Function at 0x4a3bd0
Capabilities:
Check for foreground window switch
Log keystrokes

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4a3e64
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push esi
call ebx
mov dword [esp + 0x18], eax
cmp eax, dword [0x4cc810]
je 0x4a3c07
mov ecx, esi
call fcn.004a4f30
test al, al
jne 0x4a3e64
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
push esi
mov ebp, eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4a3c25
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, ebp
jne 0x4a3c33
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp byte [0x4cb0ac], 0
jne 0x4a3ca9
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4cc810]
mov dword [0x4c801c], 0
cmp eax, dword fs:[0x24]
je 0x4a3c65
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4a3c72
mov edx, 1
lea ecx, [edx + 9]
call fcn.00401730
mov dword [0x4c801c], 1
call edi
mov edi, eax
cmp edi, esi
jne 0x4a3c90
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp edi, ebp
je 0x4a3ca9
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
cmp esi, eax
jne 0x4a3ca9
test edi, edi
jne 0x4a3e5a
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test ebp, ebp
je 0x4a3d14
push 0
push ebp
call ebx
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x4a3d1c
cmp dword [0x4cc810], edi
je 0x4a3cf3
mov ecx, ebp
call fcn.004a4f30
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
test al, al
jne 0x4a3cf9
push 1
push edi
push dword [0x4cc810]
call ebx
test eax, eax
setne byte [esp + 0x12]
jmp 0x4a3cf9
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4a3d1c
cmp edi, eax
je 0x4a3d1c
push 1
push eax
push edi
call ebx
test eax, eax
setne byte [esp + 0x13]
jmp 0x4a3d1c
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
xor ebx, ebx
nop
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4cc810]
mov dword [0x4c801c], 0
cmp eax, dword fs:[0x24]
je 0x4a3d49
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4a3d56
mov edx, 1
lea ecx, [edx + 9]
call fcn.00401730
mov dword [0x4c801c], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
cmp edi, esi
je 0x4a3e21
cmp edi, ebp
je 0x4a3d89
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
cmp esi, eax
jne 0x4a3d89
test edi, edi
jne 0x4a3e23
inc ebx
cmp ebx, 5
jl 0x4a3d20
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
mov ecx, 2
call fcn.00412a10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
mov ecx, 2
call fcn.00412a10
add esp, 0x20
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4cc810]
mov dword [0x4c801c], 0
cmp eax, dword fs:[0x24]
je 0x4a3de9
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4a3df6
mov edx, 1
lea ecx, [edx + 9]
call fcn.00401730
mov dword [0x4c801c], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
cmp edi, esi
je 0x4a3e21
cmp edi, ebp
je 0x4a3e1d
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
cmp esi, eax
je 0x4a3e23
xor edi, edi
jmp 0x4a3e23
mov edi, esi
cmp byte [esp + 0x12], 0
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x4a3e3f
push 0
push ebx
push dword [0x4cc810]
call ebp
cmp byte [esp + 0x13], 0
je 0x4a3e4f
push 0
push dword [esp + 0x1c]
push ebx
call ebp
test edi, edi
je 0x4a3e64
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret