Function at 0x4d8eb0
Capabilities:
Log keystrokes via application hook

Disassembly:
sub esp, 0x60
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xac]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov ebx, dword [esp + 0x6c]
test ebx, ebx
jl 0x4d90aa
push ebp
push edi
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push 1
push 0x28
push 0x100
push edx
mov dword [esi + 0xfc], 0xffffffff
call edi
mov eax, dword [esi + 8]
push 1
push 0x28
push 0x101
push eax
call edi
push ebx
push 2
mov ecx, esi
call fcn.004d8bc0
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x525e44], esi
call ebp
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
push eax
push 0
push 0x4d8b10
push 0xffffffffffffffff
call edi
xor ecx, ecx
mov dword [0x525e48], eax
cmp eax, ecx
jne 0x4d8f4d
call ebp
push eax
push 0
push 0x4d8b10
push 0xffffffffffffffff
call edi
mov dword [0x525e48], eax
xor ecx, ecx
mov eax, dword [esi + 0x18]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x30], ecx
mov eax, dword [eax]
xor ecx, ecx
mov dword [esp + 0x34], ecx
lea edx, [esp + 0x30]
mov dword [esp + 0x38], ecx
push edx
mov dword [esp + 0x40], ecx
push 0x18
mov dword [esp + 0x48], ecx
push eax
mov dword [esp + 0x50], ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x4d8f8e
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x2c], ecx
mov eax, dword [esi + 0xc4]
mov edi, dword [esi + 0x4c]
mov edx, ebx
shl edx, 4
mov ecx, dword [edx + eax]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 8]
lea eax, [esp + 0x20]
add edx, edi
push eax
push ecx
mov dword [esp + 0x2c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [esi + 0xac]
lea edx, [esp + 0x1c]
push ebx
push edx
add ecx, 4
call fcn.00473440
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov eax, dword [eax]
mov ecx, dword [esi + 8]
push 0
push ebp
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x80], edi
call dword [sym.imp.USER32.dll_MonitorFromPoint]
test eax, eax
jne 0x4d904b
push 2
push ebp
push edi
call dword [sym.imp.USER32.dll_MonitorFromPoint]
mov edx, eax
test edx, edx
je 0x4d904b
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0x28
push eax
push edx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x4d904b
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x74]
cmp ecx, eax
jl 0x4d9047
mov eax, dword [esp + 0x64]
cmp ecx, eax
jle 0x4d904b
mov dword [esp + 0x74], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
xor edi, edi
push edi
push ecx
mov ecx, dword [esp + 0x20]
push edi
push edx
push eax
push 0x40
push ecx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov edx, dword [0x525e48]
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x525e48], edi
mov dword [0x525e44], edi
mov edx, dword [esi + 0x108]
xor eax, eax
cmp edx, edi
push ebx
setne al
push eax
mov ecx, esi
call fcn.004d8bc0
mov ebx, dword [esi + 0xfc]
cmp ebx, edi
jge 0x4d8ed5
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x60
ret 4