Function at 0x4c67d0
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ab06b
push eax
mov eax, 0x202c
mov dword fs:[0], esp
call fcn.00557520
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x37f68]
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x4c6847
test eax, eax
jle 0x4c683d
mov edi, dword [ebp + 8]
mov esi, 0x6503b0
sub edi, esi
mov dword [esp + 0x18], eax
mov ecx, dword [ebx + 0x37f68]
mov dx, word [edi + esi]
push edx
mov eax, dword [ecx]
call dword [eax + 8]
mov word [esi], ax
mov eax, dword [esp + 0x18]
add esi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x4c6819
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0x6503b0
jmp 0x4c684e
mov ecx, dword [ebp + 8]
mov dword [esp + 0x10], ecx
test eax, eax
jle 0x4c6e81
mov edi, dword [esp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edx
jmp 0x4c686b
mov edi, dword [esp + 0x18]
mov eax, dword [ebx + 0x37f64]
test eax, eax
je 0x4c6ad1
mov eax, dword [ebx + 0x70]
inc eax
cdq
idiv dword [ebx + 0x74]
mov eax, dword [ebx + 0x20]
shr eax, 0x10
cmp ax, 0x8000
mov dword [ebx + 0x70], edx
ja 0x4c68bd
cmp ax, 0x4000
ja 0x4c68a7
mov ecx, eax
and ecx, 0xffff
mov edx, dword [ecx*4 + 0x6a5480]
jmp 0x4c68ea
mov edx, eax
mov ecx, 0x6c5480
and edx, 0xffff
shl edx, 2
sub ecx, edx
mov edx, dword [ecx]
jmp 0x4c68ea
cmp ax, 0xc000
ja 0x4c68d4
mov edx, eax
and edx, 0xffff
mov edx, dword [edx*4 + 0x685480]
jmp 0x4c68e8
mov ecx, eax
mov edx, str.t8Y__h_a
and ecx, 0xffff
shl ecx, 2
sub edx, ecx
mov edx, dword [edx]
neg edx
movsx esi, word [edi]
mov ecx, esi
imul ecx, edx
cmp ax, 0x8000
ja 0x4c6921
cmp ax, 0x4000
ja 0x4c6911
and eax, 0xffff
mov edx, 0x6b5480
shl eax, 2
sub edx, eax
mov eax, dword [edx]
jmp 0x4c6948
and eax, 0xffff
mov eax, dword [eax*4 + 0x695480]
neg eax
jmp 0x4c6948
cmp ax, 0xc000
ja 0x4c693c
and eax, 0xffff
mov edx, 0x6d5480
shl eax, 2
sub edx, eax
mov eax, dword [edx]
neg eax
jmp 0x4c6948
and eax, 0xffff
mov eax, dword [eax*4 + 0x675480]
imul eax, esi
mov edx, eax
mov eax, dword [0x681100]
mov esi, eax
sar esi, 8
sar ecx, 9
sub ecx, esi
add eax, ecx
mov ecx, dword [0x681104]
mov esi, ecx
mov dword [0x681100], eax
sar esi, 8
sar edx, 9
sub edx, esi
add ecx, edx
mov edx, dword [0x681108]
mov esi, edx
mov dword [0x681104], ecx
sar esi, 8
sar eax, 8
sub eax, esi
add edx, eax
mov eax, dword [0x68110c]
mov dword [0x681108], edx
mov edx, eax
sar edx, 8
sar ecx, 8
sub ecx, edx
add eax, ecx
mov dword [0x68110c], eax
mov eax, dword [ebx + 0x70]
test eax, eax
jne 0x4c6ac6
fild dword [0x68110c]
fild dword [0x681108]
fpatan
fmul qword [0x5c70b0]
call fcn.00556a00
mov ecx, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
mov esi, eax
sub eax, ecx
inc edx
mov dword [esp + 0xc], eax
mov eax, edx
mov dword [ebx + 0x34], edx
cmp eax, 0x118
jle 0x4c6a84
cdq
fild dword [esp + 0xc]
mov ecx, 0x12c
idiv ecx
fmul qword [0x5bafe8]
fld qword [ebx + 0x28]
fmul qword [0x5c0d20]
faddp st(1)
fst qword [ebx + 0x28]
fimul dword [ebx + 0xa0]
fmul qword [0x5c70a8]
test edx, edx
jne 0x4c6ac1
mov edx, dword [0x614cb0]
mov dword [esp + 0xc], edx
fld st(0)
fmul qword [0x5c0f28]
fild dword [ebx + 0x18]
sub esp, 8
lea eax, [esp + 0x14]
mov dword [esp + 0x2048], 0
fsub st(2)
fdivp st(1)
fstp qword [esp]
push str.TX_RX_rate__ppm_:__6f
push eax
fstp st(0)
call fcn.0056d732
mov ecx, dword [esp + 0x1c]
add esp, 0x10
push ecx
mov ecx, dword [ebx + 0x37f64]
call fcn.005750ac
lea ecx, [esp + 0xc]
mov dword [esp + 0x2040], 0xffffffff
call fcn.00575ae8
jmp 0x4c6ac3
cmp eax, 0x32
jle 0x4c6aa3
fild dword [esp + 0xc]
fmul qword [0x5bafa0]
fld qword [ebx + 0x28]
fmul qword [0x5bbad8]
faddp st(1)
fstp qword [ebx + 0x28]
jmp 0x4c6ac3
test eax, eax
jle 0x4c6ac3
fild dword [esp + 0xc]
fmul qword [0x5bb1f8]
fld qword [ebx + 0x28]
fmul qword [0x5c70a0]
faddp st(1)
fstp qword [ebx + 0x28]
jmp 0x4c6ac3
fstp st(0)
mov dword [ebx + 0x30], esi
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x20]
add eax, edx
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 0x32e28]
test eax, eax
jl 0x4c6afc
movsx ecx, word [edi]
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
fstp dword [ebx + eax*4 + 0x30e28]
mov eax, dword [ebx + 0x32e28]
inc eax
mov dword [ebx + 0x32e28], eax
jmp 0x4c6b03
inc eax
mov dword [ebx + 0x32e28], eax
cmp eax, 0x800
jl 0x4c6e67
mov eax, dword [ebx + 0x37f4c]
sub eax, 0
je 0x4c6c25
dec eax
je 0x4c6be2
dec eax
je 0x4c6b5b
xor eax, eax
lea edx, [esp + 0x38]
lea ecx, [ebx + 0x30e28]
mov esi, eax
add ecx, 4
and esi, 0xffff
inc eax
add edx, 4
cmp eax, 0x800
fld qword [esi*8 + 0x681470]
fmul dword [ecx - 4]
fstp dword [edx - 4]
jl 0x4c6b33
jmp 0x4c6c48
lea eax, [ebx + 0x30e28]
xor ecx, ecx
lea esi, [esp + 0x38]
mov edx, eax
mov eax, ecx
shl eax, 5
cmp ax, 0x4000
ja 0x4c6b82
and eax, 0xffff
fld qword [eax*8 + 0x685478]
jmp 0x4c6bcc
cmp ax, 0x8000
ja 0x4c6ba1
fld qword [0x5bab28]
and eax, 0xffff
mov edi, 0x6c5478
shl eax, 3
sub edi, eax
fsub qword [edi]
jmp 0x4c6bcc
cmp ax, 0xc000
ja 0x4c6bbb
fld qword [0x5bab28]
and eax, 0xffff
fsub qword [eax*8 + 0x645478]
jmp 0x4c6bcc
and eax, 0xffff
mov edi, 0x705478
shl eax, 3
sub edi, eax
fld qword [edi]
fmul dword [edx]
inc ecx
add edx, 4
add esi, 4
cmp ecx, 0x800
fstp dword [esi - 4]
jl 0x4c6b69
jmp 0x4c6c48
xor ecx, ecx
lea edi, [esp + 0x38]
lea esi, [ebx + 0x30e28]
lea eax, [ecx - 0x400]
add esi, 4
cdq
xor eax, edx
add edi, 4
sub eax, edx
mov edx, 0x400
sub edx, eax
inc ecx
mov dword [esp + 0xc], edx
cmp ecx, 0x800
fild dword [esp + 0xc]
fmul dword [esi - 4]
fmul qword [0x5bf7d0]
fstp dword [edi - 4]
jl 0x4c6bee
jmp 0x4c6c48
lea ecx, [esp + 0x38]
lea eax, [ebx + 0x30e28]
mov edx, 0x800
fld dword [eax]
fmul qword [0x5c7098]
add eax, 4
add ecx, 4
dec edx
fstp dword [ecx - 4]
jne 0x4c6c34
lea esi, [ebx + 0x32e30]
lea eax, [esp + 0x38]
push esi
push 1
push 0x3f000000
push 0x3ff
push 0
push eax
lea ecx, [ebx + 0x30e0c]
call fcn.004e28d0
mov eax, dword [ebx + 0x37e30]
lea ecx, [ebx + eax*4 + 0x33e30]
add eax, 0x400
and eax, 0x80000fff
jns 0x4c6c8d
dec eax
or eax, 0xfffff000
inc eax
mov dword [ebx + 0x37e30], eax
mov eax, esi
mov edx, 0x400
mov edi, dword [eax]
add eax, 4
mov dword [ecx], edi
add ecx, 4
dec edx
jne 0x4c6c9a
lea edi, [ebx + 0x37e90]
mov dword [esp + 0xc], 0x28
mov ecx, dword [edi]
test ecx, ecx
je 0x4c6ccc
mov eax, dword [ebx + 0x32e2c]
mov edx, dword [ecx]
push 0
push eax
push esi
push 0x55
call dword [edx + 4]
mov eax, dword [esp + 0xc]
add edi, 4
dec eax
mov dword [esp + 0xc], eax
jne 0x4c6cb5
mov eax, dword [0x6810fc]
inc eax
cmp eax, 0xc8
mov dword [0x6810fc], eax
jle 0x4c6d07
mov eax, dword [ebx + 0x32e2c]
xor esi, esi
cmp eax, esi
jle 0x4c6cff
dec eax
mov dword [ebx + 0x32e2c], eax
mov dword [0x6810fc], esi
jmp 0x4c6d09
xor esi, esi
mov ecx, dword [ebx + 0x32e2c]
cmp ecx, 0xa
ja case.default.0x4c6d18
jmp dword [ecx*4 + 0x4c73a4]
mov dword [ebx + 0x32e28], 0xfffff800
mov dword [ebx + 0x30e08], 0x400
jmp 0x4c6e1f
mov dword [ebx + 0x32e28], esi
mov dword [ebx + 0x30e08], 0x400
jmp 0x4c6e1f
mov dword [ebx + 0x32e28], 0x2ab
mov dword [ebx + 0x30e08], 0x400
jmp 0x4c6e1f
mov eax, 0x400
mov dword [ebx + 0x32e28], eax
mov dword [ebx + 0x30e08], eax
jmp 0x4c6e1f
mov dword [ebx + 0x32e28], 0x555
mov dword [ebx + 0x30e08], 0x2ab
jmp 0x4c6e1f
mov dword [ebx + 0x32e28], 0x600
mov dword [ebx + 0x30e08], 0x200
jmp 0x4c6e1f
mov dword [ebx + 0x32e28], 0x680
mov dword [ebx + 0x30e08], 0x180
jmp 0x4c6e1f
mov dword [ebx + 0x32e28], 0x700
mov dword [ebx + 0x30e08], 0x100
jmp 0x4c6e1f
mov dword [ebx + 0x32e28], 0x756
mov dword [ebx + 0x30e08], 0xaa
jmp 0x4c6e1f
mov dword [ebx + 0x32e28], 0x780
mov dword [ebx + 0x30e08], 0x80
jmp 0x4c6e1f
mov dword [ebx + 0x32e28], 0x7ab
mov dword [ebx + 0x30e08], 0x55
jmp 0x4c6e1f
mov dword [ebx + 0x32e28], esi
xor edx, edx
cmp ecx, 7
setg dl
mov dword [0x64fea0], edx
mov eax, dword [ebx + 0x32e28]
cmp eax, esi
jle 0x4c6e67
mov ecx, 0x800
sub ecx, eax
cmp ecx, 0x800
jge 0x4c6e67
mov eax, 0x800
lea edx, [ebx + 0x30e28]
lea esi, [ebx + ecx*4 + 0x30e28]
sub eax, ecx
mov ecx, dword [esi]
add esi, 4
mov dword [edx], ecx
add edx, 4
dec eax
jne 0x4c6e5a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add ecx, 2
dec eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
jne 0x4c6867
mov eax, dword [ebx + 0x37f38]
test eax, eax
je 0x4c7118
mov ecx, dword [0x68111c]
test ecx, ecx
je 0x4c6eba
mov dword [ebx + 0x37f38], 0
mov ecx, dword [esp + 0x2038]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x4c7118
mov ecx, dword [ebx + 0x94]
test ecx, ecx
je 0x4c7118
mov edx, dword [ebx + 0x37e8c]
mov ecx, dword [ebx + 0xb0]
shl edx, 5
cmp eax, 2
mov edi, dword [edx + ecx]
jne 0x4c6f35
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4c70d4
mov eax, dword [esp + 0x10]
mov esi, edi
sub eax, edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 0x37e38]
push 0
movsx eax, word [edx + esi]
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.004cd720
fmul qword [0x5c0df0]
call fcn.00556a00
mov word [esi], ax
add esi, 2
dec edi
jne 0x4c6f01
jmp 0x4c70d4
cmp eax, 3
jne 0x4c6f83
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4c70d4
mov eax, dword [esp + 0x10]
mov esi, edi
sub eax, edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
push 1
mov cx, word [esi + eax]
push ecx
mov ecx, dword [ebx + 0x37e38]
call fcn.004cd720
fmul qword [0x5bdd00]
call fcn.00556a00
mov word [esi], ax
add esi, 2
dec edi
jne 0x4c6f54
jmp 0x4c70d4
cmp eax, 4
jne 0x4c70a4
fld qword [0x60f518]
call fcn.00556a00
mov edx, dword [ebx + 0x37e78]
mov ecx, eax
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
jle 0x4c6fb9
mov dword [ebx + 0x37e78], ecx
push ecx
mov ecx, ebx
call fcn.004c7cc0
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4c70d4
mov esi, dword [esp + 0x10]
mov dword [esp + 0x14], eax
sub esi, edi
mov dword [esp + 0xc], esi
movsx eax, word [edi + esi]
mov edx, dword [ebx + 0x37e3c]
lea ecx, [ebx + 0x37e3c]
push eax
call dword [edx + 0xc]
mov ecx, dword [ebx + 0x37e80]
test ecx, ecx
je 0x4c7077
mov dx, word [ebx + 0x37e74]
cmp dx, 0x8000
ja 0x4c702e
cmp dx, 0x4000
mov ecx, edx
ja 0x4c701a
and ecx, 0xffff
mov ecx, dword [ecx*4 + 0x6a5480]
jmp 0x4c705a
and ecx, 0xffff
mov esi, 0x6c5480
shl ecx, 2
sub esi, ecx
mov ecx, dword [esi]
jmp 0x4c705a
cmp dx, 0xc000
mov ecx, edx
ja 0x4c7046
and ecx, 0xffff
mov ecx, dword [ecx*4 + 0x685480]
jmp 0x4c7058
and ecx, 0xffff
mov esi, str.t8Y__h_a
shl ecx, 2
sub esi, ecx
mov ecx, dword [esi]
neg ecx
imul ecx, eax
mov esi, dword [esp + 0xc]
sar ecx, 0xe
mov eax, ecx
mov cx, word [ebx + 0x37e76]
add cx, dx
mov word [ebx + 0x37e74], cx
mov edx, dword [ebx + 0x37e58]
lea ecx, [ebx + 0x37e58]
shl eax, 2
push eax
call dword [edx + 0xc]
shl eax, 2
mov word [edi], ax
mov eax, dword [esp + 0x14]
add edi, 2
dec eax
mov dword [esp + 0x14], eax
jne 0x4c6fd2
jmp 0x4c70d4
cmp eax, 5
je 0x4c70d4
cmp eax, 6
je 0x4c70d4
cmp eax, 7
je 0x4c70d4
cmp eax, 8
je 0x4c70d4
cmp eax, 9
je 0x4c70d4
mov ecx, dword [ebp + 0xc]
mov esi, dword [esp + 0x10]
add ecx, ecx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x37e8c]
mov ecx, dword [ebx + 0xb0]
shl eax, 5
add eax, ecx
mov ecx, dword [ebx + 0xa8]
push 0x20
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveOutWrite]
mov edx, dword [ebx + 0x37e8c]
mov ecx, dword [ebx + 0x80]
inc edx
mov eax, edx
mov dword [ebx + 0x37e8c], edx
cmp eax, ecx
jl 0x4c7118
mov dword [ebx + 0x37e8c], 0
lea esi, [ebx + 0x37e90]
mov dword [esp + 0x14], 0x28
mov dword [esp + 0xc], esi
mov ecx, dword [esi]
mov edi, dword [esp + 0x10]
test ecx, ecx
je 0x4c733c
mov edx, dword [ecx]
push 0
push 0
push 0
push 0x52
call dword [edx + 4]
test eax, eax
je 0x4c731a
mov esi, dword [esi]
mov eax, dword [ebx + 0x37f40]
add esi, 0x44
test eax, eax
je 0x4c72ee
cmp dword [esi], 0
jl 0x4c72ee
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0x201
push 0x201
lea eax, [esp + 0x28]
push 0
push eax
call edi
test eax, eax
jne 0x4c71ac
push eax
push 0x202
push 0x202
lea ecx, [esp + 0x28]
push eax
push ecx
call edi
test eax, eax
jne 0x4c71ac
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x4c71b2
mov dword [esi], 0xffffffff
cmp dword [esi], 0xffffffff
je 0x4c72ee
mov ecx, dword [ebx + 0x37f40]
mov edi, 0x2000
mov edx, dword [ecx]
mov eax, edx
sub eax, dword [esi]
test eax, eax
jg 0x4c71d3
add eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
cmp eax, ecx
jle 0x4c71ef
mov eax, ecx
sub edx, eax
mov dword [esi], edx
jns 0x4c71ef
mov ecx, dword [ebx + 0x37f40]
mov ecx, dword [ecx + 8]
add ecx, edx
mov dword [esi], ecx
mov edx, dword [ebx + 0x37f40]
mov ecx, dword [edx + 8]
sub ecx, dword [esi]
cmp eax, 0x2000
jge 0x4c7203
mov edi, eax
cmp ecx, edi
jge 0x4c7209
mov edi, ecx
mov eax, dword [ebx + 0x94]
mov ecx, dword [esi]
mov edx, dword [edx + 4]
push edi
test eax, eax
mov eax, dword [esp + 0x10]
lea ecx, [edx + ecx*2]
mov edx, dword [esp + 0x10]
push ecx
mov eax, dword [eax]
mov ecx, dword [edx]
mov eax, dword [eax]
jne 0x4c7230
call dword [eax + 0x24]
jmp 0x4c7233
call dword [eax + 0x28]
mov edx, dword [esi]
add edx, edi
mov eax, edx
mov dword [esi], edx
mov ecx, dword [ebx + 0x37f40]
cdq
idiv dword [ecx + 8]
mov dword [esi], edx
mov eax, dword [ebx + 0x37f40]
cmp edx, dword [eax]
je 0x4c72e8
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0xf
push 0xf
lea ecx, [esp + 0x28]
push 0
push ecx
call edi
test eax, eax
je 0x4c7298
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push edx
push eax
push 0xf
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xf
push 0xf
lea edx, [esp + 0x28]
push 0
push edx
call edi
test eax, eax
jne 0x4c726e
push 0
push 0x3c0
push 0x3c0
lea eax, [esp + 0x28]
push 0
push eax
call edi
test eax, eax
jne 0x4c72ee
mov eax, dword [0x68111c]
test eax, eax
je 0x4c7169
mov ecx, dword [ebx + 0x30e00]
mov eax, 0x186a0
sub eax, ecx
mov edx, dword [ebx + 0x30dfc]
add eax, edx
mov ecx, 0x186a0
cdq
idiv ecx
cmp edx, 0x1f4
jg 0x4c72ee
jmp 0x4c7169
mov dword [esi], 0xffffffff
mov edx, dword [esp + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx + 0x44]
test eax, eax
jge 0x4c733c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0x94]
push edx
mov edx, dword [esp + 0x14]
test eax, eax
mov eax, dword [ecx]
push edx
jne 0x4c7315
call dword [eax + 0x24]
jmp 0x4c733c
call dword [eax + 0x28]
jmp 0x4c733c
mov eax, dword [ebx + 0x94]
mov ecx, dword [esi]
mov edx, dword [ebp + 0xc]
test eax, eax
mov eax, dword [ecx]
push edx
push edi
jne 0x4c7332
call dword [eax + 0x24]
jmp 0x4c7335
call dword [eax + 0x28]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
add esi, 4
dec eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], eax
jne 0x4c712a
mov ecx, dword [ebx + 0x37f40]
test ecx, ecx
je 0x4c736e
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
push edx
push eax
call fcn.0051ee00
mov ebx, dword [ebx + 0x37f44]
test ebx, ebx
je 0x4c738a
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x10]
push 0
push ecx
push edx
mov ecx, ebx
call fcn.004c9370
mov ecx, dword [esp + 0x2038]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8