Function at 0x4f1250
Capabilities:
Log keystrokes via polling
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [0xa4efd8]
sub esp, 0x3c
push ebx
xor ebx, ebx
push ebp
push esi
sub eax, ebx
push edi
je 0x4f1868
dec eax
je 0x4f1354
dec eax
jne 0x4f1a4a
mov ecx, 0xcd5938
mov dword [0xa4efd0], ebx
call fcn.00428100
mov ecx, 0xcd5808
call fcn.00428100
mov edi, dword [0xcd5af8]
cmp edi, ebx
je 0x4f12ae
mov ecx, dword [0xcd5afc]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [0xce7fb8]
mov dword [0xcd5afc], ebx
cmp edi, ebx
mov dword [0xcd5b08], ebx
je 0x4f12da
mov ecx, dword [0xce7fbc]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [0xce7ff8]
mov dword [0xce7fbc], ebx
cmp edi, ebx
mov dword [0xce7fc8], ebx
je 0x4f1306
mov ecx, dword [0xce7ffc]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x62d4c4]
mov dword [0xce7ffc], ebx
add eax, 0x15
mov dword [0xce8008], ebx
push eax
call fcn.00575a50
mov eax, dword [0xcd5a24]
add esp, 4
cmp eax, 2
mov dword [0xa4efd8], ebx
jne 0x4f1347
pop edi
pop esi
pop ebp
mov dword [0xa4efd4], 0x65
xor eax, eax
pop ebx
add esp, 0x3c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret
mov eax, dword [0xcd5a24]
mov edi, 2
cmp eax, 3
jne 0x4f1369
mov dword [0xa4efd8], edi
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x4f145c
mov eax, dword [0xcd5d28]
cmp eax, 0x56
jne 0x4f1461
mov ecx, dword [0xa2af98]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4f145c
mov esi, 1
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
mov eax, dword [0xce8024]
cmp eax, esi
jne 0x4f13fb
test ebx, ebx
je 0x4f144d
push ebp
mov ecx, 0xcd5938
call fcn.004282b0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov esi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0xce7fa0
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 2
mov esi, 1
cmp dword [0xce8024], edi
jne 0x4f144d
test ebx, ebx
mov dword [0xce8088], esi
je 0x4f144d
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov esi, ebp
repne scasb al, byte es:[edi]
not ecx
mov eax, ecx
mov edi, 0xcd5c38
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x66756c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xcd5808
call fcn.004282b0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, 2
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [0xcd5d28]
xor ebx, ebx
jmp 0x4f1466
mov eax, dword [0xcd5d28]
mov esi, 1
cmp eax, 9
jne 0x4f14c3
cmp dword [0xa4f278], ebx
jne 0x4f14e1
cmp dword [0xce8024], esi
jne 0x4f149f
push ebx
mov ecx, 0xcd5938
mov dword [0xce8024], edi
call fcn.00429160
push esi
mov ecx, 0xcd5808
call fcn.00429160
mov dword [0xa4efd0], esi
jmp 0x4f1500
push esi
mov ecx, 0xcd5938
mov dword [0xce8024], esi
call fcn.00429160
push ebx
mov ecx, 0xcd5808
call fcn.00429160
mov dword [0xa4efd0], ebx
jmp 0x4f1500
cmp eax, 0xd
jne 0x4f14dd
mov eax, esi
mov dword [0xa262f4], ebx
mov dword [0xcd5a24], eax
mov dword [0xcd5d28], ebx
jmp 0x4f1517
cmp eax, ebx
je 0x4f1506
mov ecx, dword [0xce8024]
dec ecx
je 0x4f14f5
dec ecx
jne 0x4f1500
push eax
mov ecx, 0xcd5808
jmp 0x4f14fb
push eax
mov ecx, 0xcd5938
call fcn.00428b30
mov dword [0xcd5d28], ebx
cmp dword [0xa262f8], ebx
je 0x4f16d9
mov eax, dword [0xcd5a24]
cmp eax, esi
mov dword [0xa262f8], ebx
jne 0x4f1673
mov ecx, dword [0x62d4c4]
add ecx, 2
push ecx
call fcn.00575a50
add esp, 4
mov ecx, 0xcd5938
mov dword [0xcd5a24], ebx
call fcn.004283e0
test eax, eax
je 0x4f1559
mov ecx, 0xcd5808
call fcn.004283e0
test eax, eax
jne 0x4f1565
cmp dword [0xa4f278], ebx
je 0x4f161a
mov eax, dword [0xce821c]
inc eax
cmp eax, edi
mov dword [0xce821c], eax
jl 0x4f1a4a
mov eax, dword [0xce8088]
mov dword [0xce821c], ebx
cmp eax, esi
je 0x4f15df
mov ecx, 0xcd5808
call fcn.004283c0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0xcd5c38
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xcd5938
call fcn.004283c0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0xce7fa0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.___________Connecting_...
mov ecx, 0xcd5af8
mov dword [0xce8088], ebx
mov dword [0xcd5a24], 3
mov dword [0xcd4e1c], ebx
call fcn.00427de0
call fcn.005755e0
pop edi
pop esi
pop ebp
mov byte [0xce8059], 1
xor eax, eax
pop ebx
add esp, 0x3c
ret
push esi
mov ecx, 0xcd5938
call fcn.00429160
push ebx
mov ecx, 0xcd5808
call fcn.00429160
mov eax, dword [0xa4f274]
mov dword [0xce8024], esi
cmp eax, ebx
mov dword [0xa4efd0], ebx
je 0x4f165c
push 0x66753c
call fcn.004f0740
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push 0x667528
call fcn.004f0740
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
cmp eax, edi
jne 0x4f16a4
mov ecx, dword [0x62d4c4]
add ecx, 2
push ecx
call fcn.00575a50
add esp, 4
mov ecx, 0xa4bb08
push ebx
call fcn.004ed830
mov dword [0xa4efd8], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
cmp eax, 0x24
jne 0x4f1a4a
cmp dword [0xa4f278], ebx
jne 0x4f1a4a
mov al, byte [0xce8218]
pop edi
test al, al
sete dl
pop esi
mov dword [0xcd5a24], ebx
pop ebp
mov byte [0xce8218], dl
xor eax, eax
pop ebx
add esp, 0x3c
ret
cmp dword [0xa262f4], ebx
je 0x4f1a4a
mov eax, dword [0x647e90]
mov ecx, dword [0x647e94]
cmp eax, 0x1f1
mov dword [0xa262f4], ebx
mov byte [0xce808c], 0
jl 0x4f179e
cmp eax, 0x279
jg 0x4f1753
cmp ecx, 0x1b5
jl 0x4f1753
cmp ecx, 0x1ca
jg 0x4f1753
cmp dword [0xa4f278], ebx
jne 0x4f1753
push esi
mov ecx, 0xcd5938
call fcn.00429160
push ebx
mov ecx, 0xcd5808
call fcn.00429160
mov dword [0xce8024], esi
pop edi
pop esi
mov dword [0xa4efd0], ebx
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
cmp eax, 0x277
jg 0x4f179e
cmp ecx, 0x1d4
jl 0x4f179e
cmp ecx, 0x1e9
jg 0x4f179e
cmp dword [0xa4f278], ebx
jne 0x4f179e
push ebx
mov ecx, 0xcd5938
call fcn.00429160
push esi
mov ecx, 0xcd5808
call fcn.00429160
mov dword [0xce8024], edi
mov dword [0xa4efd0], esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
cmp eax, 0x35c
jl 0x4f17cc
cmp eax, 0x386
jg 0x4f17cc
cmp ecx, 0x28c
jl 0x4f17cc
cmp ecx, 0x2ae
jg 0x4f17cc
mov dword [0xcd5a24], esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
cmp eax, 0x3a6
jl 0x4f1826
cmp eax, 0x3d2
jg 0x4f1826
cmp ecx, 0x28c
jl 0x4f1826
cmp ecx, 0x2b0
jg 0x4f1826
cmp dword [0xcd5a24], 3
jne 0x4f17fe
push ebx
mov ecx, 0xa4bb08
call fcn.004ed830
cmp dword [0xce821c], ebx
jne 0x4f1816
mov dword [0xcd5a24], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
pop edi
pop esi
mov dword [0xce821c], ebx
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
cmp eax, 0x1c0
jl 0x4f1a4a
cmp eax, 0x1e9
jg 0x4f1a4a
cmp ecx, 0x20f
jl 0x4f1a4a
cmp ecx, 0x226
jg 0x4f1a4a
pop edi
pop esi
pop ebp
mov dword [0xcd5a24], 0x24
xor eax, eax
pop ebx
add esp, 0x3c
ret
mov ecx, 0xa26508
call fcn.00498e40
call fcn.004f06b0
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov edi, str.Arial
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, 0xfffffff5
mov eax, ecx
mov ebx, 5
mov esi, edi
mov edi, edx
shr ecx, 2
mov byte [esp + 0x27], 1
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
push 0
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x31
and ecx, 3
push 0x58
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0xa4f000]
push ecx
mov ecx, 0xcd5938
call fcn.00428160
mov esi, 0xd1eef9
mov ecx, 0xcd5938
push esi
call fcn.00429180
lea edx, [esp + 0x10]
mov ecx, 0xcd5938
push edx
call fcn.00428270
push 0
mov ecx, 0xcd5938
call fcn.00429160
mov eax, dword [0xa4f000]
mov edi, 1
push edi
push 0x14
push 0x58
push eax
mov ecx, 0xcd5808
mov dword [esp + 0x20], 0xe
mov dword [esp + 0x24], 9
call fcn.00428160
push esi
mov ecx, 0xcd5808
call fcn.00429180
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0xcd5808
call fcn.00428270
push 0
mov ecx, 0xcd5808
call fcn.00429160
lea edx, [esp + 0x10]
mov ecx, 0xcd5af8
push edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebx
call fcn.00427db0
mov eax, dword [0xa4f000]
mov ecx, 0xcd5af8
push eax
mov dword [0xcd5b00], esi
call fcn.00427d70
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0xfffffff2
push ecx
mov ecx, 0xce7ff8
mov dword [esp + 0x18], 7
call fcn.00427db0
mov edx, dword [0xa4f000]
mov ecx, 0xce7ff8
push edx
mov dword [0xce8000], esi
call fcn.00427d70
lea eax, [esp + 0x10]
mov ecx, 0xce7fb8
push eax
call fcn.00427db0
mov ecx, dword [0xa4f000]
mov dword [0xce7fc0], esi
push ecx
mov ecx, 0xce7fb8
call fcn.00427d70
mov al, byte [0xce8218]
test al, al
je 0x4f1a15
push 0xce7fa0
mov ecx, 0xcd5938
call fcn.004282b0
push 0
mov ecx, 0xcd5938
call fcn.00429160
push edi
mov ecx, 0xcd5808
call fcn.00429160
mov dword [0xce8024], 2
jmp 0x4f1a32
push edi
mov ecx, 0xcd5938
call fcn.00429160
push 0
mov ecx, 0xcd5808
call fcn.00429160
mov dword [0xce8024], edi
xor eax, eax
mov dword [0xa4efd8], edi
mov dword [0xcd5a24], eax
mov dword [0xcd5a20], eax
mov dword [0xa4efd0], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret