Function at 0x4a5b10
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x581d00
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x30c]
mov eax, dword [eax - 0xc]
lea esi, [edi + 0x30c]
test eax, eax
jne 0x4a5c09
lea ecx, [ebp - 0x34]
push ecx
mov ecx, 0x5ff448
call fcn.004658e0
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004222b0
mov eax, dword [ebp - 0x34]
or ebx, 0xffffffff
add eax, 0xfffffff0
mov dword [ebp - 4], ebx
lea edx, [eax + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4a5b95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
jne 0x4a5c0c
lea edx, [ebp - 0x34]
push edx
mov ecx, 0x5ff680
call fcn.0047c6b0
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004222b0
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
mov dword [ebp - 4], ebx
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a5bdb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call fcn.0046eb60
add esp, 4
push 0x14
push str.KingsoftWPS_Office_
mov ecx, esi
call fcn.00422060
mov ecx, dword [esi]
push ecx
push str.When_the_Registery_is_not_found_the_path_is__ws
push 0x5ff5f8
call fcn.00477930
add esp, 0xc
jmp 0x4a5c0c
or ebx, 0xffffffff
push esi
call fcn.0046eb60
add esp, 4
mov ecx, 0x5ff680
call fcn.00462590
cmp eax, ebx
je 0x4a5c35
mov ecx, 0x5ff680
call fcn.00462590
mov dword [edi + 0x314], eax
jmp 0x4a5c94
mov dword [edi + 0x314], 1
call fcn.0043f620
test eax, eax
je 0x4a5c94
push 0
lea edx, [ebp - 0x34]
push str.SaveUserCfg
push edx
call fcn.0045a800
mov ecx, dword [edi + 0x314]
push ecx
push eax
mov dword [ebp - 4], 2
call fcn.00442940
mov dword [edi + 0x314], eax
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
add esp, 0x14
mov dword [ebp - 4], ebx
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x4a5c94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [edi + 0x314], 0
lea esi, [edi + 0x50]
push 1
mov ecx, esi
je 0x4a5cb7
push 0xde
call fcn.0044ecd0
push 0
push 0xdd
jmp 0x4a5cc8
push 0xdd
call fcn.0044ecd0
push 0
push 0xde
mov ecx, esi
call fcn.0044ecd0
push 0
push 0xcd
mov ecx, esi
call fcn.0044ecd0
push 1
push 0xce
mov ecx, esi
call fcn.0044ecd0
cmp dword [edi + 0x3cc], 0
mov ecx, esi
je 0x4a5d4a
push 0x3ec
push 0x3f0
call fcn.004a1110
push 0xcf
push 0xf1
mov ecx, esi
call fcn.004a1110
push 0x81b
push 0x96f
mov ecx, esi
call fcn.004a1110
push 0xd0
push 0xf2
mov ecx, esi
call fcn.004a1110
push 0
push 0xcf
mov ecx, esi
call fcn.0044ecd0
push 0
jmp 0x4a5d58
push 1
push 0xcf
call fcn.0044ecd0
push 1
push 0x3ec
mov ecx, esi
call fcn.0044ecd0
push 0
push 0xd0
mov ecx, esi
call fcn.0044ecd0
push 1
push 0xd1
mov ecx, esi
call fcn.0044ecd0
push 0
push 0xd2
mov ecx, esi
call fcn.0044ecd0
push 1
push 0xd3
mov ecx, esi
call fcn.0044ecd0
push 0
push 0xd4
mov ecx, esi
call fcn.0044ecd0
push 0
push 0xf2
mov ecx, esi
call fcn.0044ecd0
push 1
push 0x3eb
mov ecx, esi
call fcn.0044ecd0
push 1
push 0x3ed
mov ecx, esi
call fcn.0044ecd0
push 1
push 0x3ee
mov ecx, esi
call fcn.0044ecd0
mov ecx, edi
call fcn.004a2db0
xor ecx, ecx
test al, al
setne cl
push ecx
push 0xf1
mov ecx, esi
call fcn.0044ecd0
mov ecx, edi
call fcn.004a2db0
xor edx, edx
test al, al
setne dl
mov ecx, esi
push edx
push 0x3f0
call fcn.0044ecd0
cmp dword [edi + 0x3c8], 0
je 0x4a5e6e
push 0x3ee
push 0x3eb
mov ecx, esi
call fcn.004a1110
push 0xd3
push 0xcd
mov ecx, esi
call fcn.004a1110
push 0x843
push 0x807
mov ecx, esi
call fcn.004a1110
push 0xd4
push 0xce
mov ecx, esi
call fcn.004a1110
mov ecx, edi
call fcn.004a3a80
jmp 0x4a5e75
mov ecx, edi
call fcn.004a30e0
push 0
push 0x807
mov ecx, esi
call fcn.0044ecd0
push 0
push 0x81b
mov ecx, esi
call fcn.0044ecd0
push 0
push 0x82f
mov ecx, esi
call fcn.0044ecd0
push 0
push 0x843
mov ecx, esi
call fcn.0044ecd0
push 0
push 0x96f
mov ecx, esi
call fcn.0044ecd0
push str.cgpb_polish.png
lea esi, [edi + 0x310]
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.004221d0
mov ebx, eax
push str.cgpb_bg.png
lea ecx, [ebp - 0x3c]
push esi
push ecx
mov dword [ebp - 4], 3
call fcn.004221d0
mov dword [ebp - 0x34], eax
push str.cgpb_fg.png
lea edx, [ebp - 0x40]
push esi
push edx
mov byte [ebp - 4], 4
call fcn.004221d0
add esp, 0x24
mov ebx, dword [ebx]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
mov eax, dword [eax]
push ebx
push ecx
push eax
mov ecx, 0x5ffb58
mov byte [ebp - 4], 5
call fcn.004979f0
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4a5f3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a5f61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a5f87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [edi + 0x30]
xor eax, eax
mov esi, 0x131
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x21c
mov dword [ebp - 0x14], 8
cmp dword [0x5f3570], eax
jne 0x4a5fb7
mov dword [0x5f3570], str.STATIC
mov ecx, dword [ebp - 0x38]
push ecx
push 0x5ffb78
push 0x5f3540
push 0x601b58
push 0x601b10
call fcn.00448460
add esp, 0x14
push 0
movzx eax, ax
push eax
push esi
push 0
push 0x50000000
push 0
lea edx, [ebp - 0x20]
push edx
push ebx
mov ecx, 0x5ffb58
call fcn.00447a40
push 0
mov ecx, 0x5ffb58
call fcn.00496c30
mov eax, dword [0x5ff880]
test eax, eax
je 0x4a6010
mov ecx, dword [edi + 4]
mov dword [eax], ecx
mov edx, dword [edi + 4]
push edx
mov ecx, 0x5ff680
call fcn.00477f80
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x49fdf0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x5ffb44], eax
mov eax, dword [edi + 0x3e8]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4a6086
mov eax, dword [edi + 0x30]
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x38], esp
push 0
push 0
push 0
push ecx
mov dword [eax], 0
mov eax, esp
lea edx, [ebp - 0x30]
mov dword [eax], edx
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x38], esp
push eax
lea ecx, [edi + 0x3e4]
call fcn.00448b80
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005332ca
mov esp, ebp
pop ebp
ret