Function at 0x5465a4
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5477a0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
call fcn.0044047a
test eax, eax
je 0x546615
call fcn.0044047a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xe0]
test eax, eax
jne 0x546615
jmp 0x546602
call fcn.0044047a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xac]
call fcn.0044047a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xa8]
test al, al
jne 0x5465f3
mov ecx, edi
call fcn.0047abb4
mov dword [edi + 0x44], eax
test eax, eax
je 0x54662f
mov ecx, eax
call fcn.00401abc
mov dword [ebp - 0x24], eax
jmp 0x546636
mov dword [ebp - 0x24], 0
call fcn.004a4272
test eax, eax
je 0x54690e
mov ecx, eax
call fcn.0045c620
mov esi, eax
call fcn.004a3b28
cmp esi, eax
je 0x54690e
test byte [edi + 0x270], 0xa
je 0x5467ba
mov ecx, edi
call fcn.00546ba8
mov ecx, eax
call fcn.004400ba
test al, al
je 0x5467ba
mov ecx, edi
call fcn.00546bb0
mov ecx, eax
call fcn.004400ba
test al, al
je 0x5467ba
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x130]
call fcn.0043fd32
lea ecx, [ebp - 0x110]
call fcn.0043fd32
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0xf0]
push 0x65fe0e
call fcn.00401278
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0x4c]
push eax
call fcn.00546bb8
lea ecx, [ebp - 0xac]
call fcn.0043fd32
lea ecx, [ebp - 0x8c]
call fcn.0043fd32
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x6c]
push str.Yes
call fcn.00401278
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0xd0]
push eax
call fcn.00546bb8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x430]
mov dword [ebp - 0x10], 4
lea edx, [ebp - 0x4c]
push edx
lea edx, [ebp - 0xd0]
push edx
call eax
lea ecx, [ebp - 0xd0]
call fcn.004473a6
lea ecx, [ebp - 0x6c]
call fcn.0043fda0
lea ecx, [ebp - 0x8c]
call fcn.0043fda0
lea ecx, [ebp - 0xac]
call fcn.0043fda0
lea ecx, [ebp - 0x4c]
call fcn.004473a6
lea ecx, [ebp - 0xf0]
call fcn.0043fda0
lea ecx, [ebp - 0x110]
call fcn.0043fda0
lea ecx, [ebp - 0x130]
call fcn.0043fda0
mov edi, dword [ebp - 0x20]
mov ecx, edi
call fcn.00546bd2
mov ecx, eax
call fcn.004400ba
test al, al
je 0x54690e
mov ecx, edi
call fcn.00546bda
mov ecx, eax
call fcn.004400ba
test al, al
je 0x54690e
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x130]
call fcn.0043fd32
lea ecx, [ebp - 0x110]
call fcn.0043fd32
mov dword [ebp - 0x10], 5
lea ecx, [ebp - 0xf0]
push 0x6617cf
call fcn.00401278
mov dword [ebp - 0x10], 6
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0x4c]
push eax
call fcn.00546bb8
lea ecx, [ebp - 0xac]
call fcn.0043fd32
lea ecx, [ebp - 0x8c]
call fcn.0043fd32
mov dword [ebp - 0x10], 7
lea ecx, [ebp - 0x6c]
push 0x666fb0
call fcn.00401278
mov dword [ebp - 0x10], 8
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0xd0]
push eax
call fcn.00546bb8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x43c]
mov dword [ebp - 0x10], 9
lea edx, [ebp - 0x4c]
push edx
lea edx, [ebp - 0xd0]
push edx
call eax
lea ecx, [ebp - 0xd0]
call fcn.004473a6
lea ecx, [ebp - 0x6c]
call fcn.0043fda0
lea ecx, [ebp - 0x8c]
call fcn.0043fda0
lea ecx, [ebp - 0xac]
call fcn.0043fda0
lea ecx, [ebp - 0x4c]
call fcn.004473a6
lea ecx, [ebp - 0xf0]
call fcn.0043fda0
lea ecx, [ebp - 0x110]
call fcn.0043fda0
lea ecx, [ebp - 0x130]
call fcn.0043fda0
mov edi, dword [ebp - 0x20]
mov ecx, edi
call fcn.005464a2
mov ebx, eax
test bl, 0xa
je 0x54693f
mov eax, ebx
and eax, 0x10
cmp eax, 1
mov eax, 3
adc eax, 0
test bl, bl
js 0x546955
mov ecx, eax
or ecx, 0x200
test ebx, ebx
cmovs eax, ecx
jmp 0x54695a
xor eax, eax
test bl, 0x10
je 0x546961
mov eax, ebx
shr eax, 0x17
and eax, 0x100
or eax, 1
jmp 0x54695a
or eax, 0x100
mov dword [ebp - 0x10], 0xffffffff
lea esi, [ebx*4]
and esi, 0x4000
or esi, eax
mov eax, dword [edi]
mov eax, dword [eax + 0x444]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call eax
add eax, 0xffffff00
rol eax, 0x18
cmp eax, 7
ja case.0x546990.2
jmp dword [eax*4 + 0x632bc0]
or esi, 0x30
jmp case.0x546990.2
or esi, 0x10
jmp case.0x546990.2
or esi, 0x20
jmp case.0x546990.2
or esi, 0x40
shl ebx, 3
and ebx, 0x40000
or ebx, esi
push dword [edi + 0x44]
call fcn.004701a8
add esp, 4
mov ecx, ebx
or ecx, 0x180000
cmp eax, 2
cmovne ecx, ebx
mov dword [ebp - 0x20], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea esi, [ebp - 0xd0]
mov dword [esi], eax
push eax
push 0
push 0x545b48
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [edi + 0x314], eax
call fcn.00545c86
mov ecx, 0x7d1154
push esi
call fcn.004c3cb2
mov dword [eax], edi
lea ecx, [edi + 0x250]
call fcn.00443c3a
mov dword [ebp - 0x28], eax
lea esi, [ebp - 0x4c]
mov ecx, edi
push esi
call fcn.00546be2
mov dword [ebp - 0x10], 0xa
mov ecx, esi
call fcn.00443c3a
mov esi, dword [ebp - 0x20]
mov ecx, esi
or ecx, 0x2000
mov edx, dword [ebp - 0x24]
test edx, edx
cmovne ecx, esi
push ecx
push dword [ebp - 0x28]
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
lea ecx, [ebp - 0x4c]
call fcn.0043fda0
push esi
call fcn.00546cb2
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret