3a], 0
push 0
push 0xb5
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
jmp 0x477d35
mov eax, dword [0x4be784]
mov byte [eax + 0xa3a], 1
push 8
push 0xb5
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
jmp 0x477d35
mov dl, 0x3e
mov ax, 0x31
call fcn.0048841c
dec eax
jne 0x477d35
call fcn.0044b498
jmp 0x477d35
call fcn.0042eae4
jmp 0x477d35
mov ax, 0x49
call fcn.004aa600
mov edx, 0x13
call fcn.004b12a8
cmp al, 1
jne 0x477d35
mov eax, dword [0x4be9c8]
mov byte [eax], 1
call fcn.0042eae4
mov eax, dword [0x4be9c8]
mov byte [eax], 0
jmp 0x477d35
mov al, 2
call fcn.0044c990
jmp 0x477d35
mov al, 1
call fcn.0044c990
jmp 0x477d35
xor eax, eax
call fcn.004738bc
jmp 0x477d35
mov al, 1
call fcn.004738bc
jmp 0x477d35
mov al, 2
call fcn.004738bc
jmp 0x477d35
mov al, 3
call fcn.004738bc
jmp 0x477d35
mov al, 4
call fcn.004738bc
jmp 0x477d35
mov al, 5
call fcn.004738bc
jmp 0x477d35
mov eax, dword [0x4be744]
cmp dword [eax], 0
jle 0x477d35
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov ebp, dword [edx + eax*4 - 4]
cmp byte [ebp + 0x449], 0
jne 0x477d12
call sub.user32.dll_GetFocus
mov edx, dword [0x4bec7c]
mov edx, dword [edx]
mov ecx, dword [0x4be754]
cmp eax, dword [ebp]
je 0x477d35
push edi
movzx eax, bx
push eax
push 0x111
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
cmp bx, 0x82
jb 0x477d4e
cmp bx, 0x84
ja 0x477d4e
xor ecx, ecx
mov dl, 1
xor eax, eax
call fcn.0044b274
mov eax, esi
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret