Function at 0x4859a0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, ecx
mov byte [esp + 0xb], dl
test edi, edi
je 0x485cf4
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edi
call ebx
mov dword [esp + 0x10], eax
cmp eax, dword [0x4e8f18]
je 0x485a30
mov ecx, dword [0x4ea0fc]
test cl, 1
jne 0x4859fc
push 0x4db778
or ecx, 1
push 0x4d3a20
mov dword [0x4ea0fc], ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4ea100], eax
jmp 0x485a01
mov eax, dword [0x4ea100]
test eax, eax
je 0x485a0a
push edi
call eax
jmp 0x485a28
lea eax, [esp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x485cf4
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call esi
push edi
mov ebp, eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x485a57
cmp byte [esp + 0x13], 0
jne 0x485a57
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, ebp
jne 0x485a65
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
add esp, 0x10
ret
cmp byte [0x4e7eee], 0
jne 0x485ac3
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x4e37f0], 0
lea ecx, [edx + 9]
call fcn.004015e0
mov dword [0x4e37f0], 1
call esi
mov esi, eax
cmp esi, edi
jne 0x485aaa
mov esi, edi
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x10
ret
cmp esi, ebp
je 0x485ac3
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x485ac3
test esi, esi
jne 0x485cea
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
test ebp, ebp
je 0x485b8d
push 0
push ebp
call ebx
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x485b95
cmp dword [0x4e8f18], esi
je 0x485b6c
mov ecx, dword [0x4ea0fc]
test cl, 1
jne 0x485b22
push 0x4db778
or ecx, 1
push 0x4d3a20
mov dword [0x4ea0fc], ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4ea100], eax
jmp 0x485b27
mov eax, dword [0x4ea100]
test eax, eax
je 0x485b30
push ebp
call eax
jmp 0x485b4e
lea eax, [esp + 0x1c]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
jne 0x485b72
push 1
push esi
push dword [0x4e8f18]
call ebx
test eax, eax
setne byte [esp + 0x11]
jmp 0x485b72
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x485b95
cmp esi, eax
je 0x485b95
push 1
push eax
push esi
call ebx
test eax, eax
setne byte [esp + 0x12]
jmp 0x485b95
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
xor ebx, ebx
nop word [eax + eax]
movzx eax, byte [0x4e7eee]
cmp ebx, eax
jne 0x485bd5
cmp byte [0x4e9fa2], 0
jne 0x485bd5
push 0xffc3d450
push 0
push 0
push 0
mov dl, 0x12
mov byte [0x4e9fa2], 1
mov ecx, 1
call fcn.00419a70
add esp, 0x10
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x4e37f0], 0
lea ecx, [edx + 9]
call fcn.004015e0
mov dword [0x4e37f0], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
je 0x485caa
cmp esi, ebp
je 0x485c26
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x485c26
test esi, esi
jne 0x485cac
inc ebx
cmp ebx, 5
jl 0x485ba0
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
mov ecx, 2
call fcn.00419a70
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
mov ecx, 2
call fcn.00419a70
add esp, 0x20
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x4e37f0], 0
lea ecx, [edx + 9]
call fcn.004015e0
mov dword [0x4e37f0], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, edi
je 0x485caa
cmp esi, ebp
je 0x485ca6
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
je 0x485cac
xor esi, esi
jmp 0x485cac
mov esi, edi
cmp byte [esp + 0x11], 0
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x485cc8
push 0
push ebx
push dword [0x4e8f18]
call ebp
cmp byte [esp + 0x12], 0
je 0x485cd8
push 0
push dword [esp + 0x1c]
push ebx
call ebp
test esi, esi
je 0x485cea
cmp byte [esp + 0x13], 0
jne 0x485cea
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x10
ret
pop edi
xor eax, eax
pop ebx
add esp, 0x10
ret