Function at 0x4860f8
Capabilities:
Create process on windows
Get graphical window text
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov ebx, eax
xor esi, esi
push 8
lea eax, [esp + 4]
push eax
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_GetClassNameA
mov eax, dword [0x48d8e0]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x486148
push edi
movzx eax, bx
push eax
push 0x111
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_SendMessageA
test eax, eax
je 0x486ea2
cmp bx, 0x12c
jbe 0x48615f
cmp bx, 0x136
jae 0x48615f
mov eax, ebx
sub al, 0x2c
call fcn.00485e7c
cmp bx, 0x4a
jbe 0x486177
cmp bx, 0x4f
jae 0x486177
mov edx, ebx
sub dl, 0x4a
xor eax, eax
call fcn.004145f0
movzx eax, bx
add eax, 0xfffffff8
cmp eax, 0xcf
ja case.0x48618e.8
mov al, byte [eax + 0x486195]
jmp dword [eax*4 + 0x486265]
mov dl, 0x2c
mov ax, 0x19
call fcn.0042d52c
jmp 0x486e89
call fcn.00451a40
jmp 0x486e89
call fcn.00460b7c
jmp 0x486e89
call fcn.00481a18
jmp 0x486e89
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00460e50
jmp 0x486e89
xor ecx, ecx
xor edx, edx
mov al, 2
call fcn.00460e50
jmp 0x486e89
push 0xff
mov eax, dword [0x48da44]
push eax
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x48645a
mov eax, dword [0x48d704]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x486441
push 0x486eac
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x48645a
push 0
push 0xd
push pe_nt_image_headers32
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_SendMessageA
jmp 0x486e89
mov eax, dword [0x48d550]
cmp byte [eax + 0x18d2], 0
je 0x4864e4
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d330]
movsx edx, word [edx]
cmp eax, edx
jg 0x4864e4
mov eax, dword [0x48d930]
cmp dword [eax], 0
jle 0x4864e4
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
cmp dword [edx + eax*4 - 4], 0
je 0x4864e4
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4864e4
push 0
push 0xd
push 0x102
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x486e89
call fcn.00486018
jmp 0x486e89
push 0
push 0
push 0x10
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x486e89
mov al, 0xe
call fcn.0042aef4
test al, al
je 0x486ea2
mov edx, dword [0x48d370]
mov eax, dword [0x48da44]
call fcn.00405c48
push 1
push 0x486ebc
push 0x486ebc
mov eax, dword [0x48da44]
push eax
push 0
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [0x48d29c]
mov dword [edx], eax
mov eax, dword [0x48d29c]
cmp dword [eax], 0x20
ja 0x486e89
mov eax, dword [0x48d29c]
cmp dword [eax], 0
jbe 0x486e89
mov edx, dword [0x48da44]
mov ax, 7
call fcn.0040de10
jmp 0x486e89
call fcn.0048545c
jmp 0x486e89
call fcn.00451b90
jmp 0x486e89
call fcn.00451fa8
jmp 0x486e89
call fcn.00452c70
jmp 0x486e89
push 0
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00453538
jmp 0x486e89
push 0
mov cl, 1
xor edx, edx
xor eax, eax
call fcn.00453538
jmp 0x486e89
mov al, 1
call fcn.00446ee4
jmp 0x486e89
mov al, 1
call fcn.00452810
jmp 0x486e89
mov al, 1
call fcn.00452364
jmp 0x486e89
xor eax, eax
call fcn.00485a90
jmp 0x486e89
call fcn.00460d90
mov eax, dword [0x48db64]
mov byte [eax], 1
call fcn.00460b7c
jmp 0x486e89
call fcn.00462a10
jmp 0x486e89
mov eax, dword [0x48d510]
cmp dword [eax], 0
jle 0x486640
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
call fcn.00482054
jmp 0x486e89
mov eax, dword [0x48d59c]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dl, 0x3a
mov ax, 0x13
call fcn.0042d52c
jmp 0x486e89
call fcn.0046445c
jmp 0x486e89
mov al, 1
call fcn.00441e60
jmp 0x486e89
mov dl, 0x37
mov ax, 0xe
call fcn.0042d52c
dec eax
jne 0x486e89
call fcn.00412884
jmp 0x486e89
xor eax, eax
call fcn.0046ad0c
jmp 0x486e89
mov al, 1
call fcn.0046ad0c
jmp 0x486e89
call fcn.00464718
jmp 0x486e89
call fcn.004647c0
jmp 0x486e89
call fcn.00464940
jmp 0x486e89
push 1
push 0x486ec0
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x486e89
mov edx, 0x486ec0
mov ax, 7
call fcn.0040de10
jmp 0x486e89
call fcn.0047d24c
jmp 0x486e89
call fcn.00464a94
jmp 0x486e89
mov dl, 0x3f
mov ax, 0x1d
call fcn.0042d52c
dec eax
jne 0x486e89
call fcn.0044145c
mov eax, dword [0x48d93c]
mov byte [eax], 0
jmp 0x486e89
xor eax, eax
call fcn.00465a30
jmp 0x486e89
xor eax, eax
call fcn.00462128
jmp 0x486e89
mov al, 1
call fcn.00462128
jmp 0x486e89
mov al, 2
call fcn.00462128
jmp 0x486e89
call fcn.00464cd4
jmp 0x486e89
mov dl, 0x38
mov ax, 0x1b
call fcn.0042d52c
jmp 0x486e89
call fcn.004666c4
jmp 0x486e89
xor eax, eax
call fcn.0045d238
jmp 0x486e89
push 5
push 0
push 0
mov eax, dword [0x48d478]
mov eax, dword [eax]
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x486e89
push 5
push 0
push 0
mov ax, 0x28c
call fcn.0040bc04
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x486e89
mov al, 1
call fcn.00411204
jmp 0x486e89
test edi, edi
jne 0x4867e1
mov dl, 2
mov ax, 0x13
call fcn.0042d52c
test eax, eax
je 0x486ea2
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov edi, dword [edx + eax*4 - 4]
mov eax, edi
call fcn.00464bb4
mov eax, edi
call fcn.0047e098
mov eax, dword [0x48da60]
fistp qword [eax]
wait
mov eax, dword [0x48da60]
push dword [eax + 4]
push dword [eax]
mov eax, dword [0x48d944]
mov cl, 1
mov dl, 1
call fcn.00456504
mov esi, eax
test esi, esi
jle 0x486847
call fcn.00458a10
test al, al
jne 0x486840
mov eax, dword [0x48db98]
cmp byte [eax], 0
jne 0x486840
mov eax, edi
call fcn.00481d20
mov eax, edi
call fcn.0047bd88
call fcn.004567fc
jmp 0x486e89
call fcn.00412194
jmp 0x486e89
mov eax, dword [0x48d488]
cmp byte [eax], 2
jne 0x486872
xor ecx, ecx
xor edx, edx
mov ax, 0x81
call fcn.004860f8
mov eax, dword [0x48d488]
cmp byte [eax], 1
je 0x486913
mov eax, dword [0x48d488]
cmp byte [eax], 0
jne 0x4868c9
call fcn.00477b44
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4868b3
push 0
push 0
push 0x226
mov eax, dword [0x48da1c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4868c9
push 0
push 1
push 0x226
mov eax, dword [0x48da1c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0x48d488]
mov byte [eax], 1
mov al, 1
call fcn.00477b88
push 0
push 0
push 0x415
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 8
push 0x80
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
jmp 0x486e89
push 0
push 0x80
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x48d488]
mov byte [eax], 0
jmp 0x486e89
mov eax, dword [0x48d488]
cmp byte [eax], 1
jne 0x48694b
xor ecx, ecx
xor edx, edx
mov ax, 0x80
call fcn.004860f8
mov eax, dword [0x48d488]
cmp byte [eax], 2
je 0x4869f6
mov eax, dword [0x48d488]
cmp byte [eax], 0
jne 0x4869a2
call fcn.00477b44
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x48698c
push 0
push 0
push 0x226
mov eax, dword [0x48da1c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4869a2
push 0
push 1
push 0x226
mov eax, dword [0x48da1c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0x48d488]
mov byte [eax], 2
mov al, 1
call fcn.00477b88
mov eax, dword [0x48d510]
cmp dword [eax], 2
jle 0x4869dd
push 0
push 0
push 0x415
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 8
push 0x81
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
jmp 0x486e89
push 0
push 0x81
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
call fcn.00477a5c
mov eax, dword [0x48d488]
mov byte [eax], 0
jmp 0x486e89
push 0
push 0
push 0x227
mov eax, dword [0x48da1c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x486e89
push 0
push 1
push 0x226
mov eax, dword [0x48da1c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x486e89
push 0
push 0
push 0x226
mov eax, dword [0x48da1c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x486e89
call fcn.00460d90
jmp 0x486e89
push 0
push 0
push 0x228
mov eax, dword [0x48da1c]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
jmp 0x486e89
push 5
push 0
push 0
push 0x486ecc
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x486e89
call fcn.00486018
jmp 0x486e89
call fcn.00411278
jmp 0x486e89
mov eax, dword [0x48d550]
mov al, byte [eax + 0x190f]
xor al, 1
mov edx, dword [0x48d550]
mov byte [edx + 0x190f], al
call fcn.0044145c
mov eax, dword [0x48d93c]
mov byte [eax], 0
jmp 0x486e89
mov eax, dword [0x48d550]
mov al, byte [eax + 0x18ee]
xor al, 1
mov edx, dword [0x48d550]
mov byte [edx + 0x18ee], al
mov edx, dword [0x48d550]
test al, al
je 0x486b3a
push 8
push 0x8e
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x48d88c]
mov byte [eax], 0x18
push 5
mov eax, dword [0x48d718]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x486b65
push 0
push 0x8e
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x48d88c]
mov byte [eax], 0
push 0
mov eax, dword [0x48d718]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
call fcn.00445468
call fcn.00460dd8
jmp 0x486e89
mov eax, dword [0x48d550]
mov al, byte [eax + 0x193c]
xor al, 1
mov edx, dword [0x48d550]
mov byte [edx + 0x193c], al
mov edx, dword [0x48d550]
test al, al
je 0x486bb5
push 8
push 0x8f
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x48d7dc]
mov byte [eax], 0x19
jmp 0x486bd1
push 0
push 0x8f
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [0x48d7dc]
mov byte [eax], 0
mov al, 1
call fcn.00464398
call fcn.00445468
call fcn.00460dd8
jmp 0x486e89
mov eax, dword [0x48d550]
mov al, byte [eax + 0x1939]
xor al, 1
mov edx, dword [0x48d550]
mov byte [edx + 0x1939], al
mov edx, dword [0x48d550]
test al, al
je 0x486c20
push 8
push 0x90
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
jmp 0x486c34
push 0
push 0x90
mov eax, dword [0x48d520]
mov eax, dword [eax]
push eax
call sub.user32.dll_CheckMenuItem
call fcn.00444e54
call fcn.00445468
call fcn.00460dd8
jmp 0x486e89
mov al, 2
call fcn.00452364
jmp 0x486e89
push 5
push 0
push 0
mov eax, dword [0x48d960]
mov eax, dword [eax]
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x486e89
mov edx, 0x486ef8
mov eax, dword [0x48da44]
call fcn.00405c48
mov eax, dword [0x48d550]
mov al, byte [eax + 0x188c]
test al, al
jne 0x486ca0
push 0x486f20
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
jmp 0x486cba
mov edx, dword [0x48d550]
cmp al, 2
jne 0x486cba
push 0x486f24
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 0x486f28
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 5
push 0
push 0
mov eax, dword [0x48da44]
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x486e89
mov al, 2
call fcn.00452810
jmp 0x486e89
xor eax, eax
call fcn.00461db4
jmp 0x486e89
call fcn.00453700
jmp 0x486e89
call fcn.00473f7c
jmp 0x486e89
mov al, 1
call fcn.00464870
jmp 0x486e89
mov al, 2
call fcn.00464870
jmp 0x486e89
mov dl, 0x31
mov ax, 0x2c
call fcn.0042d52c
dec eax
jne 0x486e89
mov eax, dword [0x48d8b8]
cmp byte [eax], 0
je 0x486d8d
push 0
push 0x89
mov eax, dword [0x48da28]
mov eax, dword [eax]
push eax
call sub.user32.dll_DeleteMenu
push 0
push 0xab
mov eax, dword [0x48da28]
mov eax, dword [eax]
push eax
call sub.user32.dll_DeleteMenu
mov eax, dword [0x48d998]
mov al, byte [eax + 0xb7]
mov edx, dword [0x48d550]
mov byte [edx + 0x1860], al
call fcn.00444994
jmp 0x486e89
call fcn.00412194
jmp 0x486e89
call fcn.0044b0d8
jmp 0x486e89
mov ax, 0x49
call fcn.0040bc04
mov edx, 0x13
call fcn.00411d74
cmp al, 1
jne 0x486e89
mov eax, dword [0x48d720]
mov byte [eax], 1
call fcn.0044b0d8
mov eax, dword [0x48d720]
mov byte [eax], 0
jmp 0x486e89
mov al, 2
call fcn.00461f90
jmp 0x486e89
mov al, 1
call fcn.00461f90
jmp 0x486e89
xor eax, eax
call fcn.00481b04
jmp 0x486e89
mov al, 1
call fcn.00481b04
jmp 0x486e89
mov al, 2
call fcn.00481b04
jmp 0x486e89
mov al, 3
call fcn.00481b04
jmp 0x486e89
mov al, 4
call fcn.00481b04
jmp 0x486e89
mov al, 5
call fcn.00481b04
jmp 0x486e89
mov eax, dword [0x48d510]
cmp dword [eax], 0
jle 0x486e89
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov ebp, dword [edx + eax*4 - 4]
cmp byte [ebp + 0x564], 0
jne 0x486e66
call sub.user32.dll_GetFocus
mov edx, dword [0x48d930]
mov edx, dword [edx]
mov ecx, dword [0x48d524]
cmp eax, dword [ebp]
je 0x486e89
push edi
movzx eax, bx
push eax
push 0x111
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
cmp bx, 0x82
jb 0x486ea2
cmp bx, 0x84
ja 0x486ea2
xor ecx, ecx
mov dl, 1
xor eax, eax
call fcn.00460c38
mov eax, esi
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret