Function at 0x4591a0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
cmp dword [ebp + 0x18], 0
jne 0x4591b4
xor eax, eax
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov dword [ebp + 0x18], 0
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4591d0
mov eax, dword [ecx]
call dword [eax + 0xc8]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
cmp eax, 1
jne 0x45948b
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov edi, eax
mov dword [ebp - 0x38], 0
mov eax, 2
mov word [ebp - 0x3c], di
mov word [ebp - 0x64], ax
mov ebx, 0xd
movzx eax, word [0x4e8c0c]
mov word [ebp - 0x14], ax
movzx eax, word [0x4e8c08]
mov word [ebp - 0x28], ax
mov eax, dword [esi]
push ecx
push esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], edi
mov word [ebp - 0x50], bx
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], edi
call dword [eax + 0x14]
test eax, eax
jne 0x4592e0
mov ecx, dword [ebp + 0x10]
mov ax, word [0x4e8c0c]
push 0
mov word [ecx], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
push ecx
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x45934d
mov ecx, dword [ebp + 0x10]
mov ax, word [0x4e8c08]
push 0
mov word [ecx], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x4593b4
mov eax, dword [ebp + 0x10]
push 0
mov word [eax], di
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
lea ecx, [ebp - 0x50]
push ecx
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x45941b
mov eax, dword [ebp + 0x10]
push 0
mov word [eax], bx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
lea ecx, [ebp - 0x64]
push ecx
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x4596a2
mov eax, dword [ebp + 0x10]
mov ecx, 2
push 0
mov word [eax], cx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
test eax, eax
jne 0x4596a2
mov edi, dword [ebp + 0x10]
cmp word [edi], ax
jne 0x4596a2
movzx eax, word [0x4e8c08]
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push eax
call esi
test eax, eax
je 0x45950f
mov ax, word [0x4e8c08]
push 0
mov word [edi], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
movzx eax, word [0x4e8c0c]
push eax
call esi
test eax, eax
je 0x459579
mov ax, word [0x4e8c0c]
push 0
mov word [edi], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 1
call esi
test eax, eax
je 0x4595dc
mov eax, 1
push 0
mov word [edi], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0xd
call esi
test eax, eax
je 0x45963f
mov eax, 0xd
push 0
mov word [edi], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 2
call esi
test eax, eax
je 0x4596a2
mov eax, 2
push 0
mov word [edi], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x18