Function at 0x4b5a80
Capabilities:
Check for foreground window switch
Log keystrokes

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4b5dd4
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
cmp eax, dword [0x4fcbf0]
je 0x4b5b10
mov ecx, dword [0x4ff18c]
test cl, 1
jne 0x4b5adc
push str.IsHungAppWindow
or ecx, 1
push str.user32
mov dword [0x4ff18c], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov dword [0x4ff190], eax
jmp 0x4b5ae1
mov eax, dword [0x4ff190]
test eax, eax
je 0x4b5aea
push edi
call eax
jmp 0x4b5b08
lea eax, [esp + 0x14]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x4b5dd4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push edi
mov ebp, eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4b5b2c
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, ebp
jne 0x4b5b3a
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp byte [0x4fab27], 0
jne 0x4b5bba
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4fcbf0]
mov dword [0x4f816c], 0
cmp eax, dword fs:[0x24]
je 0x4b5b6c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b5b79
mov edx, 1
lea ecx, [edx + 9]
call fcn.004018d0
mov dword [0x4f816c], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
jne 0x4b5b9b
mov esi, edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp esi, ebp
je 0x4b5bb4
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x4b5bb4
test esi, esi
jne 0x4b5dca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test ebp, ebp
je 0x4b5c80
push 0
push ebp
call ebx
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x4b5c88
cmp dword [0x4fcbf0], ebx
je 0x4b5c5f
mov ecx, dword [0x4ff18c]
test cl, 1
jne 0x4b5c15
push str.IsHungAppWindow
or ecx, 1
push str.user32
mov dword [0x4ff18c], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov dword [0x4ff190], eax
jmp 0x4b5c1a
mov eax, dword [0x4ff190]
test eax, eax
je 0x4b5c23
push ebp
call eax
jmp 0x4b5c41
lea eax, [esp + 0x1c]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
jne 0x4b5c65
push 1
push ebx
push dword [0x4fcbf0]
call esi
test eax, eax
setne byte [esp + 0x12]
jmp 0x4b5c65
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4b5c88
cmp ebx, eax
je 0x4b5c88
push 1
push eax
push ebx
call esi
test eax, eax
setne byte [esp + 0x13]
jmp 0x4b5c88
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
xor ebx, ebx
nop word [eax + eax]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4fcbf0]
mov dword [0x4f816c], 0
cmp eax, dword fs:[0x24]
je 0x4b5cb9
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b5cc6
mov edx, 1
lea ecx, [edx + 9]
call fcn.004018d0
mov dword [0x4f816c], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
je 0x4b5d91
cmp esi, ebp
je 0x4b5cf9
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x4b5cf9
test esi, esi
jne 0x4b5d93
inc ebx
cmp ebx, 5
jl 0x4b5c90
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
mov ecx, 2
call fcn.0041bd60
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
mov ecx, 2
call fcn.0041bd60
add esp, 0x20
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4fcbf0]
mov dword [0x4f816c], 0
cmp eax, dword fs:[0x24]
je 0x4b5d59
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b5d66
mov edx, 1
lea ecx, [edx + 9]
call fcn.004018d0
mov dword [0x4f816c], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
je 0x4b5d91
cmp esi, ebp
je 0x4b5d8d
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
je 0x4b5d93
xor esi, esi
jmp 0x4b5d93
mov esi, edi
cmp byte [esp + 0x12], 0
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x4b5daf
push 0
push ebx
push dword [0x4fcbf0]
call ebp
cmp byte [esp + 0x13], 0
je 0x4b5dbf
push 0
push dword [esp + 0x1c]
push ebx
call ebp
test esi, esi
je 0x4b5dd4
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret