Function at 0x4f03e0
Capabilities:
Check for foreground window switch
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
call fcn.004058a4
lea eax, [ebp - 0x58]
mov edx, dword [0x4e2d0c]
call fcn.004058c4
xor eax, eax
push ebp
push 0x4f09a1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x4f043b
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004f02e4
jmp 0x4f0963
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ee5cc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4f0963
mov byte [ebp - 0x1d], 0
cmp dword [ebp + 0x14], 0
jge 0x4f047c
mov eax, dword [ebp + 0x14]
cdq
xor eax, edx
sub eax, edx
jno 0x4f0475
call fcn.00403a60
mov dword [ebp + 0x14], eax
mov byte [ebp - 0x1d], 1
cmp dword [ebp + 0xc], 0
je 0x4f04fa
mov dword [ebp - 0x2c], 0x20000
cmp dword [ebp + 0xc], 2
jne 0x4f0496
mov dword [ebp - 0x2c], 0x20200
cmp dword [ebp + 0x14], 0
jge 0x4f04a1
xor eax, eax
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x10], 0
je 0x4f04ae
mov dword [ebp + 0x10], 1
add dword [ebp + 0x10], 1
jno 0x4f04b9
call fcn.00403a60
cmp dword [ebp + 0x14], 0
jne 0x4f04d0
mov eax, dword [0x5892f4]
mov eax, dword [eax]
xor ecx, ecx
mov edx, dword [ebp - 0x30]
call fcn.005805a8
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
add eax, 0x1d50
push eax
push 0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00506e3c
jmp 0x4f0963
push 4
call sub.kernel32.dll_Sleep_1
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.005463e4
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004fdbe8
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_IsIconic
test eax, eax
jne 0x4f0538
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x4f0540
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 0x28], eax
push 0
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x24]
jne 0x4f059d
cmp dword [ebp + 0x14], 0
jle 0x4f058a
mov eax, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
mov al, byte [ebp - 0x1d]
push eax
mov ecx, 0x20000
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004ef6c8
mov dword [ebp - 0x34], eax
jmp 0x4f05f7
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetFocus
mov dword [ebp - 0x34], eax
jmp 0x4f05f7
cmp dword [ebp + 0x14], 0
jle 0x4f05c4
mov eax, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
mov al, byte [ebp - 0x1d]
push eax
mov ecx, 0x20000
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004ef6c8
mov dword [ebp - 0x34], eax
jmp 0x4f05f7
push 0xffffffffffffffff
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x4f05f7
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetFocus
mov dword [ebp - 0x34], eax
push 0
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_AttachThreadInput
cmp dword [ebp - 0x38], 0
je 0x4f060e
mov eax, dword [0x5892f4]
mov eax, dword [eax]
xor ecx, ecx
mov edx, dword [ebp - 0x38]
call fcn.005805a8
cmp dword [ebp - 0x34], 0
je 0x4f0963
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.004eb784
mov edx, dword [ebp - 0x18]
mov eax, 0x4f09b4
call fcn.00405810
test eax, eax
jle 0x4f06cc
push 0
lea eax, [ebp - 0x5c]
push eax
mov ecx, 0x4f09d4
mov edx, 0x4f09dc
mov eax, dword [ebp - 0xc]
call fcn.004ad270
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0xc]
call fcn.00405358
push 0
lea eax, [ebp - 0x60]
push eax
mov ecx, 0x4f09d4
mov edx, 0x4f09e4
mov eax, dword [ebp - 0xc]
call fcn.004ad270
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 0xc]
call fcn.00405358
push 0
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x4f09d4
mov edx, 0x4f09ec
mov eax, dword [ebp - 0xc]
call fcn.004ad270
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0xc]
call fcn.00405358
mov dword [ebp + 0x10], 2
push 0x60006
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.004f1120
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.005463e4
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.005463e4
cmp dword [ebp + 0x10], 2
je 0x4f06f3
cmp dword [ebp + 0x14], 0
jne 0x4f0841
cmp dword [ebp + 0x10], 0
jne 0x4f0841
push 0x14
call sub.kernel32.dll_Sleep_1
mov edx, 0x14
mov eax, dword [ebp - 4]
call fcn.005463e4
cmp byte [ebp + 8], 0
je 0x4f07b3
push 0
push 0
xor ecx, ecx
mov edx, 0x23
mov eax, dword [ebp - 4]
call fcn.004fdffc
push 0xa
call sub.kernel32.dll_Sleep_1
mov edx, 0xa
mov eax, dword [ebp - 4]
call fcn.005463e4
push 0
push 0
mov ecx, 1
mov edx, 0x10
mov eax, dword [ebp - 4]
call fcn.004fdffc
push 0xa
call sub.kernel32.dll_Sleep_1
mov edx, 0xa
mov eax, dword [ebp - 4]
call fcn.005463e4
push 0
push 0
xor ecx, ecx
mov edx, 0x24
mov eax, dword [ebp - 4]
call fcn.004fdffc
push 0xa
call sub.kernel32.dll_Sleep_1
mov edx, 0xa
mov eax, dword [ebp - 4]
call fcn.005463e4
push 0
push 0
mov ecx, 2
mov edx, 0x10
mov eax, dword [ebp - 4]
call fcn.004fdffc
push 0x50
call sub.kernel32.dll_Sleep_1
mov edx, 0x14
mov eax, dword [ebp - 4]
call fcn.005463e4
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4f09f4
mov edx, 0x4f09fc
mov eax, dword [ebp - 0xc]
call fcn.004ad270
mov eax, dword [ebp - 0x1c]
call fcn.004054f0
test eax, eax
jle 0x4f08eb
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], 1
push 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
dec eax
test edx, edx
je 0x4f07f7
cmp eax, dword [edx - 4]
jb 0x4f07fc
call fcn.00403a58
inc eax
movzx eax, word [edx + eax*2 - 2]
push eax
push 0x102
mov eax, dword [ebp - 0x34]
push eax
call sub.user32.dll_PostMessageW
mov eax, dword [ebp - 0x10]
mov ecx, 0xa
cdq
idiv ecx
test edx, edx
jne 0x4f0834
push 0xa
call sub.kernel32.dll_Sleep_1
mov edx, 0xa
mov eax, dword [ebp - 4]
call fcn.005463e4
inc dword [ebp - 0x10]
dec dword [ebp - 0x40]
jne 0x4f07e5
jmp 0x4f08eb
cmp dword [ebp + 0x10], 0
jne 0x4f08bf
push 0
push 0
push 0xe
mov eax, dword [ebp - 0x34]
push eax
call sub.user32.dll_SendMessageW
mov dword [ebp - 0x14], eax
imul eax, dword [ebp - 0x14], 2
jno 0x4f0864
call fcn.00403a60
add eax, 2
jno 0x4f086e
call fcn.00403a60
test eax, eax
jns 0x4f0877
call fcn.00403a58
call fcn.00402dc0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x14]
add eax, 1
jno 0x4f0890
call fcn.00403a60
push eax
push 0xd
mov eax, dword [ebp - 0x34]
push eax
call sub.user32.dll_SendMessageW
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x3c]
call fcn.00405460
mov eax, dword [ebp - 0x3c]
call fcn.00402df4
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.0040555c
jmp 0x4f08ca
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00405358
lea eax, [ebp - 0x2c]
push eax
push 0x3e8
push 2
mov eax, dword [ebp - 0x1c]
call fcn.004054e0
push eax
push 0
push 0xc
mov eax, dword [ebp - 0x34]
push eax
call sub.user32.dll_SendMessageTimeoutW
push 0
push 0xffffffffffffffff
push 0xb9
mov eax, dword [ebp - 0x34]
push eax
call sub.user32.dll_PostMessageA
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 0x30]
jne 0x4f0919
push 0
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004f1244
jmp 0x4f0943
push 0x752f752f
push 0
push 0x201
mov eax, dword [ebp - 0x34]
push eax
call sub.user32.dll_PostMessageA
push 0x752f752f
push 0
push 0x202
mov eax, dword [ebp - 0x34]
push eax
call sub.user32.dll_PostMessageA
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.005463e4
cmp dword [ebp + 0x10], 0
jne 0x4f0963
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.005463e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f09a8
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.0040530c
lea eax, [ebp - 0x58]
mov edx, dword [0x4e2d0c]
call fcn.00405994
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040530c
lea eax, [ebp - 0xc]
call fcn.004052f4
ret