Function at 0x47b7f0
Capabilities:
Hide graphical window
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5153f8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x573be0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
cmp eax, 0x204
je 0x47b8d7
cmp eax, 0x206
je 0x47b8d7
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa2
call edi
push 0xa3
shr eax, 7
and eax, 0xffffff01
mov dword [esp + 0x34], eax
call edi
push 0xa4
shr eax, 7
and eax, 0xffffff01
mov dword [esp + 0x38], eax
call edi
push 0xa5
shr eax, 7
and eax, 0xffffff01
mov dword [esp + 0x3c], eax
call edi
shr eax, 7
and al, 1
jne 0x47b89d
cmp byte [esp + 0x38], al
jne 0x47b89d
cmp byte [esp + 0x34], al
jne 0x47b899
cmp byte [esp + 0x30], al
je 0x47b89d
mov cl, 1
jmp 0x47b89f
xor cl, cl
mov eax, dword [ebx + 4]
cmp eax, 0x100
jne 0x47b8b3
cmp dword [ebx + 8], 0x74
je 0x47b8d7
test cl, cl
jne 0x47b8d7
cmp eax, 0x20a
jne 0x47b8be
test cl, cl
jne 0x47b8d7
cmp eax, 0x112
jne 0x47b8f1
cmp dword [ebx + 8], 0xf060
jne 0x47b8f1
mov eax, dword [esi + 0x34]
lea ecx, [esi + 0x34]
call dword [eax + 0x10]
mov eax, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0x113
jne 0x47c1da
mov eax, dword [ebx + 8]
cmp eax, 0xb
jne 0x47c11b
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x58], 0
movzx eax, byte [esi + 0xa9]
push eax
lea eax, [esp + 0x2c]
push str.doc_complete_is__d
push eax
call fcn.00421610
add esp, 0xc
lea ecx, [esp + 0x24]
push str.installer_main_timeout
call fcn.004204a0
lea edx, [esp + 0x28]
lea ecx, [esp + 0x24]
mov byte [esp + 0x58], 1
call fcn.00422800
lea ecx, [esp + 0x24]
mov byte [esp + 0x58], 0
call fcn.004205e0
push str.no_call_to_show_kill_the_process
lea ecx, [esp + 0x20]
call fcn.00420550
push str.PreTranslateMessage
lea ecx, [esp + 0x24]
mov byte [esp + 0x5c], 2
call fcn.004204a0
mov byte [esp + 0x58], 3
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x28]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x5c], 4
call fcn.00421890
add esp, 4
mov byte [esp + 0x58], 5
cmp dword [esi + 0x58], 0
je 0x47b9e2
push 2
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0x54]
push eax
call fcn.004219a0
lea ecx, [esp + 0x38]
call fcn.004205e0
lea ecx, [esp + 0x24]
call fcn.004205e0
lea ecx, [esp + 0x20]
call fcn.004205e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x58], 0
call fcn.004205e0
push 0xb
push dword [esi - 0x24]
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, str.http:__fallback.playtech_installer.com_playtech_compressed_assets_casino_omni_index.7ze
lea ecx, [esi + 0xbc]
mov bl, 1
xor bh, bh
call fcn.00475b80
test al, al
je 0x47bbdb
cmp byte [esi + 0xa9], bh
jne 0x47bbdb
push str.fall_back_1
lea ecx, [esp + 0x20]
mov byte [esi + 0xb9], bl
call fcn.00420550
push str.PreTranslateMessage
lea ecx, [esp + 0x24]
mov byte [esp + 0x5c], 6
call fcn.004204a0
mov byte [esp + 0x58], 7
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x28]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x5c], 8
call fcn.00421890
add esp, 4
mov byte [esp + 0x58], 9
cmp dword [esi + 0x58], 0
je 0x47bab4
push 0
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0x54]
push eax
call fcn.004219a0
lea ecx, [esp + 0x38]
call fcn.004205e0
lea ecx, [esp + 0x24]
call fcn.004205e0
lea ecx, [esp + 0x20]
call fcn.004205e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x58], 0
call fcn.004205e0
mov eax, dword [esi + 0xc0]
lea ecx, [esi + 0xc0]
cmp dword [eax - 0xc], 0
je 0x47bafd
push ecx
lea ecx, [esi + 0xbc]
call fcn.004222b0
jmp 0x47bb0d
push str.http:__fallback.playtech_installer.com_playtech_compressed_assets_casino_omni_index.7ze
lea ecx, [esi + 0xbc]
call fcn.00420600
lea ecx, [esi - 0x28]
call fcn.00481870
test al, al
je 0x47bb40
lea ecx, [esi - 0x28]
mov dword [esi + 0xf4], 2
mov byte [esi + 0xa8], 0
call fcn.0047b250
lea ecx, [esp + 0x28]
call fcn.004205e0
jmp 0x47b8d7
push str.prepareInstallerPackage_fail_for_fallback_url
lea ecx, [esp + 0x20]
call fcn.00420550
push str.PreTranslateMessage
lea ecx, [esp + 0x24]
mov byte [esp + 0x5c], 0xa
call fcn.004204a0
mov byte [esp + 0x58], 0xb
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x28]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x5c], 0xc
call fcn.00421890
add esp, 4
mov byte [esp + 0x58], 0xd
cmp dword [esi + 0x58], 0
je 0x47bbb0
push 2
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0x54]
push eax
call fcn.004219a0
lea ecx, [esp + 0x38]
call fcn.004205e0
lea ecx, [esp + 0x24]
call fcn.004205e0
lea ecx, [esp + 0x20]
call fcn.004205e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x58], 0
call fcn.004205e0
mov bh, 1
cmp byte [esi + 0xb9], 0
je 0x47bee6
cmp byte [esi + 0xa9], 0
jne 0x47bee6
mov byte [esi + 0xb9], 0
mov ecx, dword [0x57b324]
lea ecx, [ecx - 0x10]
call fcn.00420750
add eax, 0x10
mov dword [esp + 0x24], eax
push str.index.7ze
lea ecx, [esp + 0x28]
mov byte [esp + 0x5c], 0xe
call fcn.004286d0
lea ecx, [esp + 0x24]
call fcn.00425da0
test al, al
je 0x47bed0
mov dword [esi + 0xf4], 3
mov ecx, dword [0x57b2ac]
lea ecx, [ecx - 0x10]
call fcn.00420750
add eax, 0x10
mov dword [esp + 0x20], eax
lea edi, [esi + 0xc4]
mov byte [esp + 0x58], 0xf
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x47bc73
push str.index.7ze
mov ecx, edi
call fcn.00420600
mov eax, dword [edi]
lea ecx, [esp + 0x20]
push dword [eax - 0xc]
push eax
call fcn.00428940
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push edi
mov edx, 0x57b2ac
lea ecx, [esp + 0x2c]
mov byte [esp + 0x60], 0x10
call fcn.00426550
add esp, 8
test al, al
jne 0x47be0d
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x58], 0x11
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push str.setNavigation_error_CopyFile__s
push eax
call fcn.00421610
add esp, 0xc
lea ecx, [esp + 0x38]
push str.CopyFile_error
call fcn.004204a0
push str.PreTranslateMessage
lea ecx, [esp + 0x38]
mov byte [esp + 0x5c], 0x12
call fcn.004204a0
mov byte [esp + 0x58], 0x13
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x58], 0x14
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
lea edx, [esp + 0x30]
lea ecx, [esp + 0x4c]
mov byte [esp + 0x5c], 0x15
call fcn.00421890
add esp, 4
lea ecx, [esp + 0x38]
push ecx
mov edx, eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x5c], 0x16
call fcn.00421890
add esp, 4
lea ecx, [esp + 0x18]
push ecx
mov edx, eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x5c], 0x17
call fcn.00421890
add esp, 4
mov byte [esp + 0x58], 0x18
cmp dword [esi + 0x58], 0
je 0x47bda2
push 2
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esi + 0x54]
push eax
call fcn.004219a0
lea ecx, [esp + 0x3c]
call fcn.004205e0
lea ecx, [esp + 0x44]
call fcn.004205e0
lea ecx, [esp + 0x48]
call fcn.004205e0
lea ecx, [esp + 0x2c]
call fcn.004205e0
lea ecx, [esp + 0x30]
call fcn.004205e0
lea ecx, [esp + 0x34]
call fcn.004205e0
lea ecx, [esp + 0x38]
mov byte [esp + 0x58], 0x11
call fcn.004205e0
push ecx
mov ecx, esp
push 0x54c728
call fcn.004204a0
lea ecx, [esp + 0x1c]
call fcn.00422b40
add esp, 4
lea ecx, [esp + 0x18]
call fcn.004205e0
jmp 0x47bebe
push ecx
lea ecx, [esi - 0x28]
call fcn.00483a60
test al, al
jne 0x47beb4
push str.unpackPackage_error
lea ecx, [esp + 0x34]
call fcn.004204a0
push str.PreTranslateMessage
lea ecx, [esp + 0x38]
mov byte [esp + 0x5c], 0x19
call fcn.004204a0
mov byte [esp + 0x58], 0x1a
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x38], eax
lea eax, [esp + 0x30]
push eax
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x4c]
mov byte [esp + 0x5c], 0x1b
call fcn.00421890
add esp, 4
mov byte [esp + 0x58], 0x1c
cmp dword [esi + 0x58], 0
je 0x47be8e
push 2
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esi + 0x54]
push eax
call fcn.004219a0
lea ecx, [esp + 0x48]
call fcn.004205e0
lea ecx, [esp + 0x38]
call fcn.004205e0
lea ecx, [esp + 0x34]
call fcn.004205e0
lea ecx, [esp + 0x30]
call fcn.004205e0
jmp 0x47bebe
lea ecx, [esi - 0x28]
call fcn.0047b250
xor bl, bl
lea ecx, [esp + 0x1c]
call fcn.004205e0
lea ecx, [esp + 0x20]
call fcn.004205e0
lea ecx, [esp + 0x24]
mov byte [esp + 0x58], 0
call fcn.004205e0
test bl, bl
je 0x47c10d
push str.no_more_fall_backs
lea ecx, [esp + 0x34]
call fcn.00420550
push str.PreTranslateMessage
lea ecx, [esp + 0x38]
mov byte [esp + 0x5c], 0x1d
call fcn.004204a0
mov byte [esp + 0x58], 0x1e
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x38], eax
lea eax, [esp + 0x30]
push eax
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x4c]
mov byte [esp + 0x5c], 0x1f
call fcn.00421890
add esp, 4
mov byte [esp + 0x58], 0x20
cmp dword [esi + 0x58], 0
je 0x47bf56
push 0
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esi + 0x54]
push eax
call fcn.004219a0
lea ecx, [esp + 0x48]
call fcn.004205e0
lea ecx, [esp + 0x38]
call fcn.004205e0
lea ecx, [esp + 0x34]
call fcn.004205e0
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 0
call fcn.004205e0
mov eax, dword [esi + 0x34]
lea edi, [esi + 0x34]
mov ecx, edi
mov byte [esi + 0xb1], 0
call dword [eax + 0x28]
call fcn.00492300
test al, al
je 0x47c02e
cmp dword [esi + 0xb4], 0
lea ecx, [esp + 0x3c]
jne 0x47bfe4
call fcn.00475bd0
push eax
push 0x30
push ecx
mov byte [esp + 0x64], 0x21
mov ecx, esp
mov dword [esp + 0x54], esp
push str.Check_your_internet_connection
call fcn.004204a0
push ecx
mov ecx, esp
push str.Please_check_your_internet_connection_and_try_to_run_the_installer_again.
mov byte [esp + 0x6c], 0x22
call fcn.004204a0
mov eax, dword [edi]
mov byte [esp + 0x68], 0x21
jmp 0x47c01b
call fcn.00475bd0
push eax
push 0x30
push ecx
mov byte [esp + 0x64], 0x23
mov ecx, esp
mov dword [esp + 0x54], esp
push str.Check_your_internet_connection
call fcn.004204a0
push ecx
mov ecx, esp
push str.Please_check_your_internet_connection_and_try_to_run_the_uninstaller_again.
mov byte [esp + 0x6c], 0x24
call fcn.004204a0
mov eax, dword [edi]
mov byte [esp + 0x68], 0x23
mov ecx, edi
call dword [eax + 0x18]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x58], 0
call fcn.004509c0
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x58], 0x25
test bh, bh
je 0x47c052
push str.prepareUrl_error_fallback_url
jmp 0x47c077
cmp byte [esi + 0xa9], 0
je 0x47c062
push str.timeout_after_installer_main
jmp 0x47c077
cmp byte [esi + 0xa8], 0
je 0x47c072
push str.navigation_error_on_fallback_url
jmp 0x47c077
push str.navigation_timeout
lea ecx, [esp + 0x20]
call fcn.00420600
push str.installer_failed
lea ecx, [esp + 0x1c]
call fcn.004204a0
mov byte [esp + 0x58], 0x26
mov eax, dword [esi + 0xb4]
cmp eax, 2
jne 0x47c0a5
push str.uninstaller_failed
jmp 0x47c0c7
cmp eax, 1
jne 0x47c0b1
push str.preuninstaller_failed
jmp 0x47c0c7
cmp eax, 3
jne 0x47c0bd
push str.bg_failed
jmp 0x47c0c7
cmp eax, 4
jne 0x47c0d0
push str.notification_failed
lea ecx, [esp + 0x1c]
call fcn.00420600
push ecx
mov ecx, dword [esp + 0x1c]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.00420750
add eax, 0x10
lea ecx, [esp + 0x20]
mov dword [esi], eax
call fcn.00422b40
mov eax, dword [edi]
add esp, 4
mov ecx, edi
push 0
push 0
call dword [eax + 0xc]
lea ecx, [esp + 0x18]
call fcn.004205e0
lea ecx, [esp + 0x1c]
call fcn.004205e0
lea ecx, [esp + 0x28]
call fcn.004205e0
jmp 0x47b8d7
cmp eax, 0xc
jne 0x47c175
add dword [esi + 0xa4], 0x14
cmp dword [esi + 0xa4], 0xff
jl 0x47c147
push eax
push dword [esi - 0x24]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0xa4], 0xff
movzx eax, byte [esi + 0xa4]
push 2
push eax
push 0
push dword [esi - 0x24]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push dword [esi + 0xa4]
mov ecx, dword [esi + 0xa0]
push dword [esi + 0x60]
call fcn.0044fe90
jmp 0x47b8d7
cmp eax, 0xd
je 0x47c183
cmp eax, 0xe
jne 0x47c233
add dword [esi + 0xa4], 0xffffffec
cmp dword [esi + 0xa4], 0
jg 0x47c147
cmp dword [ebx + 8], 0xd
jne 0x47c1b6
push 0xd
push dword [esi - 0x24]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x34]
lea ecx, [esi + 0x34]
push 0
push 0
call dword [eax + 0xc]
jmp 0x47b8d7
push 0xe
push dword [esi - 0x24]
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x60]
call edi
push 0
push dword [esi - 0x24]
call edi
jmp 0x47b8d7
cmp eax, 0x402
jne 0x47c1f8
mov ecx, dword [ebx + 8]
mov eax, dword [esi + 0xa0]
mov dword [esi + 0xa4], ecx
mov dword [eax + 0x40], ecx
jmp 0x47b8d7
cmp eax, 0x201
jne 0x47c233
movsx eax, word [ebx + 0xc]
cmp eax, dword [esi + 0x74]
jge 0x47c233
movsx eax, word [ebx + 0xe]
cmp eax, dword [esi + 0x78]
jge 0x47c233
push 0
push 0xf012
push 0x112
push dword [esi - 0x24]
call edi
push 0
push 0xf012
push 0x112
push dword [esi + 0x60]
call edi
mov eax, dword [ebx + 4]
cmp eax, 0x100
jb 0x47c244
cmp eax, 0x109
jbe 0x47c252
cmp eax, 0x200
jb 0x47c2be
cmp eax, 0x20e
ja 0x47c2be
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
push edi
push dword [esi - 0x24]
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x47c2a0
push edi
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [esi - 0x24]
je 0x47c289
push edi
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [esi - 0x24]
jne 0x47c274
push ebx
push 0
push 0x37f
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x47b8d7
push ebx
lea ecx, [esi - 0x28]
call fcn.004849a0
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4