Function at 0x4a1de8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x312
jne 0x4a1fe9
mov eax, dword [ebp - 4]
cmp byte [eax + 0xbc], 0
je 0x4a1fe9
xor eax, eax
push ebp
push 0x4a1fdf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6712e4]
mov eax, dword [eax]
cmp byte [eax + 0x9d], 0
je 0x4a1ec4
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb9], 0
je 0x4a1ea1
xor eax, eax
push ebp
push 0x4a1e92
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x65aa80], 0
je 0x4a1e85
mov eax, dword [0x65aa80]
mov edx, dword [0x49b218]
call fcn.00403eb0
test al, al
je 0x4a1e85
mov eax, dword [0x65aa80]
mov si, 0xffeb
call fcn.00403f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1fd5
push 0
push 1
push 0x111
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
push eax
call sub.user32.dll_GetParent
push eax
call sub.user32.dll_PostMessageA
jmp 0x4a1fd5
xor eax, eax
push ebp
push 0x4a1f21
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp word [eax + 0xba], 0
je 0x4a1f17
mov eax, dword [ebp - 4]
cmp byte [eax + 0xbc], 0
je 0x4a1f17
mov eax, dword [ebp - 4]
mov byte [eax + 0xbc], 0
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xba]
call fcn.004a1ddc
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
push eax
call sub.user32.dll_UnregisterHotKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1f2b
push 0
push 1
push 0
push 0x11
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x11
call sub.user32.dll_keybd_event
push 0
push 1
push 0
push 0x53
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x53
call sub.user32.dll_keybd_event
push 0
push 3
push 0
push 0x53
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x53
call sub.user32.dll_keybd_event
push 0
push 3
push 0
push 0x11
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x11
call sub.user32.dll_keybd_event
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 4]
mov si, word [eax + 0xba]
test si, si
je 0x4a1fd5
push 0x53
push 2
mov eax, esi
call fcn.004a1ddc
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.user32.dll_RegisterHotKey
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 4]
mov byte [eax + 0xbc], bl
test bl, bl
je 0x4a1fd5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1fe9
mov eax, dword [ebp - 8]
cmp dword [eax], 0x110
jne 0x4a1ffd
mov eax, dword [ebp - 4]
test byte [eax + 0x5e], 1
je 0x4a205b
mov eax, dword [0x670aa0]
cmp byte [eax], 0
je 0x4a2050
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4e
jne 0x4a2050
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 8]
mov eax, dword [ebx + 8]
sub eax, 0xfffffda2
jne 0x4a2050
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0xc]
mov eax, dword [ebp - 4]
call fcn.004a1890
test al, al
jne 0x4a2050
mov edx, dword [ebp - 8]
mov eax, 1
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.user32.dll_SetWindowLongA
jmp 0x4a205b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004405e0
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret