Function at 0x4b6a00
Capabilities:
Check for foreground window switch
Log keystrokes

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4b6d54
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
cmp eax, dword [0x4fd2ec]
je 0x4b6a90
mov ecx, dword [0x5000fc]
test cl, 1
jne 0x4b6a5c
push str.IsHungAppWindow
or ecx, 1
push str.user32
mov dword [0x5000fc], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov dword [0x500100], eax
jmp 0x4b6a61
mov eax, dword [0x500100]
test eax, eax
je 0x4b6a6a
push edi
call eax
jmp 0x4b6a88
lea eax, [esp + 0x14]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x4b6d54
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push edi
mov ebp, eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4b6aac
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, ebp
jne 0x4b6aba
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp byte [0x4fba9e], 0
jne 0x4b6b3a
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4fd2ec]
mov dword [0x4f90ec], 0
cmp eax, dword fs:[0x24]
je 0x4b6aec
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b6af9
mov edx, 1
lea ecx, [edx + 9]
call fcn.004018f0
mov dword [0x4f90ec], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
jne 0x4b6b1b
mov esi, edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp esi, ebp
je 0x4b6b34
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x4b6b34
test esi, esi
jne 0x4b6d4a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test ebp, ebp
je 0x4b6c00
push 0
push ebp
call ebx
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x4b6c08
cmp dword [0x4fd2ec], ebx
je 0x4b6bdf
mov ecx, dword [0x5000fc]
test cl, 1
jne 0x4b6b95
push str.IsHungAppWindow
or ecx, 1
push str.user32
mov dword [0x5000fc], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov dword [0x500100], eax
jmp 0x4b6b9a
mov eax, dword [0x500100]
test eax, eax
je 0x4b6ba3
push ebp
call eax
jmp 0x4b6bc1
lea eax, [esp + 0x1c]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
jne 0x4b6be5
push 1
push ebx
push dword [0x4fd2ec]
call esi
test eax, eax
setne byte [esp + 0x12]
jmp 0x4b6be5
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4b6c08
cmp ebx, eax
je 0x4b6c08
push 1
push eax
push ebx
call esi
test eax, eax
setne byte [esp + 0x13]
jmp 0x4b6c08
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
xor ebx, ebx
nop word [eax + eax]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4fd2ec]
mov dword [0x4f90ec], 0
cmp eax, dword fs:[0x24]
je 0x4b6c39
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b6c46
mov edx, 1
lea ecx, [edx + 9]
call fcn.004018f0
mov dword [0x4f90ec], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
je 0x4b6d11
cmp esi, ebp
je 0x4b6c79
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x4b6c79
test esi, esi
jne 0x4b6d13
inc ebx
cmp ebx, 5
jl 0x4b6c10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
mov ecx, 2
call fcn.0041c240
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
mov ecx, 2
call fcn.0041c240
add esp, 0x20
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4fd2ec]
mov dword [0x4f90ec], 0
cmp eax, dword fs:[0x24]
je 0x4b6cd9
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b6ce6
mov edx, 1
lea ecx, [edx + 9]
call fcn.004018f0
mov dword [0x4f90ec], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
je 0x4b6d11
cmp esi, ebp
je 0x4b6d0d
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
je 0x4b6d13
xor esi, esi
jmp 0x4b6d13
mov esi, edi
cmp byte [esp + 0x12], 0
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x4b6d2f
push 0
push ebx
push dword [0x4fd2ec]
call ebp
cmp byte [esp + 0x13], 0
je 0x4b6d3f
push 0
push dword [esp + 0x1c]
push ebx
call ebp
test esi, esi
je 0x4b6d54
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret