Function at 0x76ab20
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], 0
nop
mov rax, qword [rbp + 0x28]
mov eax, dword [rax]
cmp eax, 0x113
jg 0x76abb4
cmp eax, 0x113
je 0x76ad69
cmp eax, 0x83
jg 0x76ab8c
cmp eax, 0x83
je 0x76b120
sub eax, 0xf
test eax, eax
je 0x76acba
sub eax, 5
test eax, eax
je 0x76b06a
sub eax, 0x33
test eax, eax
jne 0x76b24b
jmp 0x76ad0e
sub eax, 0x85
test eax, eax
je 0x76b120
sub eax, 0x7b
test eax, eax
je 0x76adf6
sub eax, 2
test eax, eax
jne 0x76b24b
jmp 0x76b16c
cmp eax, 0x317
jg 0x76abe3
cmp eax, 0x317
je 0x76ac17
sub eax, 0x1e5
test eax, eax
je 0x76ac17
sub eax, 8
test eax, eax
je 0x76adc2
sub eax, 1
test eax, eax
jne 0x76b24b
jmp 0x76ac0a
sub eax, 0x318
test eax, eax
je 0x76b0cb
sub eax, 0x1b1
test eax, eax
jne 0x76b24b
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x60], 1
jmp 0x76b24b
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x62], 1
jmp 0x76b24b
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x1e5
jne 0x76ac88
mov ecx, 1
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x76ac88
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x60], 0
je 0x76ac88
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x61], 0
jne 0x76ac88
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x62], 0
je 0x76ac88
lea rcx, [rbp + 0x38]
call sub.user32.dll_GetCursorPos
mov rcx, qword [rbp + 0x38]
call sub.user32.dll_WindowFromPoint
mov rcx, qword [rbp + 0x20]
cmp rax, qword [rcx + 8]
jne 0x76ac88
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x61], 1
mov rcx, qword [rax + 8]
mov edx, 0x1ed
xor r8, r8
xor r9, r9
call sub.user32.dll_SendMessageW
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x29], 0
je 0x76aca0
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x2a], 0
jne 0x76b24b
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
jmp 0x76b259
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x29], 0
jne 0x76acde
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
jmp 0x76b259
mov rcx, qword [rbp + 0x20]
xor edx, edx
call fcn.006cbdf0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
mov rcx, qword [rbp + 0x20]
mov dl, 1
call fcn.006cbdf0
jmp 0x76b259
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x29], 0
je 0x76ad22
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x2a], 0
jne 0x76ad3c
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
jmp 0x76b259
cmp byte [0x0084b55c], 0
je 0x76b24b
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 8]
mov edx, 0x93
mov r8d, 0xa
xor r9, r9
call sub.user32.dll_SetTimer
jmp 0x76b24b
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x60], 0
je 0x76b24b
mov rax, qword [rbp + 0x28]
cmp qword [rax + 8], 0x93
jne 0x76b24b
mov byte [0x0084b55c], 0
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 8]
mov edx, pe_nt_image_headers64
mov r8d, 0x28
xor r9, r9
call sub.user32.dll_PostMessageW
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 8]
mov edx, 0x93
call sub.user32.dll_KillTimer
jmp 0x76b24b
mov rcx, qword [rbp + 0x20]
mov byte [rcx + 0x61], 1
xor edx, edx
call fcn.006cbdf0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
mov rcx, qword [rbp + 0x20]
mov dl, 1
call fcn.006cbdf0
jmp 0x76b24b
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x29], 0
je 0x76ae0a
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x2a], 0
jne 0x76ae24
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
jmp 0x76b259
mov rax, qword [rbp + 0x20]
mov rcx, rax
mov rdx, qword [rax + 8]
call fcn.0076a0e0
mov rcx, qword [rbp + 0x20]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x20]
mov eax, dword [rax + 0x64]
cmp eax, 0xffffffff
je 0x76ae52
mov rcx, qword [rbp + 0x20]
mov dword [rcx + 0x68], eax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 8]
cmp rax, 0xd
je 0x76ae6c
cmp rax, 0x25
je 0x76ae6c
cmp rax, 0x27
jne 0x76aeb0
mov rax, qword [rbp + 0x20]
mov eax, dword [rax + 0x64]
cmp eax, 0xffffffff
je 0x76ae96
mov rcx, qword [rbp + 0x20]
mov edx, eax
call fcn.0076a170
mov rcx, rax
call fcn.0076bc10
test al, al
je 0x76ae96
mov byte [0x0084b55c], 1
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
jmp 0x76b259
mov rax, qword [rbp + 0x28]
mov eax, dword [rax + 8]
sub eax, 0x26
test eax, eax
je 0x76afab
sub eax, 2
test eax, eax
jne 0x76b050
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x80]
call sub.user32.dll_GetMenuItemCount
sub eax, 1
mov rcx, qword [rbp + 0x20]
cmp dword [rcx + 0x68], eax
jl 0x76aef4
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x68], 0xffffffff
mov rax, qword [rbp + 0x20]
add dword [rax + 0x68], 1
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x80]
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x68]
call fcn.0076aac0
test al, al
je 0x76af68
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x80]
call sub.user32.dll_GetMenuItemCount
mov rcx, qword [rbp + 0x20]
mov ecx, dword [rcx + 0x68]
mov esi, eax
sub esi, 1
mov ebx, ecx
cmp ebx, esi
jg 0x76af67
sub esi, ecx
add esi, 1
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x80]
mov edx, ebx
call fcn.0076aac0
test al, al
jne 0x76af5d
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x68], ebx
jmp 0x76af67
add ebx, 1
sub esi, 1
test esi, esi
jne 0x76af3e
nop
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x78], 1
jne 0x76af7d
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x64], 0xffffffff
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 8]
mov edx, 0x1e5
mov rax, qword [rbp + 0x20]
movsxd r8, dword [rax + 0x68]
xor r9, r9
call sub.user32.dll_SendMessageW
mov rax, qword [rbp + 0x28]
mov qword [rax + 0x18], 0
jmp 0x76b259
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x68], 0
jg 0x76afcc
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x80]
call sub.user32.dll_GetMenuItemCount
mov rcx, qword [rbp + 0x20]
mov dword [rcx + 0x68], eax
mov rax, qword [rbp + 0x20]
sub dword [rax + 0x68], 1
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x80]
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x68]
call fcn.0076aac0
test al, al
je 0x76b022
mov rax, qword [rbp + 0x20]
mov ebx, dword [rax + 0x68]
test ebx, ebx
jl 0x76b021
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x80]
mov edx, ebx
call fcn.0076aac0
test al, al
jne 0x76b019
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x68], ebx
jmp 0x76b021
sub ebx, 1
cmp ebx, 0xffffffff
jne 0x76affa
nop
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 8]
mov edx, 0x1e5
mov rax, qword [rbp + 0x20]
movsxd r8, dword [rax + 0x68]
xor r9, r9
call sub.user32.dll_SendMessageW
mov rax, qword [rbp + 0x28]
mov qword [rax + 0x18], 0
jmp 0x76b259
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
jmp 0x76b259
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x29], 0
je 0x76b07e
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x2a], 0
jne 0x76b098
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
jmp 0x76b259
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 8]
mov edx, 0x317
mov rax, qword [rbp + 0x28]
mov r8, qword [rax + 8]
mov rax, qword [rbp + 0x28]
mov r9, qword [rax + 0x10]
call sub.user32.dll_SendMessageW
mov rax, qword [rbp + 0x28]
mov qword [rax + 0x18], 1
jmp 0x76b259
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x29], 0
je 0x76b0df
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x2a], 0
jne 0x76b0f9
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
jmp 0x76b259
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 8]
mov edx, 0x317
mov rax, qword [rbp + 0x28]
mov r8, qword [rax + 8]
mov rax, qword [rbp + 0x28]
mov r9, qword [rax + 0x10]
call sub.user32.dll_SendMessageW
jmp 0x76b259
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x29], 0
je 0x76b134
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x2a], 0
jne 0x76b14e
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006cb3e0
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x18], rax
jmp 0x76b259
mov rcx, qword [rbp + 0x20]
call fcn.006cbe80
test al, al
jne 0x76b259
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x40], 0
jmp 0x76b259
or esi, 0xffffffff
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x80]
call sub.user32.dll_GetMenuItemCount
xor ecx, ecx
mov edi, eax
sub edi, 1
mov ebx, ecx
cmp ebx, edi
jg 0x76b1fe
sub edi, ecx
add edi, 1
mov rcx, qword [rbp + 0x20]
mov edx, ebx
call fcn.0076a170
mov rcx, rax
lea rdx, [rbp + 0x30]
call fcn.0076b500
mov rcx, qword [rbp + 0x20]
mov edx, ebx
call fcn.0076a170
mov rcx, rax
call fcn.0076bc10
test al, al
je 0x76b1f4
mov rcx, qword [rbp + 0x30]
lea rdx, [0x0076b294]
call fcn.00412300
test eax, eax
je 0x76b1f4
cmp qword [rbp + 0x30], 0
je 0x76b1f4
mov rax, qword [rbp + 0x28]
movzx rcx, word [rax + 8]
mov rdx, qword [rbp + 0x30]
call fcn.007106a0
test al, al
je 0x76b1f4
mov esi, ebx
jmp 0x76b1fe
add ebx, 1
sub edi, 1
test edi, edi
jne 0x76b191
nop
cmp esi, 0xffffffff
je 0x76b24b
mov byte [0x0084b55c], 1
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x61], 1
mov rcx, qword [rax + 8]
mov edx, 0x1e5
movsxd r8, esi
xor r9, r9
call sub.user32.dll_SendMessageW
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x64], 0xffffffff
mov rcx, qword [rax + 8]
mov edx, pe_nt_image_headers64
mov r8d, 0xd
xor r9, r9
call sub.user32.dll_SendMessageW
jmp 0x76b259
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
call fcn.006ccc00
nop
lea rcx, [rbp + 0x30]
call fcn.004107c0
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret