Function at 0x471200
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
cmp dword [ebp + 0x18], 0
jne 0x471214
xor eax, eax
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov dword [ebp + 0x18], 0
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x471230
mov eax, dword [ecx]
call dword [eax + 0xc8]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
cmp eax, 1
jne 0x4714eb
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov edi, eax
mov dword [ebp - 0x38], 0
mov eax, 2
mov word [ebp - 0x3c], di
mov word [ebp - 0x64], ax
mov ebx, 0xd
movzx eax, word [0x66a2f0]
mov word [ebp - 0x14], ax
movzx eax, word [0x66a2f4]
mov word [ebp - 0x28], ax
mov eax, dword [esi]
push ecx
push esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], edi
mov word [ebp - 0x50], bx
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], edi
call dword [eax + 0x14]
test eax, eax
jne 0x471340
mov ecx, dword [ebp + 0x10]
mov ax, word [0x66a2f0]
push 0
mov word [ecx], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
push ecx
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x4713ad
mov ecx, dword [ebp + 0x10]
mov ax, word [0x66a2f4]
push 0
mov word [ecx], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x471414
mov eax, dword [ebp + 0x10]
push 0
mov word [eax], di
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
lea ecx, [ebp - 0x50]
push ecx
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x47147b
mov eax, dword [ebp + 0x10]
push 0
mov word [eax], bx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
lea ecx, [ebp - 0x64]
push ecx
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x471702
mov eax, dword [ebp + 0x10]
mov ecx, 2
push 0
mov word [eax], cx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
test eax, eax
jne 0x471702
mov edi, dword [ebp + 0x10]
cmp word [edi], ax
jne 0x471702
movzx eax, word [0x66a2f4]
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push eax
call esi
test eax, eax
je 0x47156f
mov ax, word [0x66a2f4]
push 0
mov word [edi], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
movzx eax, word [0x66a2f0]
push eax
call esi
test eax, eax
je 0x4715d9
mov ax, word [0x66a2f0]
push 0
mov word [edi], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 1
call esi
test eax, eax
je 0x47163c
mov eax, 1
push 0
mov word [edi], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0xd
call esi
test eax, eax
je 0x47169f
mov eax, 0xd
push 0
mov word [edi], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 2
call esi
test eax, eax
je 0x471702
mov eax, 2
push 0
mov word [edi], ax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x18