Function at 0x87e510
Capabilities:
Check for foreground window switch
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x87e8aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x87e892
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x87e881
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x8aa338]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 8], ax
mov eax, dword [0x8aa338]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0046f580
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
call fcn.0044773c
mov dx, 2
call fcn.00447704
test al, al
jne 0x87e5c9
push 8
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
jne 0x87e5c9
push 0x11
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
jne 0x87e5c9
push 0
push 0
push 0
call fcn.0087d2f4
push eax
mov cx, word [0x87e8bc]
mov dl, 1
mov eax, 0x87e8c4
call fcn.00884f94
call fcn.004045a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x87e89c
call fcn.0087cc24
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0xd]
call fcn.0087e23c
mov edi, eax
test edi, edi
ja 0x87e61f
push 0
push 0
push 0
call fcn.0087d2f4
push eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x418]
mov eax, dword [eax + 0x10c]
mov cx, word [0x87e8bc]
mov dl, 1
call fcn.00884f94
call fcn.004045a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x87e89c
mov byte [ebp - 0xe], 0
cmp byte [ebp - 0xd], 0
je 0x87e69b
mov eax, edi
call fcn.0087e414
mov ebx, eax
test ebx, ebx
jbe 0x87e6a5
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x87e6a5
push 2
push edi
call sub.user32.dll_GetAncestor
mov dword [ebp - 0xc], eax
push 9
push ebx
call sub.user32.dll_ShowWindow
mov byte [ebp - 0xe], 1
push 0x1f4
call sub.kernel32.dll_Sleep_1
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x87e675
push 0xfa
call sub.kernel32.dll_Sleep_1
mov esi, 1
jmp 0x87e68c
push 0xc8
call sub.kernel32.dll_Sleep_1
inc esi
cmp esi, 0xa
jg 0x87e6a5
push 2
push edi
call sub.user32.dll_GetAncestor
cmp eax, dword [ebp - 0xc]
je 0x87e67c
jmp 0x87e6a5
push 2
push edi
call sub.user32.dll_GetAncestor
mov ebx, eax
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x87e6ee
push 0
push 0
push 0
call fcn.0087d2f4
push eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x418]
mov eax, dword [eax + 0x10c]
mov cx, word [0x87e8bc]
mov dl, 1
call fcn.00884f94
call fcn.004045a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x87e89c
mov byte [ebp - 5], 1
cmp byte [ebp - 0xe], 0
jne 0x87e728
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x87e728
push 9
push ebx
call sub.user32.dll_ShowWindow
push 0x1f4
call sub.kernel32.dll_Sleep_1
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x87e728
push 0xfa
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x14]
push eax
push 0x9c4
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_SendMessageTimeoutA
push ebx
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
push 0x64
call sub.kernel32.dll_Sleep_1
mov esi, 1
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
je 0x87e787
cmp edi, eax
je 0x87e787
push 0xc8
call sub.kernel32.dll_Sleep_1
mov eax, esi
mov ecx, 5
cdq
idiv ecx
test edx, edx
jne 0x87e781
push ebx
call sub.user32.dll_SetForegroundWindow
inc esi
cmp esi, 0x10
jne 0x87e756
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
je 0x87e798
cmp edi, eax
jne 0x87e863
lea eax, [ebp - 0x14]
push eax
push 0x9c4
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_SendMessageTimeoutA
lea eax, [ebp - 0x14]
push eax
push 0x9c4
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_SendMessageTimeoutA
call sub.user32.dll_GetForegroundWindow
mov edx, dword [ebp - 4]
mov dword [edx], eax
push 0
push 1
push 0
push 0x11
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x11
call sub.user32.dll_keybd_event
push 0
push 1
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0x64
call sub.kernel32.dll_Sleep_1
push 0
push 3
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 3
push 0
push 0x11
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x11
call sub.user32.dll_keybd_event
push 0x1f4
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x14]
push eax
push 0x9c4
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_SendMessageTimeoutA
lea eax, [ebp - 0x14]
push eax
push 0x9c4
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_SendMessageTimeoutA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x87e888
mov eax, dword [0x8aa338]
mov eax, dword [eax]
mov dx, word [ebp - 8]
call fcn.0046f580
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x87e8b1
ret