Function at 0x4e8570
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e820
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
lea esi, [edi + 0x2c]
mov dword [edi + 0x48], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x40], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0xc], 0
mov eax, dword [edi + 0x1ac]
push 1
push eax
mov ecx, esi
call fcn.00511140
push 0x2711
lea ecx, [ebp - 0x24]
push ecx
mov ecx, 0x55a400
call fcn.00467b90
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
mov ecx, eax
test eax, eax
jne 0x4e85eb
mov ecx, 0x538640
mov eax, dword [esi + 4]
test eax, eax
je 0x4e8619
test ecx, ecx
je 0x4e8619
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
test eax, eax
jne 0x4e8625
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x4e8625
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov dword [eax + esi], 0x57
push 0x8100
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x55a400
call fcn.00467b90
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004fce50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4e8658
push eax
call fcn.005134a7
add esp, 4
lea esi, [edi + 0x13c]
mov dword [ebp - 0x18], esi
test ebx, ebx
je 0x4e869b
push 0x3e9
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4e8687
push 0x3e9
push ebx
mov edi, eax
call fcn.0042dc20
mov edi, dword [ebp - 0x10]
jmp 0x4e86ab
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 4]
lea esi, [edx + esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x4e86ab
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea esi, [ecx + esi + 0x10]
mov dword [esi], 0x57
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x4e86b7
mov ecx, 0x538640
mov eax, dword [edi + 0x150]
lea esi, [edi + 0x14c]
test eax, eax
je 0x4e86ee
test ecx, ecx
je 0x4e86ee
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
test eax, eax
jne 0x4e86fa
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x4e86fa
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov dword [eax + esi], 0x57
push 0x80ed
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x55a400
call fcn.00467b90
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004fce50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4e872d
push eax
call fcn.005134a7
add esp, 4
lea esi, [edi + 0x160]
test ebx, ebx
je 0x4e876d
push 0x3ea
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4e8759
push 0x3ea
push ebx
mov edi, eax
call fcn.0042dc20
mov edi, dword [ebp - 0x10]
jmp 0x4e877d
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 4]
lea esi, [edx + esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x4e877d
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea esi, [ecx + esi + 0x10]
mov dword [esi], 0x57
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x4e8789
mov ecx, 0x538640
mov eax, dword [edi + 0x174]
lea esi, [edi + 0x170]
test eax, eax
je 0x4e87c0
test ecx, ecx
je 0x4e87c0
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
test eax, eax
jne 0x4e87cc
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x4e87cc
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov dword [eax + esi], 0x57
cmp dword [edi + 0x1b0], 0
jne 0x4e886c
push 0x4e3b
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x55a400
call fcn.00467b90
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.004fce50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4e880c
push eax
call fcn.005134a7
add esp, 4
lea esi, [edi + 0xd0]
test ebx, ebx
je 0x4e8849
push 0x1771
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4e8835
push 0x1771
push ebx
mov edi, eax
call fcn.0042dc20
jmp 0x4e8859
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 4]
lea edi, [edx + esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x4e8859
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx + esi + 0x10]
mov dword [eax], 0x57
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x4e8865
mov ecx, 0x538640
mov eax, esi
call fcn.00402f90
mov esi, dword [ebp - 0x10]
mov edi, dword [0x55a3f8]
mov ecx, dword [ebp + 8]
push 1
push 0x1389
add esi, 0x50
push edi
mov ebx, 1
mov edx, esi
call fcn.004a5050
test al, al
je 0x4e88aa
mov ebx, 0xc351
mov eax, esi
call fcn.004a5210
test al, al
je 0x4e88aa
mov edx, esi
call fcn.004a5280
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
push 1
push 0x138a
add esi, 0x90
push edi
mov ebx, 1
mov edx, esi
call fcn.004a5050
test al, al
je 0x4e88e5
mov ebx, 0xc352
mov eax, esi
call fcn.004a5210
test al, al
je 0x4e88e5
mov edx, esi
call fcn.004a5280
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
push edx
mov edx, 0x9c6
add esi, 0x184
lea ecx, [edx - 1]
mov edi, 2
call fcn.004b4d90
push 0x9c5
mov ebx, esi
call fcn.004b4f90
push 0x9c6
call fcn.004b4f90
push 0x4e3c
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x55a400
call fcn.00467b90
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.004fce50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4e894d
push eax
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x4e8959
mov ecx, 0x538640
mov eax, 0x9c5
mov ebx, esi
call fcn.004b5130
push 0x4e3e
lea ecx, [ebp - 0x30]
push ecx
mov ecx, 0x55a400
call fcn.00467b90
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.004fce50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4e8998
push eax
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x4e89a4
mov ecx, 0x538640
mov eax, 0x9c6
mov ebx, esi
call fcn.004b5130
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 0x1b0]
test eax, eax
jne 0x4e89f2
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4e89d9
push 0
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov byte [edi + 0x1b4], 0
jmp 0x4e8a14
mov edx, dword [eax + 0x10]
mov ecx, dword [edx + 4]
lea eax, [ecx + eax + 0x10]
mov dword [eax], 6
mov byte [edi + 0x1b4], 0
jmp 0x4e8a14
cmp eax, 1
jne 0x4e89fe
mov eax, 0x9c5
jmp 0x4e8a08
cmp eax, 2
jne 0x4e8a0d
mov eax, 0x9c6
call fcn.004b50d0
mov byte [edi + 0x1b4], 1
push 0x4e3d
lea edx, [ebp - 0x30]
push edx
mov ecx, 0x55a400
call fcn.00467b90
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.004fce50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4e8a47
push eax
call fcn.005134a7
add esp, 4
mov ebx, dword [ebp + 8]
lea esi, [edi + 0xf4]
test ebx, ebx
je 0x4e8a8c
push 0x1772
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4e8a78
push 0x1772
mov ecx, ebx
push ecx
mov edi, eax
call fcn.0042dc20
mov edi, dword [ebp - 0x10]
jmp 0x4e8a9c
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 4]
lea esi, [eax + esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x4e8a9c
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 4]
lea esi, [edx + esi + 0x10]
mov dword [esi], 0x57
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x4e8aa8
mov ecx, 0x538640
mov eax, dword [edi + 0x108]
lea esi, [edi + 0x104]
test eax, eax
je 0x4e8adb
test ecx, ecx
je 0x4e8adb
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
test eax, eax
jne 0x4e8ae7
mov eax, dword [esi]
mov edi, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + esi], eax
mov edi, dword [ebp - 0x10]
jmp 0x4e8ae7
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
mov dword [eax + esi], 0x57
push 0x4e3f
lea edx, [ebp - 0x30]
push edx
mov ecx, 0x55a400
call fcn.00467b90
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.004fce50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4e8b1a
push eax
call fcn.005134a7
add esp, 4
lea esi, [edi + 0x118]
test ebx, ebx
je 0x4e8b60
push 0x1773
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4e8b4c
mov ecx, dword [ebp + 8]
push 0x1773
push ecx
mov edi, eax
call fcn.0042dc20
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
jmp 0x4e8b70
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 4]
lea esi, [eax + esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x4e8b70
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 4]
lea esi, [edx + esi + 0x10]
mov dword [esi], 0x57
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x4e8b7c
mov ecx, 0x538640
mov eax, dword [edi + 0x12c]
lea esi, [edi + 0x128]
test eax, eax
je 0x4e8bac
test ecx, ecx
je 0x4e8bac
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
test eax, eax
jne 0x4e8bb8
mov eax, dword [esi]
mov edi, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + esi], eax
jmp 0x4e8bb8
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
mov dword [eax + esi], 0x57
test ebx, ebx
je 0x4e8bfe
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, ebx
je 0x4e8bfe
lea edx, [ebp - 0x18]
push edx
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov edi, eax
push esi
push edi
call ebx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push esi
push edi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4e8c15
push eax
call fcn.005134a7
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc