Function at 0x487d41
Capabilities:
Capture webcam image
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [ebp + 0xc]
mov ecx, 0x203
push ebx
push esi
mov esi, dword [ebp + 8]
cmp eax, ecx
push edi
ja 0x488728
cmp eax, ecx
je 0x4888ba
mov ecx, 0x135
cmp eax, ecx
ja 0x48866a
je 0x4886ce
cmp eax, 0x20
je 0x488636
cmp eax, 0x4e
je 0x4882f3
cmp eax, 0x111
je 0x487f08
add ecx, 0xffffffde
cmp eax, ecx
je 0x487ed1
jbe 0x488916
cmp eax, 0x115
ja 0x488916
push dword [ebp + 0x14]
call fcn.00486878
xor ebx, ebx
pop ecx
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x488916
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0xe1
push dword [ebp + 0x14]
call esi
mov edi, eax
movzx eax, word [ebp + 0x10]
cmp eax, ebx
je 0x487e6a
cmp eax, 1
je 0x487e4d
cmp eax, 2
je 0x487e30
cmp eax, 3
je 0x487e13
jle 0x487e90
cmp eax, 5
jg 0x487e90
mov eax, dword [ebp + 0x10]
shr eax, 0x10
movsx edi, ax
jmp 0x487e90
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0xe3
push dword [ebp + 0x14]
call esi
mov eax, dword [ebp - 0xc]
push 0xa
sub eax, dword [ebp - 4]
cdq
jmp 0x487e85
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0xe3
push dword [ebp + 0x14]
call esi
mov eax, dword [ebp - 0xc]
push 0xfffffffffffffff6
sub eax, dword [ebp - 4]
cdq
jmp 0x487e85
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0xe3
push dword [ebp + 0x14]
call esi
mov eax, dword [ebp - 0xc]
push 0x64
sub eax, dword [ebp - 4]
cdq
jmp 0x487e85
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0xe3
push dword [ebp + 0x14]
call esi
mov eax, dword [ebp - 0xc]
push 0xffffffffffffff9c
sub eax, dword [ebp - 4]
cdq
pop ecx
idiv ecx
add edi, eax
cmp edi, ebx
jg 0x487e90
xor edi, edi
push 1
push edi
push 0xe0
push dword [ebp + 0x14]
call esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
cmp eax, ebx
je 0x488916
mov edx, dword [eax + 0x1c]
cmp edx, ebx
je 0x488916
cmp byte [edx], bl
je 0x488916
mov ecx, dword [ebp - 8]
push ebx
push ebx
push ebx
push dword [ecx + 4]
push ecx
push eax
push dword [ecx + 0x20]
jmp 0x4888b7
push esi
call fcn.00486878
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x488916
mov ecx, dword [eax + 0x1c]
cmp ecx, ebx
je 0x488916
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
push eax
push eax
push dword [eax + 0x20]
push ecx
call fcn.0047f577
add esp, 0x20
xor eax, eax
jmp 0x488928
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
jne 0x487f45
mov esi, dword [ebp + 0x10]
shr esi, 0x10
cmp si, bx
je 0x487f20
cmp si, 1
jne 0x487f45
push dword [ebp + 8]
call fcn.00486878
cmp eax, ebx
pop ecx
je 0x487f01
mov ecx, dword [eax + 0x1c]
cmp ecx, ebx
je 0x487f01
cmp byte [ecx], bl
je 0x487f01
movzx edx, si
push ebx
push edx
movzx edx, word [ebp + 0x10]
push ebx
push edx
jmp 0x487ef3
push dword [ebp + 0x14]
call fcn.00486878
mov esi, eax
pop ecx
cmp esi, ebx
je 0x488916
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x488916
mov edi, dword [eax + 0x1c]
cmp edi, ebx
mov dword [ebp - 8], edi
je 0x488916
mov ecx, dword [esi + 8]
cmp ecx, 0x14
ja 0x4881d0
je 0x48810c
sub ecx, 0xa
je 0x488278
dec ecx
je 0x487fdb
dec ecx
je 0x4881f1
sub ecx, 4
je 0x487fb8
dec ecx
dec ecx
jne 0x487f01
cmp byte [edi], bl
je 0x487f01
mov ecx, dword [ebp + 0x10]
push ebx
shr ecx, 0x10
push ecx
jmp 0x48828d
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
test cx, cx
jne 0x487f01
cmp byte [edi], bl
je 0x487f01
push ebx
push ebx
push 0x1000
jmp 0x4882e3
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
cmp cx, 5
jne 0x488006
or dword [esi + 0x24], 0xffffffff
mov ecx, dword [eax + 0x1c]
cmp ecx, ebx
je 0x487f01
cmp byte [ecx], bl
je 0x487f01
push ebx
push 5
jmp 0x4880a5
cmp cx, 1
jne 0x4880b5
test byte [esi + 0x14], 0x40
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
jne 0x488076
push ebx
push ebx
push 0x147
push dword [esi]
call edi
cmp eax, 0xffffffff
mov dword [ebp + 0x14], eax
je 0x488076
push ebx
push eax
push 0x149
push dword [esi]
call edi
cmp eax, ebx
je 0x48806a
push eax
call fcn.0047f853
pop ecx
mov dword [ebp + 8], eax
push eax
push dword [ebp + 0x14]
push 0x148
push dword [esi]
call edi
push dword [ebp + 8]
push ebx
push 0xc
push dword [esi]
call edi
push dword [ebp + 8]
call fcn.0047f869
pop ecx
jmp 0x488076
push 0x54dd08
push ebx
push 0xc
push dword [esi]
call edi
push ebx
push ebx
push 0x147
push dword [esi]
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x487f01
mov ecx, dword [eax + 0x1c]
cmp ecx, ebx
je 0x487f01
cmp byte [ecx], bl
je 0x487f01
push ebx
push 1
movzx edx, word [ebp + 0x10]
push ebx
push edx
push esi
push eax
push dword [esi + 0x20]
jmp 0x487ef8
cmp cx, 3
jne 0x487f01
mov edx, dword [eax + 8]
cmp edx, 0x1e
jne 0x4880cf
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x14]
jmp 0x4880d2
mov ecx, dword [eax + 0x14]
and ecx, 0x10
cmp ecx, ebx
je 0x487f01
cmp edx, 0x1e
jne 0x4880ea
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x24]
jmp 0x4880ed
mov edx, dword [eax + 0x24]
mov ecx, 0x1000
and edx, ecx
cmp edx, ebx
je 0x487f01
cmp byte [edi], bl
je 0x487f01
push ebx
push 3
jmp 0x4882e2
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
cmp cx, 2
jne 0x488163
mov edx, dword [eax + 8]
cmp edx, 0x1e
jne 0x488128
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x14]
jmp 0x48812b
mov ecx, dword [eax + 0x14]
and ecx, 0x10
cmp ecx, ebx
je 0x487f01
cmp edx, 0x1e
jne 0x488143
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x24]
jmp 0x488146
mov ecx, dword [eax + 0x24]
and ecx, 0x40
cmp ecx, ebx
je 0x487f01
cmp byte [edi], bl
je 0x487f01
push ebx
push 2
push 0x40
jmp 0x4882e3
cmp cx, 1
jne 0x488179
cmp byte [edi], bl
je 0x487f01
push ebx
push 1
jmp 0x48828d
cmp cx, 4
jne 0x487f01
mov edx, dword [eax + 8]
cmp edx, 0x1e
jne 0x488193
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x14]
jmp 0x488196
mov ecx, dword [eax + 0x14]
and ecx, 0x10
cmp ecx, ebx
je 0x487f01
cmp edx, 0x1e
jne 0x4881ae
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x24]
jmp 0x4881b1
mov edx, dword [eax + 0x24]
mov ecx, 0x1000
and edx, ecx
cmp edx, ebx
je 0x487f01
cmp byte [edi], bl
je 0x487f01
push ebx
push 4
jmp 0x4882e2
sub ecx, 0x17
je 0x488278
dec ecx
je 0x4881f1
dec ecx
je 0x488278
sub ecx, 6
je 0x488278
jmp 0x487f01
mov edx, dword [ebp + 0x10]
mov ecx, 0x300
shr edx, 0x10
cmp dx, cx
jne 0x48820f
cmp byte [edi], bl
je 0x487f01
push ebx
jmp 0x487fb2
mov edi, 0x100
cmp dx, di
jne 0x487f01
mov edx, dword [eax + 8]
cmp edx, 0x1e
jne 0x48822d
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x14]
jmp 0x488230
mov ecx, dword [eax + 0x14]
and ecx, 0x10
cmp ecx, ebx
je 0x487f01
cmp edx, 0x1e
jne 0x488248
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x24]
jmp 0x48824b
mov edx, dword [eax + 0x24]
mov ecx, 0x1000
and edx, ecx
cmp edx, ebx
je 0x487f01
mov edx, dword [ebp - 8]
cmp byte [edx], bl
je 0x487f01
push ebx
push edi
push ecx
movzx ecx, word [ebp + 0x10]
push ecx
push esi
push eax
push dword [esi + 0x20]
push edx
jmp 0x487ef9
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
cmp cx, bx
jne 0x488290
cmp byte [edi], bl
je 0x487f01
push ebx
push ebx
push ebx
jmp 0x4882e3
cmp cx, 6
jne 0x487f01
mov edx, dword [eax + 8]
cmp edx, 0x1e
jne 0x4882aa
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x14]
jmp 0x4882ad
mov ecx, dword [eax + 0x14]
and ecx, 0x10
cmp ecx, ebx
je 0x487f01
cmp edx, 0x1e
jne 0x4882c5
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x24]
jmp 0x4882c8
mov edx, dword [eax + 0x24]
mov ecx, 0x1000
and edx, ecx
cmp edx, ebx
je 0x487f01
cmp byte [edi], bl
je 0x487f01
push ebx
push 6
push ecx
movzx ecx, word [ebp + 0x10]
push ecx
push esi
push eax
push dword [esi + 0x20]
push edi
jmp 0x487ef9
mov edi, dword [ebp + 0x14]
mov esi, dword [edi]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x488916
lea eax, [ebp - 0x120]
push 0xff
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
lea eax, [ebp - 0x120]
push 0x535888
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x48834f
cmp dword [0x54e56c], eax
jne 0x488916
mov eax, dword [edi]
mov dword [0x54e56c], eax
jmp 0x488916
lea eax, [ebp - 0x120]
push 0x535684
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x4883ae
cmp dword [edi + 8], 0xfffffdf8
jne 0x488916
mov eax, dword [0x54e56c]
xor ebx, ebx
cmp eax, ebx
je 0x488916
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push dword [edi + 4]
push 0x419
push eax
call esi
lea ecx, [ebp - 0x20]
push ecx
push eax
push 0x417
push dword [0x54e56c]
call esi
mov eax, dword [ebp - 0x14]
mov dword [edi + 0xc], eax
jmp 0x488916
push dword [ebp - 4]
call fcn.00486878
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
je 0x488916
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x488916
mov edx, dword [eax + 0x1c]
cmp edx, ebx
je 0x488916
mov ecx, dword [esi + 8]
sub ecx, 9
je 0x4885d5
sub ecx, 0xc
je 0x48851b
sub ecx, 7
je 0x48850c
dec ecx
dec ecx
je 0x48846c
dec ecx
dec ecx
jne 0x488916
mov ecx, dword [edi + 8]
cmp ecx, 0xfffffe6e
je 0x488538
cmp ecx, 0xfffffffd
jne 0x488916
cmp dword [eax + 8], 0x1e
jne 0x488429
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x14]
jmp 0x48842c
mov ecx, dword [eax + 0x14]
and ecx, 0x10
cmp ecx, ebx
je 0x488916
cmp dword [eax + 8], 0x1e
jne 0x488445
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x24]
jmp 0x488448
mov ecx, dword [eax + 0x24]
and ecx, 0x40
cmp ecx, ebx
je 0x488916
cmp byte [edx], bl
je 0x488916
push ebx
push ebx
push 0x40
push dword [edi + 4]
push esi
push eax
push dword [esi + 0x20]
jmp 0x4888b7
cmp dword [edi + 8], 0xfffffdd9
jne 0x488916
mov eax, dword [edi]
push ebx
push ebx
push 0x130b
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov dword [ebp + 0x10], eax
push dword [ebp - 4]
call fcn.00486878
pop ecx
push eax
call fcn.00485068
mov eax, dword [esi + 0x18]
pop ecx
pop ecx
mov edx, dword [eax + 8]
cmp edx, 0x1e
jne 0x4884b1
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x14]
jmp 0x4884b4
mov ecx, dword [eax + 0x14]
and ecx, 0x10
cmp ecx, ebx
je 0x487f01
cmp edx, 0x1e
jne 0x4884cc
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x24]
jmp 0x4884cf
mov edx, dword [eax + 0x24]
mov ecx, 0x8000
and edx, ecx
cmp edx, ebx
je 0x487f01
cmp eax, ebx
je 0x487f01
mov edx, dword [eax + 0x1c]
cmp edx, ebx
je 0x487f01
cmp byte [edx], bl
je 0x487f01
push ebx
push dword [ebp + 0x10]
push ecx
push dword [edi + 4]
push esi
push eax
push dword [esi + 0x20]
push edx
jmp 0x487ef9
cmp dword [edi + 8], 0xfffffd2e
jne 0x488916
jmp 0x488538
mov ecx, dword [edi + 8]
cmp ecx, 0xffffff94
je 0x488548
cmp ecx, 0xffffff9b
jne 0x488412
test word [edi + 0x1c], 0x2008
je 0x488916
cmp byte [edx], bl
je 0x488916
push ebx
push ebx
push ebx
jmp 0x48845f
mov eax, dword [esi]
push 0x488ee4
mov dword [0x54e564], eax
push dword [edi + 0x10]
push 0x1030
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x54e564]
call fcn.00488e92
mov eax, dword [esi + 0x18]
pop ecx
mov edx, dword [eax + 8]
cmp edx, 0x1e
jne 0x488583
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x14]
jmp 0x488586
mov ecx, dword [eax + 0x14]
and ecx, 0x10
cmp ecx, ebx
je 0x488916
cmp edx, 0x1e
jne 0x48859e
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x24]
jmp 0x4885a1
mov edx, dword [eax + 0x24]
mov ecx, 0x8000
and edx, ecx
cmp edx, ebx
je 0x488916
cmp eax, ebx
je 0x488916
mov edx, dword [eax + 0x1c]
cmp edx, ebx
je 0x488916
cmp byte [edx], bl
je 0x488916
push ebx
push dword [edi + 0x10]
push ecx
jmp 0x48845f
push dword [ebp - 4]
call fcn.00486878
mov esi, eax
pop ecx
cmp esi, ebx
je 0x488916
cmp dword [edi + 8], 0xfffffd13
jne 0x488916
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x488916
mov eax, dword [eax + 0x1c]
cmp eax, ebx
je 0x488916
cmp byte [eax], bl
je 0x488916
mov eax, dword [esi + 0x18]
push ebx
push ebx
push esi
mov dword [ebp - 8], eax
call fcn.00483885
pop ecx
push eax
mov eax, dword [ebp - 8]
push dword [edi + 4]
push esi
push eax
push dword [esi + 0x20]
push dword [eax + 0x1c]
jmp 0x48890e
push esi
call fcn.00486878
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x488916
mov ecx, dword [eax + 0x28]
cmp ecx, ebx
je 0x488916
mov eax, ecx
inc eax
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 1
pop eax
jmp 0x488928
sub eax, 0x138
je 0x4886ce
sub eax, 0xc8
je 0x48868f
dec eax
je 0x488756
dec eax
jne 0x488916
or dword [ebp + 0x10], 1
jmp 0x488777
push esi
call fcn.00486878
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
je 0x488916
mov eax, dword [esi + 0x24]
mov edi, 0x80
and ax, di
cmp al, 0x80
jne 0x488916
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x48879b
push 0x20
pop eax
jmp 0x48879d
xor ebx, ebx
cmp dword [0x54e558], ebx
je 0x488916
push dword [ebp + 0x14]
call fcn.00486878
mov esi, eax
pop ecx
cmp esi, ebx
je 0x488916
cmp dword [esi + 0x18], ebx
je 0x488916
cmp dword [esi + 8], 0xc
je 0x488916
push dword [0x5359bc]
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esi + 0x18]
cmp dword [eax + 8], 0x1e
jne 0x488916
mov eax, dword [0x54e558]
jmp 0x488928
mov ecx, 0x208
cmp eax, ecx
ja 0x4887be
je 0x488773
sub eax, 0x204
je 0x488756
dec eax
je 0x488750
dec eax
je 0x4888ba
dec eax
je 0x488756
jmp 0x488916
or dword [ebp + 0x10], 2
jmp 0x488777
push esi
call fcn.00486878
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
je 0x488916
mov eax, dword [esi + 0x24]
mov edi, 0x100
jmp 0x488792
or dword [ebp + 0x10], 0x10
push esi
call fcn.00486878
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
je 0x488916
mov eax, dword [esi + 0x24]
mov edi, 0x200
and eax, edi
cmp eax, edi
jmp 0x4886af
xor eax, eax
mov ecx, dword [esi + 0x1c]
cmp ecx, ebx
je 0x488916
cmp byte [ecx], bl
je 0x488916
or eax, dword [ebp + 0x10]
push ebx
push dword [ebp + 0x14]
or eax, edi
jmp 0x488906
sub eax, 0x209
je 0x4888ba
sub eax, 0x7dfa
je 0x488848
dec eax
je 0x4887f5
dec eax
jne 0x488916
push dword [ebp + 8]
call fcn.00486878
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x487f01
mov eax, dword [eax + 4]
jmp 0x488928
push dword [ebp + 0x10]
call fcn.00486878
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x488916
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x488916
mov esi, dword [ecx + 8]
cmp esi, 0x1e
jne 0x488823
mov edx, dword [ecx + 0x18]
mov edx, dword [edx + 0x14]
jmp 0x488826
mov edx, dword [ecx + 0x14]
and edx, 0x10
cmp edx, ebx
je 0x488916
cmp esi, 0x1e
jne 0x48883e
mov edx, dword [ecx + 0x18]
mov edx, dword [edx + 0x24]
jmp 0x488841
mov edx, dword [ecx + 0x24]
mov esi, 0x800
jmp 0x488899
push dword [ebp + 0x10]
call fcn.00486878
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x488916
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x488916
mov esi, dword [ecx + 8]
cmp esi, 0x1e
jne 0x488876
mov edx, dword [ecx + 0x18]
mov edx, dword [edx + 0x14]
jmp 0x488879
mov edx, dword [ecx + 0x14]
and edx, 0x10
cmp edx, ebx
je 0x488916
cmp esi, 0x1e
jne 0x488891
mov edx, dword [ecx + 0x18]
mov edx, dword [edx + 0x24]
jmp 0x488894
mov edx, dword [ecx + 0x24]
mov esi, 0x400
and edx, esi
cmp edx, ebx
je 0x488916
mov edx, dword [ecx + 0x1c]
cmp edx, ebx
je 0x488916
cmp byte [edx], bl
je 0x488916
push ebx
push dword [ebp + 0x14]
push esi
push dword [eax + 4]
push eax
push ecx
push dword [eax + 0x20]
push edx
jmp 0x48890e
push esi
call fcn.00486878
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x488916
mov eax, dword [eax + 0x24]
and eax, 0x40
cmp al, 0x40
jne 0x488916
push esi
call fcn.00486878
pop ecx
mov esi, eax
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4888ec
push 0x20
pop eax
jmp 0x4888ee
xor eax, eax
cmp esi, ebx
je 0x488916
mov ecx, dword [esi + 0x1c]
cmp ecx, ebx
je 0x488916
cmp byte [ecx], bl
je 0x488916
or eax, dword [ebp + 0x10]
push ebx
push dword [ebp + 0x14]
or al, 0x40
push eax
push ebx
push esi
push esi
push dword [esi + 0x20]
push ecx
call fcn.0047f577
add esp, 0x20
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebx
leave
ret 0x10