Function at 0x4e9bf0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
test esi, esi
je 0x4e9e8c
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push esi
call edi
mov ecx, dword fs:[0x2c]
mov ebp, eax
mov eax, dword [0x62271c]
mov dword [esp + 0x1c], ebp
lea ebx, [eax*4]
mov eax, dword [ebx + ecx]
cmp byte [eax + 0x2198], 0
jne 0x4e9c3f
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ebx + ecx]
cmp ebp, dword [eax + 0x250]
je 0x4e9c5b
push esi
call fcn.004e92a0
add esp, 4
test al, al
jne 0x4e9e8c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
push esi
mov dword [esp + 0x1c], ebp
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4e9c7b
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, ebp
jne 0x4e9c89
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword fs:[0x2c]
mov eax, dword [ebx + eax]
cmp byte [eax + 0x2198], 0
jne 0x4e9ca0
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [ebx + eax]
cmp byte [eax + 0x13f], 0
jne 0x4e9cc4
push ebp
push esi
call fcn.004e8570
add esp, 8
test eax, eax
jne 0x4e9e8e
mov byte [esp + 0x24], 0
mov byte [esp + 0x13], 0
test ebp, ebp
je 0x4e9d76
push 0
push ebp
call edi
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x4e9d7e
mov ecx, dword fs:[0x2c]
mov ecx, dword [ebx + ecx]
cmp byte [ecx + 0x2198], 0
jne 0x4e9d01
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [ebx + eax]
cmp dword [eax + 0x250], edi
je 0x4e9d57
push ebp
call fcn.004e92a0
add esp, 4
test al, al
jne 0x4e9d57
mov ecx, dword fs:[0x2c]
mov eax, dword [ebx + ecx]
cmp byte [eax + 0x2198], 0
jne 0x4e9d3e
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ebx + ecx]
push 1
push edi
push dword [eax + 0x250]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x24]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4e9d7e
cmp edi, eax
je 0x4e9d7e
push 1
push eax
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
jmp 0x4e9d7e
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
xor edi, edi
mov eax, dword fs:[0x2c]
mov eax, dword [ebx + eax]
cmp byte [eax + 0x2198], 0
jne 0x4e9d97
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov ecx, dword [ebx + eax]
movzx eax, byte [ecx + 0x13f]
cmp edi, eax
jne 0x4e9dd2
cmp byte [ecx + 0x218a], 0
jne 0x4e9dd2
push 0xffc3d450
push 0
push 0
push 0
push 0x12
push 1
mov byte [ecx + 0x218a], 1
call fcn.0043db20
add esp, 0x18
push ebp
push esi
call fcn.004e8570
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4e9e1d
mov ebp, dword [esp + 0x18]
inc edi
cmp edi, 5
jl 0x4e9d80
push 0xffc3d44d
push eax
push eax
push eax
push 0x12
push 2
call fcn.0043db20
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0043db20
push ebp
push esi
call fcn.004e8570
add esp, 0x38
mov ebp, eax
cmp byte [esp + 0x24], 0
je 0x4e9e5d
mov ecx, dword fs:[0x2c]
mov eax, dword [ebx + ecx]
cmp byte [eax + 0x2198], 0
jne 0x4e9e43
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ebx + ecx]
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 0
push edi
push dword [eax + 0x250]
call ebx
jmp 0x4e9e67
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x13], 0
je 0x4e9e77
push 0
push dword [esp + 0x20]
push edi
call ebx
test ebp, ebp
je 0x4e9e8c
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret