Function at 0x548eb8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor ecx, ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.00405a20
xor eax, eax
push ebp
push 0x549159
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0x549168
mov eax, dword [ebp - 4]
add eax, 8
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00412214
add esp, 0xc
lea eax, [ebp - 0x3c]
call fcn.004139fc
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 0x28], eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0x24], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x548f66
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetFocus
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_AttachThreadInput
cmp dword [ebp - 0x18], 0
je 0x549123
mov eax, dword [0x5504b0]
cmp byte [eax], 0
je 0x548fe5
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x549174
mov edx, 0x54917c
mov eax, dword [ebp - 8]
call fcn.004af72c
mov eax, dword [ebp - 0x20]
call fcn.0040566c
test eax, eax
jle 0x54911f
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 1
push 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x20]
dec eax
test edx, edx
je 0x548fbe
cmp eax, dword [edx - 4]
jb 0x548fc3
call fcn.00403be4
inc eax
movzx eax, word [edx + eax*2 - 2]
push eax
push 0x102
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_PostMessageW
inc dword [ebp - 0x10]
dec dword [ebp - 0x2c]
jne 0x548fac
jmp 0x54911f
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404efc
push 0
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x54918c
mov edx, 0x549198
mov eax, dword [ebp - 0x1c]
call fcn.004af6e0
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x1c]
call fcn.00404cf0
mov dword [ebp - 0x10], 1
jmp 0x549104
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call fcn.0040f1c0
cmp al, 1
jne 0x5490a6
push 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
dec eax
test edx, edx
je 0x549040
cmp eax, dword [edx - 4]
jb 0x549045
call fcn.00403be4
inc eax
movzx eax, byte [edx + eax - 1]
mov edx, pe_nt_image_headers32
mul edx
jno 0x549059
call fcn.00403bec
mov edx, dword [ebp - 0x10]
add edx, 1
jno 0x549066
call fcn.00403bec
mov ecx, dword [ebp - 0x1c]
dec edx
test ecx, ecx
je 0x549073
cmp edx, dword [ecx - 4]
jb 0x549078
call fcn.00403be4
inc edx
movzx edx, byte [ecx + edx - 1]
add eax, edx
jno 0x549087
call fcn.00403bec
movzx eax, ax
push eax
push 0x286
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_PostMessageA
add dword [ebp - 0x10], 1
jno 0x5490a4
call fcn.00403bec
jmp 0x5490f9
push 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
dec eax
test edx, edx
je 0x5490b8
cmp eax, dword [edx - 4]
jb 0x5490bd
call fcn.00403be4
inc eax
movzx eax, byte [edx + eax - 1]
push eax
push 0x286
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
dec eax
test edx, edx
je 0x5490e2
cmp eax, dword [edx - 4]
jb 0x5490e7
call fcn.00403be4
inc eax
cmp byte [edx + eax - 1], 0xd
jne 0x5490f9
mov eax, 1
call fcn.0054ad04
add dword [ebp - 0x10], 1
jno 0x549104
call fcn.00403bec
mov eax, dword [ebp - 0x1c]
call fcn.00404f34
cmp eax, dword [ebp - 0x10]
jge 0x54901f
mov eax, 1
call fcn.0054ad04
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549160
lea eax, [ebp - 0x40]
call fcn.00404c58
lea eax, [ebp - 0x3c]
call fcn.0041220c
lea eax, [ebp - 0x20]
call fcn.00405480
lea eax, [ebp - 0x1c]
call fcn.00404c58
lea eax, [ebp - 8]
call fcn.00405480
ret