Function at 0x4a5ab0
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
sub esp, 0x5c
push ebp
push esi
mov esi, dword [esp + 0x68]
push esi
call fcn.005827d0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4a5ceb
push ebx
push edi
push esi
call dword [sym.imp.USER32.dll_IsZoomed]
neg eax
sbb eax, eax
neg eax
push esi
mov dword [ebp + 0x784], eax
call fcn.00582c10
add esp, 4
test eax, eax
jne 0x4a5b46
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 6
push esi
call edi
mov eax, dword [0x645340]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
je 0x4a5b19
push 0x10
call ebx
test ah, ah
jns 0x4a5b21
mov eax, dword [0x645340]
test eax, eax
jne 0x4a5b26
push 0x10
call ebx
test ah, ah
jns 0x4a5b26
push 0
push esi
call edi
mov eax, dword [ebp]
push eax
call fcn.005850e0
call fcn.005851c0
push 0
call fcn.005562e0
add esp, 8
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x5c
ret
mov eax, dword [0x60a0fc]
test eax, eax
jne 0x4a5b93
mov eax, dword [0x60a270]
test eax, eax
jne 0x4a5b93
push 0
call fcn.00425170
add esp, 4
push 7
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp]
push ecx
call fcn.005850e0
call fcn.005851c0
push 0
call fcn.005562e0
push edi
call fcn.00425170
add esp, 0xc
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x5c
ret
push 0
call fcn.00425170
mov ebx, dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x78]
add esp, 4
test al, 1
je 0x4a5c13
call fcn.0053b620
test eax, eax
jne 0x4a5c13
call fcn.004a4e20
mov edx, dword [0x645328]
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push 5
push edx
call ebp
cmp eax, esi
jne 0x4a5c13
push 2
push eax
call ebp
mov edi, eax
test edi, edi
je 0x4a5c13
lea ecx, [ecx]
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4a5bf8
push 2
push edi
call ebp
mov edi, eax
test edi, edi
jne 0x4a5be0
jmp 0x4a5c13
test edi, edi
je 0x4a5c13
cmp edi, esi
je 0x4a5c13
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call ebx
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
push eax
mov ebp, 0x2c
push esi
mov dword [esp + 0x48], ebp
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x58]
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x5c]
mov edi, dword [sym.imp.USER32.dll_SetWindowPlacement]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x68]
push ecx
mov ebp, 1
push esi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], 0xffffff9c
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x24], 7
call edi
lea edx, [esp + 0x40]
push edx
push esi
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], 0
call edi
call fcn.005851c0
mov eax, dword [0x645328]
push eax
call ebx
push esi
call ebx
push esi
call fcn.005850e0
call fcn.004a4e20
push 0
call fcn.005562e0
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00425170
add esp, 0xc
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x5c
ret