Function at 0x459820
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d51a4
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], 0
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 8]
mov edx, dword [ebp - 0x818]
cmp ecx, dword [edx + 0x84]
jne 0x459c3a
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 5
jne 0x4598a5
mov ecx, dword [ebp - 0x818]
call fcn.00455500
cmp eax, 1
je 0x4598a0
push 6
mov ecx, dword [ebp - 0x818]
call fcn.004571a0
jmp 0x459c1f
cmp dword [ebp - 0x10], 6
jne 0x459abb
mov edx, dword [ebp - 0x818]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x818]
mov edx, dword [eax + 0x64]
call edx
movzx eax, al
test eax, eax
je 0x4598ce
jmp 0x459a99
mov ecx, dword [ebp - 0x818]
mov ecx, dword [ecx + 0x78]
call fcn.00412e90
movzx edx, al
test edx, edx
je 0x4598e8
jmp 0x459a99
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0x78]
call fcn.00455520
movzx ecx, al
test ecx, ecx
je 0x459a99
push 0x3b8
push 0
lea edx, [ebp - 0x3dc]
push edx
call fcn.00555bf0
add esp, 0xc
mov dword [ebp - 0x3dc], 0x3b8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x3d8], ecx
mov dword [ebp - 0x3d4], 0
mov dword [ebp - 0x3d0], 0x10
mov dword [ebp - 0xbc], 0x2710
push str.Captions_TrayInfo
lea ecx, [ebp - 0x7e8]
call fcn.004b3550
mov dword [ebp - 4], 0
lea edx, [ebp - 0x7e8]
push edx
lea eax, [ebp - 0x3e8]
push eax
mov ecx, dword [ebp - 0x818]
mov ecx, dword [ecx + 0x78]
call fcn.0041b330
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7e8]
call fcn.004b3860
mov edx, dword [ebp - 0x818]
add edx, 0xc4
push edx
lea ecx, [ebp - 0x1c]
call fcn.004b34d0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0x78]
call fcn.00404b70
cmp eax, 1
jne 0x459a31
push str.Captions_QuickScan
lea ecx, [ebp - 0x7f4]
call fcn.004b3550
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7f4]
push ecx
lea edx, [ebp - 0x3f4]
push edx
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0x78]
call fcn.0041b330
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7f4]
call fcn.004b3860
lea ecx, [ebp - 0x3f4]
call fcn.00404b70
test eax, eax
jle 0x459a22
push 0x6025a8
lea ecx, [ebp - 0x1c]
call fcn.004b3b40
lea ecx, [ebp - 0x3f4]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004b3ad0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3f4]
call fcn.004b3860
lea ecx, [ebp - 0x1c]
call fcn.004553f0
push eax
push 0x40
lea edx, [ebp - 0xb8]
push edx
call fcn.004551f0
lea ecx, [ebp - 0x3e8]
call fcn.004553f0
push eax
push 0x100
lea eax, [ebp - 0x2bc]
push eax
call fcn.004551f0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x3dc]
push ecx
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3e8]
call fcn.004b3860
mov ecx, dword [ebp - 0x818]
call fcn.00455500
cmp eax, 7
je 0x459ab6
push 7
mov ecx, dword [ebp - 0x818]
call fcn.004571a0
jmp 0x459c1f
cmp dword [ebp - 0x10], 1
jne 0x459ad3
push 8
mov ecx, dword [ebp - 0x818]
call fcn.004571a0
jmp 0x459c1f
cmp dword [ebp - 0x10], 7
jne 0x459aeb
push 8
mov ecx, dword [ebp - 0x818]
call fcn.004571a0
jmp 0x459c1f
cmp dword [ebp - 0x10], 9
jne 0x459b6f
mov edx, dword [ebp - 0x818]
mov ecx, dword [edx + 0x78]
call fcn.0041d950
movzx eax, al
test eax, eax
jne 0x459b15
push 0xb
mov ecx, dword [ebp - 0x818]
call fcn.004571a0
jmp 0x459b6a
mov ecx, dword [ebp - 0x818]
mov ecx, dword [ecx + 0x78]
call fcn.0041d9e0
movzx edx, al
test edx, edx
je 0x459b39
push 0xa
mov ecx, dword [ebp - 0x818]
call fcn.004571a0
jmp 0x459b6a
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0x78]
call fcn.0041da90
movzx ecx, al
test ecx, ecx
je 0x459b5d
push 0xa
mov ecx, dword [ebp - 0x818]
call fcn.004571a0
jmp 0x459b6a
push 4
mov ecx, dword [ebp - 0x818]
call fcn.004571a0
jmp 0x459c1f
cmp dword [ebp - 0x10], 0xb
jne 0x459b87
push 0xb
mov ecx, dword [ebp - 0x818]
call fcn.004571a0
jmp 0x459c1f
cmp dword [ebp - 0x10], 4
jne 0x459bb0
push 0
mov edx, dword [ebp - 0x818]
mov eax, dword [edx + 0xb4]
mov ecx, dword [ebp - 0x818]
mov ecx, dword [ecx + 0xb4]
mov edx, dword [eax]
mov eax, dword [edx + 0x30]
call eax
jmp 0x459c1f
cmp dword [ebp - 0x10], 5
jne 0x459bd9
push 0
mov ecx, dword [ebp - 0x818]
mov edx, dword [ecx + 0xb4]
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0xb4]
mov edx, dword [edx]
mov eax, dword [edx + 0x30]
call eax
jmp 0x459c1f
cmp dword [ebp - 0x10], 2
jne 0x459c1f
push 1
mov ecx, dword [ebp - 0x818]
mov edx, dword [ecx + 0xb4]
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0xb4]
mov edx, dword [edx]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [ebp - 0x818]
mov edx, dword [ecx + 0xb4]
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0xb4]
mov edx, dword [edx]
mov eax, dword [edx + 0x34]
call eax
mov ecx, dword [ebp - 0x818]
add ecx, 0x8c
call fcn.004010f0
jmp 0x45a1bd
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 8]
mov eax, dword [ebp - 0x818]
cmp edx, dword [eax + 0x88]
jne 0x459d4a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
and edx, 0xffff
mov word [ebp - 0x3f8], dx
movzx eax, word [ebp - 0x3f8]
cmp eax, 0x203
jne 0x459d45
mov ecx, dword [ebp - 0x818]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x818]
mov eax, dword [edx + 0x64]
call eax
movzx ecx, al
test ecx, ecx
jne 0x459caa
mov edx, dword [ebp - 0x818]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x818]
mov edx, dword [eax + 0x58]
call edx
jmp 0x459d45
mov ecx, dword [ebp - 0x818]
call fcn.004c4880
cmp eax, 1
jne 0x459cc9
push 0
mov ecx, dword [ebp - 0x818]
call fcn.004c48a0
jmp 0x459d45
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx]
je 0x459d45
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x3fc], eax
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x400], eax
mov ecx, dword [ebp - 0x3fc]
cmp ecx, dword [ebp - 0x400]
je 0x459d45
push 1
mov edx, dword [ebp - 0x400]
push edx
mov eax, dword [ebp - 0x3fc]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov eax, dword [ebp - 0x400]
push eax
mov ecx, dword [ebp - 0x3fc]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x45a1bd
mov edx, dword [ebp + 8]
movzx eax, word [edx + 8]
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0x14
jg 0x459d95
cmp dword [ebp - 0x81c], 0x14
je 0x459f3f
cmp dword [ebp - 0x81c], 1
je 0x459db7
cmp dword [ebp - 0x81c], 2
je 0x459f1a
cmp dword [ebp - 0x81c], 0x11
je 0x45a036
jmp 0x45a1ae
cmp dword [ebp - 0x81c], 0x16
je 0x45a061
cmp dword [ebp - 0x81c], 0x111
je 0x45a0c1
jmp 0x45a1ae
mov ecx, dword [ebp - 0x818]
mov ecx, dword [ecx + 0x78]
call fcn.00412e90
movzx edx, al
test edx, edx
je 0x459e11
lea eax, [ebp - 0x804]
push eax
mov ecx, dword [ebp - 0x818]
mov ecx, dword [ecx + 0x78]
call fcn.004555a0
mov dword [ebp - 0x820], eax
mov edx, dword [ebp - 0x814]
or edx, 1
mov dword [ebp - 0x814], edx
mov ecx, dword [ebp - 0x820]
call fcn.00404b70
test eax, eax
jle 0x459e11
mov dword [ebp - 0x824], 1
jmp 0x459e1b
mov dword [ebp - 0x824], 0
mov al, byte [ebp - 0x824]
mov byte [ebp - 0x7f5], al
mov ecx, dword [ebp - 0x814]
and ecx, 1
je 0x459e44
and dword [ebp - 0x814], 0xfffffffe
lea ecx, [ebp - 0x804]
call fcn.004b3860
movzx edx, byte [ebp - 0x7f5]
test edx, edx
je 0x459e54
jmp 0x459f06
push 0x3b8
push 0
lea eax, [ebp - 0x7bc]
push eax
call fcn.00555bf0
add esp, 0xc
mov dword [ebp - 0x7bc], 0x3b8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 0x7b8], edx
mov dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0x88]
mov dword [ebp - 0x7ac], ecx
mov dword [ebp - 0x7b0], 7
lea edx, [ebp - 0x810]
push edx
mov ecx, dword [ebp - 0x818]
call fcn.004b89e0
mov dword [ebp - 0x828], eax
mov ecx, dword [ebp - 0x828]
call fcn.004553f0
push eax
push 0x80
lea eax, [ebp - 0x7a4]
push eax
call fcn.004551f0
lea ecx, [ebp - 0x810]
call fcn.004b3860
mov ecx, dword [ebp - 0x818]
mov edx, dword [ecx + 0xdc]
mov dword [ebp - 0x7a8], edx
lea eax, [ebp - 0x7bc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x818]
call fcn.004c4930
jmp 0x45a1bd
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x818]
call fcn.004597a0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x818]
call fcn.004c4930
jmp 0x45a1bd
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x7d8], eax
lea ecx, [ebp - 0x7d0]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp - 0x7c0], 0
mov ecx, dword [ebp - 0x818]
movzx edx, byte [ecx + 0x7d]
test edx, edx
je 0x459f8a
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0xe4]
mov dword [ebp - 0x82c], ecx
jmp 0x459f9c
mov edx, dword [ebp - 0x818]
mov eax, dword [edx + 0xe0]
mov dword [ebp - 0x82c], eax
mov ecx, dword [ebp - 0x82c]
mov dword [ebp - 0x7d4], ecx
mov edx, dword [ebp - 0x7c0]
push edx
push 0
mov eax, dword [ebp - 0x7d8]
push eax
mov ecx, dword [ebp - 0x7d4]
call fcn.0043f740
mov ecx, dword [ebp - 0x7d4]
call fcn.004c3bf0
add eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x7c0], eax
mov ecx, dword [ebp - 0x7c0]
push ecx
push 0
mov edx, dword [ebp - 0x7d8]
push edx
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0xe8]
call fcn.0043f740
mov ecx, dword [ebp - 0x7c4]
sub ecx, 0x31
mov dword [ebp - 0x7cc], ecx
push 0xf
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push eax
lea edx, [ebp - 0x7d0]
push edx
mov eax, dword [ebp - 0x7d8]
push eax
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 1
jmp 0x45a1bd
mov ecx, dword [ebp - 0x818]
call fcn.00455500
cmp eax, 0xa
jne 0x45a052
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0
jmp 0x45a05c
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 1
jmp 0x45a1bd
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x10], 0
jne 0x45a07b
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x818]
call fcn.004c4930
jmp 0x45a0bc
mov ecx, dword [ebp - 0x818]
call fcn.00455500
cmp eax, 0xa
jne 0x45a09c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x818]
call fcn.004c4930
jmp 0x45a0bc
mov ecx, dword [ebp - 0x818]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x818]
mov eax, dword [edx + 0x8c]
call eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0
jmp 0x45a1bd
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x7dc], eax
mov ecx, dword [ebp - 0x818]
call fcn.00455500
cmp eax, 1
jne 0x45a19d
mov ecx, dword [ebp - 0x7dc]
mov dword [ebp - 0x830], ecx
cmp dword [ebp - 0x830], 0x8000
je 0x45a116
cmp dword [ebp - 0x830], 0x8001
je 0x45a143
cmp dword [ebp - 0x830], 0x8002
je 0x45a170
jmp 0x45a19d
push 0
mov edx, dword [ebp - 0x818]
mov ecx, dword [edx + 0x78]
call fcn.00419c90
push 0
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0x78]
call fcn.0043d750
mov ecx, dword [ebp - 0x818]
call fcn.00459470
jmp 0x45a1bd
push 0
mov ecx, dword [ebp - 0x818]
mov ecx, dword [ecx + 0x78]
call fcn.00419c90
push 1
mov edx, dword [ebp - 0x818]
mov ecx, dword [edx + 0x78]
call fcn.0043d750
mov ecx, dword [ebp - 0x818]
call fcn.00459470
jmp 0x45a1bd
push 1
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax + 0x78]
call fcn.00419c90
push 0
mov ecx, dword [ebp - 0x818]
mov ecx, dword [ecx + 0x78]
call fcn.0043d750
mov ecx, dword [ebp - 0x818]
call fcn.00459470
jmp 0x45a1bd
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x818]
call fcn.004c4930
jmp 0x45a1bd
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x818]
call fcn.004c4930
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret 4