Function at 0x47e9fc
Capabilities:
Create process on windows
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, 0x37
mov ebx, ecx
push edi
mov dword [ebp - 0x38], ebx
jg 0x47ea74
cmp esi, 0x34
jge 0x47ea69
cmp esi, 0x13
je 0x47ea4a
cmp esi, 0x2e
je 0x47ea40
cmp esi, 0x30
jle 0x47ea8f
cmp esi, 0x32
jle 0x47ea69
cmp esi, 0x33
jne 0x47ea8f
mov ecx, dword [ebx + 4]
call fcn.0046c124
jmp 0x47f33e
call fcn.00481b23
jmp 0x47f33e
mov ecx, dword [0x4c9224]
test ecx, ecx
je 0x47ea8f
cmp byte [ecx + 0x10], 0
jne 0x47ea8f
cmp dword [ecx + 0x24], 0
jbe 0x47ea8f
push 1
call fcn.004023fa
jmp 0x47ea8f
push esi
call fcn.0047e77e
jmp 0x47f33e
cmp esi, 0x41
je 0x47f339
cmp esi, 0x70
je 0x47f332
cmp esi, 0x73
je 0x47f32b
mov byte [ebp - 1], 0
cmp esi, 0x28
jne 0x47eaa8
mov eax, dword [0x4c934c]
cmp eax, 4
jae 0x47eaa8
add eax, 0x17
mov dword [ebp + 8], eax
mov esi, dword [ebx + 0xc0]
mov edi, dword [esi + 0x14]
mov eax, edi
imul eax, eax, 0xc
call section..text
mov eax, edi
shl eax, 2
mov dword [ebp - 0x4c], esp
call section..text
mov esi, dword [esi + 8]
and dword [ebp - 0x20], 0
and dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], esp
push 2
push 0xffffffffffffffff
push 0x100c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x47ec2f
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc0]
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax + 0x14]
jae 0x47ec2f
mov esi, dword [ebp - 8]
mov eax, dword [ebx + 0x5c]
imul esi, esi, 0xdc
mov edi, dword [ebp - 0x18]
and dword [ebp - 0x28], 0
add eax, esi
mov ecx, dword [eax]
mov dword [edi], ecx
cmp ecx, 1
jne 0x47ebd2
mov ecx, dword [eax + 0x7c]
call fcn.00435cab
mov ecx, dword [eax + 0x20]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x3c], ecx
test ecx, ecx
jbe 0x47ebd2
mov ecx, dword [ebx + 0x5c]
mov edx, dword [eax + 0x18]
add ecx, esi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 4]
mov ecx, dword [edx + 4]
mov ax, word [ecx]
cmp ax, word [edi]
jne 0x47eb80
test ax, ax
je 0x47eb7c
mov ax, word [ecx + 2]
cmp ax, word [edi + 2]
jne 0x47eb80
add ecx, 4
add edi, 4
test ax, ax
jne 0x47eb5a
xor eax, eax
jmp 0x47eb85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47ebbc
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 0x80]
mov ecx, dword [edx + 8]
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x47ebb3
test al, al
je 0x47ebaf
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x47ebb3
inc ecx
inc ecx
inc edi
inc edi
test al, al
jne 0x47eb95
xor eax, eax
jmp 0x47ebb8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47ebcc
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add edx, 0x28
cmp eax, dword [ebp - 0x3c]
jb 0x47eb51
jmp 0x47ebcf
mov dword [ebp - 0x28], edx
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x5c]
add esi, eax
cmp dword [esi], 0
jne 0x47ebe7
mov eax, dword [esi + 0x78]
jmp 0x47ebe9
xor eax, eax
cmp dword [edi], 0
mov dword [edi + 4], eax
jne 0x47ec00
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 0x78]
mov ecx, dword [ebp - 0x2c]
inc dword [ebp - 0x24]
mov dword [ecx + edx*4], eax
mov eax, dword [ebx + 0xc0]
mov eax, dword [eax + 8]
inc dword [ebp - 0x20]
push 2
push dword [ebp - 8]
add edi, 0xc
push 0x100c
push eax
mov dword [ebp - 0x18], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x47eaf8
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
sub eax, edi
xor ebx, ebx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x20], ebx
je 0x47f33e
mov esi, dword [ebp + 8]
push 0x24
pop eax
cmp edi, ebx
jbe 0x47ecab
cmp esi, 0x17
je 0x47ec59
cmp esi, 0x18
jne 0x47ec75
cmp byte [0x4c922d], bl
je 0x47ec75
mov dword [ebp - 0x84], 9
mov dword [ebp - 0x70], 0x4c922d
push ebx
jmp 0x47ec89
cmp esi, 0x19
je 0x47ec7f
cmp esi, 0x1a
jne 0x47ecab
xor ecx, ecx
inc ecx
mov dword [ebp - 0x84], ecx
push ecx
mov dword [ebp - 0x80], eax
mov eax, edi
call fcn.004786bc
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00450a1d
pop ecx
pop ecx
cmp eax, 6
jne 0x47f33e
call fcn.0042957f
cmp esi, 0x22
jne 0x47ecd2
xor eax, eax
cmp edi, ebx
jbe 0x47eccc
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx + eax*4]
test byte [ecx + 0x3c], 0x20
je 0x47ed05
inc eax
cmp eax, edi
jb 0x47ecbb
push 0x23
pop esi
mov dword [ebp + 8], esi
cmp esi, 0x13
jne 0x47ecf3
cmp dword [0x4c9224], ebx
je 0x47ed05
mov ecx, str.a4d77a09_10ea_4574_8c09_9b6e1a21c95f
call fcn.00412b68
push 0xa
mov edx, eax
pop ecx
call fcn.0043a6cd
cmp esi, 0x1c
je 0x47f2da
cmp esi, 0x1b
je 0x47f2da
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x20], ebx
jbe 0x47f26c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
imul eax, eax, 0xc
add eax, ecx
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
mov eax, dword [eax]
test eax, eax
jne 0x47f213
mov ecx, esi
call fcn.00411ee2
test al, al
je 0x47f24e
cmp dword [ebp + 8], 0x6c
jg 0x47f24e
mov eax, dword [ebp + 8]
cmp eax, 0x6c
je 0x47f202
cmp eax, 0x24
jg 0x47eec6
je 0x47eeba
cmp eax, 0x1f
jg 0x47ee82
cmp eax, 0x1d
jge 0x47ee6a
cmp eax, 0x13
je 0x47ee27
cmp eax, 0x14
je 0x47ee1b
cmp eax, 0x15
je 0x47ee05
cmp eax, 0x16
je 0x47f1bc
jle 0x47f24e
cmp eax, 0x1a
jg 0x47f24e
movzx eax, byte [0x4c9363]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
add ecx, 0xffffffe9
and eax, 4
or eax, ecx
push eax
mov ecx, esi
call fcn.0040e21f
mov edi, dword [ebp - 0x38]
cmp esi, dword [edi + 0xb8]
jne 0x47eddc
push 0
mov ecx, edi
call fcn.004783a8
cmp esi, dword [edi + 0x84]
jne 0x47eeb1
mov eax, dword [edi + 0xc0]
push 0
push 0xffffffffffffffff
push 0x1076
push dword [eax + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x47eeb1
test byte [esi + 0x3c], 0x40
jne 0x47eeb1
mov ecx, esi
call fcn.0040ea48
jmp 0x47eeb1
mov ecx, esi
call fcn.0040d210
jmp 0x47eeb1
cmp dword [0x4c9224], 0
je 0x47f24e
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0xc0]
mov eax, dword [ecx + 0x2c]
mov al, byte [eax + 0xa]
shr al, 7
not al
test al, 1
jne 0x47ee55
push 0
push 0xa
call fcn.0044b033
mov ecx, dword [0x4c9224]
push 0
push 0xffffffffffffffff
push esi
call fcn.00402844
jmp 0x47f24e
add eax, 0xffffffe3
push eax
mov ecx, esi
call fcn.004074e7
push 0x1e
pop ecx
call fcn.00411a0b
jmp 0x47f24e
sub eax, 0x20
je 0x47f2aa
dec eax
je 0x47eeaa
dec eax
je 0x47eea1
dec eax
jne 0x47f24e
mov ecx, esi
call fcn.0040e967
jmp 0x47eeb1
mov ecx, esi
call fcn.0040e9d5
jmp 0x47eeb1
mov ecx, esi
call fcn.0040f85e
mov byte [ebp - 1], 1
jmp 0x47f24e
mov ecx, esi
call fcn.00407866
jmp 0x47f24e
cmp eax, 0x2b
jg 0x47f1a4
je 0x47f19d
sub eax, 0x25
je 0x47f186
dec eax
je 0x47ef15
dec eax
je 0x47ef09
dec eax
dec eax
je 0x47eefd
dec eax
jne 0x47f24e
mov dl, 1
mov ecx, esi
call fcn.0046fdce
jmp 0x47f24e
mov ecx, esi
call fcn.0040a3fb
jmp 0x47f24e
mov ecx, esi
call fcn.004074b1
jmp 0x47f24e
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
xor dl, dl
mov ecx, esi
mov byte [ebp - 9], 0
mov byte [ebp - 0x10], 1
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x80], 0x23
mov dword [ebp - 0x28], 0x4a5560
call fcn.0047263e
mov bl, al
mov eax, dword [esi]
neg bl
sbb bl, bl
inc bl
mov dword [ebp - 0x28], 0x4a5060
cmp byte [eax + 0x24], 0
mov edi, 0x4945b8
je 0x47ef99
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0x20]
test ecx, ecx
jne 0x47ef72
mov ecx, edi
mov edx, eax
call fcn.0043a9f9
test al, al
jne 0x47ef99
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
test ecx, ecx
jne 0x47ef8b
mov ecx, edi
call fcn.00444ef3
push eax
lea ecx, [ebp - 0x14]
call fcn.004019c6
test bl, bl
je 0x47f16f
mov eax, dword [esi]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp dword [eax + 8], ecx
jbe 0x47f08b
mov dword [ebp - 8], ecx
and dword [ebp - 0x34], 0
cmp byte [eax + 0x24], 0
mov byte [ebp - 0x30], 1
je 0x47efe3
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ebp - 8]
test ecx, ecx
jne 0x47efd0
mov ecx, edi
mov edx, dword [eax + 0x18]
call fcn.00444ef3
push eax
lea ecx, [ebp - 0x34]
call fcn.00439f99
jmp 0x47efee
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.004019c6
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x47eff7
mov ecx, edi
call fcn.004458a5
test al, al
jne 0x47f020
cmp byte [ebp - 0x30], al
je 0x47f00d
mov ecx, dword [ebp - 0x34]
call fcn.004444cc
inc dword [ebp - 0x1c]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x1c]
add dword [ebp - 8], 0x34
cmp ecx, dword [eax + 8]
jb 0x47efb4
jmp 0x47f08b
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x34], eax
je 0x47f033
mov edi, dword [ebp - 0x34]
push edi
push dword [0x4cf694]
lea eax, [ebp - 0x64]
push eax
call fcn.00444012
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.00443fea
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00450a1d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x64]
mov edi, eax
call fcn.004444cc
and dword [ebp - 0x5c], 0
cmp edi, 6
sete bl
cmp edi, 7
sete byte [ebp - 9]
cmp byte [ebp - 0x30], 0
je 0x47f086
mov ecx, dword [ebp - 0x34]
call fcn.004444cc
mov edi, 0x4945b8
test bl, bl
je 0x47f0b1
cmp dword [ebp - 0x14], 0
je 0x47f098
mov edi, dword [ebp - 0x14]
push 0
push 0
push edi
mov ecx, esi
call fcn.0040ec64
push 0x1e
pop ecx
call fcn.00411a0b
jmp 0x47f16f
cmp byte [ebp - 9], 0
je 0x47f16f
mov ecx, dword [esi]
cmp byte [ecx + 0x24], 0
je 0x47f0d7
cmp dword [ebp - 0x14], 0
je 0x47f0cc
mov edi, dword [ebp - 0x14]
push edi
call fcn.0041fafb
jmp 0x47f16f
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], ecx
cmp eax, ecx
jne 0x47f0eb
mov eax, edi
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x47f121
mov eax, dword [ebp - 0x14]
mov ecx, eax
test eax, eax
jne 0x47f108
mov ecx, edi
jmp 0x47f10a
mov edi, eax
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x58]
call fcn.00443ec7
inc ebx
inc ebx
mov dword [ebp - 8], ebx
jmp 0x47f13c
call fcn.004450d3
push eax
lea ecx, [ebp - 0x58]
call fcn.00443e43
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
test eax, eax
jne 0x47f13c
mov dword [ebp - 8], edi
mov ebx, dword [esi]
lea ecx, [ebp - 0x58]
call fcn.00443fea
push eax
mov ecx, ebx
call fcn.0041fafb
mov esi, dword [esi]
mov ecx, dword [ebp - 8]
mov ebx, dword [esi]
call fcn.00444cbc
push eax
push ebx
mov ecx, esi
call fcn.0041fb15
mov ecx, dword [ebp - 0x58]
call fcn.004444cc
and dword [ebp - 0x50], 0
cmp byte [ebp - 0x10], 0
je 0x47f24e
mov ecx, dword [ebp - 0x14]
call fcn.004444cc
jmp 0x47f24e
mov eax, dword [esi]
xor edx, edx
cmp byte [eax + 0x24], dl
mov ecx, esi
sete dl
dec edx
call fcn.0047ca27
jmp 0x47f24e
xor dl, dl
jmp 0x47eef1
sub eax, 0x2c
je 0x47f1f4
dec eax
je 0x47f2d3
sub eax, 0xb
je 0x47f1c8
dec eax
jne 0x47f24e
mov ecx, esi
call fcn.0040f90f
jmp 0x47eeb1
cmp dword [ebp - 0x40], 0
jbe 0x47f1db
push 0x491f70
lea ecx, [ebp - 0x48]
call fcn.00443e43
mov ecx, esi
call fcn.0040530e
mov ecx, eax
call fcn.0043ad91
push eax
lea ecx, [ebp - 0x48]
call fcn.00443e43
jmp 0x47f24e
push 0
or edx, 0xffffffff
mov ecx, esi
call fcn.0047ab25
jmp 0x47f24e
push 1
xor eax, eax
push eax
push eax
push dword [esi + 0x1c4]
jmp 0x47f2a0
cmp eax, 1
jne 0x47f24e
mov ecx, dword [edi + 0x20]
call fcn.00435cab
mov ecx, dword [ebp + 8]
sub ecx, 0x16
je 0x47f239
sub ecx, 0x19
je 0x47f297
dec ecx
je 0x47f289
dec ecx
dec ecx
je 0x47f279
sub ecx, 8
jne 0x47f24e
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x3c]
mov ecx, edi
sbb eax, eax
and eax, 4
push eax
xor edx, edx
call fcn.00437784
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jb 0x47ed1a
mov edx, dword [ebp - 0x40]
test edx, edx
jbe 0x47f26c
mov ecx, dword [ebp - 0x48]
call fcn.00469484
mov ecx, dword [ebp - 0x48]
call fcn.004444cc
jmp 0x47f30e
push dword [edi + 8]
mov edx, dword [edi + 4]
mov ecx, dword [eax + 0x10]
call fcn.00436af1
jmp 0x47f24e
mov ecx, edi
call fcn.00437a90
call fcn.00481b23
jmp 0x47f24e
push 1
xor eax, eax
push eax
push eax
push dword [edi + 8]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x47f24e
call fcn.00429590
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
test ax, ax
jge 0x47f2cc
call fcn.0047857b
jmp 0x47f33e
call fcn.0048d00f
jmp 0x47f33e
call fcn.00429590
jmp 0x47f33e
xor eax, eax
cmp esi, 0x1b
sete al
push 0x10
add eax, 4
mov esi, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x47f2f7
or esi, 2
mov ecx, dword [ebp - 0x2c]
push esi
mov edx, edi
call fcn.00413027
push 0x1e
pop ecx
call fcn.00411a0b
mov byte [ebp - 1], 1
call fcn.00429590
cmp byte [ebp - 1], 0
je 0x47f321
mov ecx, dword [ebp - 0x38]
call fcn.0047d976
mov ecx, dword [ebp - 0x38]
call fcn.0047ae36
jmp 0x47f33e
call fcn.0047b797
jmp 0x47f33e
call fcn.0047d317
jmp 0x47f33e
call fcn.004757dd
lea esp, [ebp - 0x90]
pop edi
pop esi
pop ebx
leave
ret 4