Function at 0x46ef95
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
sub esp, 0x334
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x334], eax
push 0x158
mov eax, 0x5e0902
call fcn.0059ca24
mov eax, dword [ebp + 0x340]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x344]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x34c]
mov edi, ecx
xor ebx, ebx
push str.WAND_manual_fill_mode_started
mov ecx, 0x66eab8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], ebx
call fcn.0047efc3
lea ecx, [ebp - 0x6c]
call fcn.004c07ca
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.005756ee
mov byte [ebp - 4], 1
call fcn.00567d0d
push eax
lea ecx, [ebp - 0x14]
call fcn.00402440
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov byte [ebp - 4], 2
call esi
test ax, ax
jge 0x46f035
push 0x10
call esi
mov dword [ebp - 0x1c], 1
test ax, ax
jl 0x46f038
mov dword [ebp - 0x1c], ebx
push 2
lea ecx, [edi + 0x174]
push ebx
mov dword [ebp - 0x40], ecx
call fcn.0043626f
push ebx
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0x402
lea esi, [edi + 0x194]
push dword [esi]
call ebx
push 0
push 1
push 0x404
push dword [esi]
call ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6c]
push dword [ebp - 0x24]
call fcn.004c082c
test eax, eax
jne 0x46f0f0
mov edi, dword [edi + 0x20]
lea ecx, [ebp - 0x6c]
call fcn.004c09e8
push eax
push 0x25e
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
push 0x16
push edi
call fcn.00428d53
add esp, 0x10
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402490
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.00575a31
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004c1222
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x334]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x338
leave
ret 0x10
mov ecx, dword [ebp - 0x40]
call fcn.0046e2fb
call fcn.00567d0d
push eax
lea ecx, [ebp - 0x24]
call fcn.00402440
xor ebx, ebx
mov byte [ebp - 4], 3
mov esi, 0x66ea90
cmp dword [ebp - 0x20], ebx
je 0x46f24f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6c]
call fcn.004c3395
cmp eax, ebx
je 0x46f24f
push ebx
lea ecx, [ebp - 0x164]
call fcn.0048b2d8
push str.MK_is_enabled
push 0x66eab8
mov byte [ebp - 4], 4
call fcn.0047f157
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
cmp eax, ebx
jne 0x46f15a
mov eax, 0x631718
push eax
lea ecx, [ebp - 0x98]
call fcn.00401ec0
lea ecx, [ebp - 0x164]
call fcn.0056d3e5
test eax, eax
je 0x46f18c
cmp dword [ebp - 0xf0], ebx
je 0x46f18c
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x24]
call fcn.00402340
mov ebx, dword [ebp - 0x24]
push ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6c]
call fcn.004c1e05
lea ecx, [ebp - 0x6c]
cmp eax, 0xffffffff
jne 0x46f1ea
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x10], eax
call fcn.004c09e8
push eax
push 0x279
mov ecx, esi
call fcn.0047ddbd
push eax
push 0x14
push dword [ebp - 0x10]
call fcn.00428d53
add esp, 0x10
cmp eax, 6
je 0x46f23e
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 3
call fcn.0046e909
lea ecx, [ebx - 0x10]
call fcn.00402490
jmp 0x46f0a6
test eax, eax
jne 0x46f20e
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x10], eax
call fcn.004c09e8
push eax
push 0x278
mov ecx, esi
call fcn.0047ddbd
push eax
push 0x14
push dword [ebp - 0x10]
jmp 0x46f1c1
push ebx
push dword [ebp - 0x20]
call fcn.004c2314
test eax, eax
jne 0x46f23e
mov eax, dword [edi + 0x20]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x10], eax
call fcn.004c09e8
push eax
push 0x27c
mov ecx, esi
call fcn.0047ddbd
push eax
push 0x14
push dword [ebp - 0x10]
jmp 0x46f1c1
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 3
call fcn.0046e909
jmp 0x46f252
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x40]
call fcn.0046e2fb
cmp dword [ebp - 0x1c], 0
jne 0x46f326
push 0x66e928
push 0x66e914
push 0
lea ecx, [ebp - 0x6c]
call fcn.004c4a9d
test eax, eax
jne 0x46f69a
mov eax, dword [ebp - 0x58]
cmp eax, 6
je 0x46f2f4
cmp eax, 8
je 0x46f2f4
cmp eax, 0xa
je 0x46f2f4
cmp eax, 0xc
je 0x46f2f4
cmp eax, 0xd
je 0x46f2f4
mov edi, dword [edi + 0x20]
lea ecx, [ebp - 0x6c]
call fcn.004c09e8
push eax
push 0x25f
mov ecx, esi
call fcn.0047ddbd
push eax
push 0x16
push edi
call fcn.00428d53
add esp, 0x10
lea ecx, [ebx - 0x10]
call fcn.00402490
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402490
xor esi, esi
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.00575a31
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004c1222
mov eax, esi
jmp 0x46f0cb
mov eax, dword [edi + 0x20]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x10], eax
call fcn.004c09e8
push eax
push 0x280
mov ecx, esi
call fcn.0047ddbd
push eax
push 0x14
push dword [ebp - 0x10]
call fcn.00428d53
add esp, 0x10
cmp eax, 6
jne 0x46f6bb
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x3c]
call fcn.005757d6
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x6c]
call fcn.004c1c1f
mov ecx, esi
test eax, eax
je 0x46f674
push 0x6037c8
push 0x4f
call fcn.0047ddbd
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00401b30
add esp, 0xc
push 1
mov ebx, 0x631718
push ebx
push 0
lea ecx, [ebp - 0x3c]
call fcn.00575d7e
push 1
push ebx
push 0
lea ecx, [ebp - 0x3c]
call fcn.00575d7e
push 1
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x3c]
call fcn.00575c16
push 1
push 0x3c
mov ecx, esi
call fcn.0047ddbd
push eax
push 0
lea ecx, [ebp - 0x3c]
call fcn.00575d7e
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ebx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3c]
call fcn.00575c79
push ebx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3c]
call fcn.00575c79
movzx eax, word [ebp - 0x74]
push eax
movzx eax, word [ebp - 0x76]
push eax
movzx eax, word [ebp - 0x78]
push eax
movzx eax, word [ebp - 0x80]
push eax
movzx eax, word [ebp - 0x7a]
push eax
movzx eax, word [ebp - 0x7e]
push eax
lea eax, [ebp - 0x14]
push str._02u__02u__04u___02u:_02u:_02u
push eax
call fcn.00401b30
add esp, 0x20
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3c]
call fcn.00575bc4
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x94]
call fcn.004bfd48
push ebx
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], ebx
call fcn.004bfff5
test eax, eax
je 0x46f441
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x94]
call fcn.004bfe6d
mov eax, dword [ebp - 0x1c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x44]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push 0x6037e0
lea eax, [ebp - 0x14]
push str._s_v_u._u._u._u_r_n
push eax
call fcn.00401b30
add esp, 0x1c
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3c]
call fcn.00575bc4
push edi
push ebx
push str.OperaPsw.txt
push ebx
lea ecx, [ebp]
call fcn.00439617
push 0x282
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.0047ddbd
lea ecx, [ebp]
mov ebx, eax
call fcn.00575ddc
lea ecx, [ebp]
mov dword [eax + 0x30], ebx
call fcn.00577176
cmp eax, 1
jne 0x46f654
push eax
lea ecx, [ebp + 0x1e0]
call fcn.004b06db
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 7
call fcn.005772a2
mov eax, dword [eax]
push 0x5f5c9c
push eax
lea ecx, [ebp + 0x1e0]
mov byte [ebp - 4], 8
call fcn.004b0baa
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov ebx, eax
mov byte [ebp - 4], 7
call fcn.00402490
test ebx, ebx
je 0x46f62d
xor ebx, ebx
cmp dword [ebp - 0x34], ebx
jle 0x46f5cf
push ebx
lea ecx, [ebp - 0x3c]
call fcn.004026b0
push dword [eax]
call fcn.00428548
pop ecx
test eax, eax
jne 0x46f554
push 1
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x3c]
call fcn.004026b0
mov ecx, eax
call fcn.0040d280
push dword [eax]
or dword [ebp - 0x28], 1
mov byte [ebp - 4], 9
call fcn.00428548
pop ecx
mov byte [ebp - 0x15], 0
test eax, eax
je 0x46f558
mov byte [ebp - 0x15], 1
test byte [ebp - 0x28], 1
mov dword [ebp - 4], 7
je 0x46f574
mov ecx, dword [ebp - 0x10]
and dword [ebp - 0x28], 0xfffffffe
add ecx, 0xfffffff0
call fcn.00402490
cmp byte [ebp - 0x15], 0
je 0x46f58a
push 0x603864
lea ecx, [ebp + 0x1e0]
call fcn.004b07a6
push ebx
lea ecx, [ebp - 0x3c]
call fcn.004026b0
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
push ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x20], eax
call fcn.004026b0
push dword [ebp - 0x20]
mov eax, dword [eax]
push eax
lea ecx, [ebp + 0x1e0]
call fcn.004b0892
push 0x603864
lea ecx, [ebp + 0x1e0]
call fcn.004b07a6
inc ebx
cmp ebx, dword [ebp - 0x34]
jl 0x46f511
lea ecx, [ebp + 0x1e0]
call fcn.004b0acc
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp]
call fcn.005772a2
mov eax, dword [eax]
mov ecx, dword [edi + 0x20]
push 1
push 0
push 0
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
mov ebx, eax
call fcn.00402490
cmp ebx, 0x20
ja 0x46f645
mov edi, dword [edi + 0x20]
push 0x284
mov ecx, esi
call fcn.0047ddbd
push eax
push 0x13
push edi
call fcn.00428d53
add esp, 0xc
jmp 0x46f645
mov edi, dword [edi + 0x20]
push 0x283
mov ecx, esi
call fcn.0047ddbd
push eax
push edi
call fcn.00428e29
pop ecx
pop ecx
lea ecx, [ebp + 0x1e0]
mov byte [ebp - 4], 6
call fcn.004b0b8e
lea ecx, [ebp]
mov byte [ebp - 4], 5
call fcn.0057670f
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 3
call fcn.004bfff0
mov ebx, dword [ebp - 0x24]
jmp 0x46f68d
mov edi, dword [edi + 0x20]
push 0x281
call fcn.0047ddbd
push eax
push 0x16
push edi
call fcn.00428d53
add esp, 0xc
mov ecx, dword [ebp - 0x40]
call fcn.0046e2fb
jmp 0x46f1dd
cmp dword [ebp - 0x58], 0xf
jne 0x46f6bb
mov edi, dword [edi + 0x20]
push 0x27f
mov ecx, esi
call fcn.0047ddbd
push eax
push 0x16
push edi
call fcn.00428d53
add esp, 0xc
mov ecx, dword [ebp - 0x40]
call fcn.0046e2fb
lea ecx, [ebx - 0x10]
call fcn.00402490
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402490
xor esi, esi
inc esi
jmp 0x46f2d5