Function at 0x4b6480
Capabilities:
Check for foreground window switch
Log keystrokes

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4b67d4
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
cmp eax, dword [0x4fdb70]
je 0x4b6510
mov ecx, dword [0x50010c]
test cl, 1
jne 0x4b64dc
push str.IsHungAppWindow
or ecx, 1
push str.user32
mov dword [0x50010c], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov dword [0x500110], eax
jmp 0x4b64e1
mov eax, dword [0x500110]
test eax, eax
je 0x4b64ea
push edi
call eax
jmp 0x4b6508
lea eax, [esp + 0x14]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x4b67d4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push edi
mov ebp, eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4b652c
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, ebp
jne 0x4b653a
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp byte [0x4fbaa7], 0
jne 0x4b65ba
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4fdb70]
mov dword [0x4f90ec], 0
cmp eax, dword fs:[0x24]
je 0x4b656c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b6579
mov edx, 1
lea ecx, [edx + 9]
call fcn.004018d0
mov dword [0x4f90ec], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
jne 0x4b659b
mov esi, edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp esi, ebp
je 0x4b65b4
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x4b65b4
test esi, esi
jne 0x4b67ca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test ebp, ebp
je 0x4b6680
push 0
push ebp
call ebx
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x4b6688
cmp dword [0x4fdb70], ebx
je 0x4b665f
mov ecx, dword [0x50010c]
test cl, 1
jne 0x4b6615
push str.IsHungAppWindow
or ecx, 1
push str.user32
mov dword [0x50010c], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov dword [0x500110], eax
jmp 0x4b661a
mov eax, dword [0x500110]
test eax, eax
je 0x4b6623
push ebp
call eax
jmp 0x4b6641
lea eax, [esp + 0x1c]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
jne 0x4b6665
push 1
push ebx
push dword [0x4fdb70]
call esi
test eax, eax
setne byte [esp + 0x12]
jmp 0x4b6665
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4b6688
cmp ebx, eax
je 0x4b6688
push 1
push eax
push ebx
call esi
test eax, eax
setne byte [esp + 0x13]
jmp 0x4b6688
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
xor ebx, ebx
nop word [eax + eax]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4fdb70]
mov dword [0x4f90ec], 0
cmp eax, dword fs:[0x24]
je 0x4b66b9
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b66c6
mov edx, 1
lea ecx, [edx + 9]
call fcn.004018d0
mov dword [0x4f90ec], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
je 0x4b6791
cmp esi, ebp
je 0x4b66f9
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x4b66f9
test esi, esi
jne 0x4b6793
inc ebx
cmp ebx, 5
jl 0x4b6690
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
mov ecx, 2
call fcn.0041c230
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
mov ecx, 2
call fcn.0041c230
add esp, 0x20
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4fdb70]
mov dword [0x4f90ec], 0
cmp eax, dword fs:[0x24]
je 0x4b6759
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b6766
mov edx, 1
lea ecx, [edx + 9]
call fcn.004018d0
mov dword [0x4f90ec], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
je 0x4b6791
cmp esi, ebp
je 0x4b678d
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
je 0x4b6793
xor esi, esi
jmp 0x4b6793
mov esi, edi
cmp byte [esp + 0x12], 0
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x4b67af
push 0
push ebx
push dword [0x4fdb70]
call ebp
cmp byte [esp + 0x13], 0
je 0x4b67bf
push 0
push dword [esp + 0x1c]
push ebx
call ebp
test esi, esi
je 0x4b67d4
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret