Function at 0x465ef8
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 8], edx
mov eax, dword [0x54e398]
cmp edi, eax
jne 0x465f1d
push eax
call fcn.0044a2c7
push edi
call fcn.00516145
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x466687
cmp dword [ebp + 0xc], 2
jne 0x466050
mov edx, dword [ebp - 4]
cmp dword [edx + 0x770], 0
je 0x466680
push 0
push 0
push 0xb0
mov ecx, dword [ebp - 4]
push dword [ecx + 0x758]
call sub.USER32.dll_SendMessageA
mov esi, eax
mov dword [0x571c44], esi
push 0
push 0
push 0xe
mov eax, dword [ebp - 4]
push dword [eax + 0x758]
call sub.USER32.dll_SendMessageA
shr esi, 0x10
and si, 0xffff
movzx edx, si
cmp eax, edx
jg 0x466687
push 0
push 0
push 0xe
mov ecx, dword [ebp - 4]
push dword [ecx + 0x758]
call sub.USER32.dll_SendMessageA
mov ebx, eax
mov dword [0x571c44], ebx
test ebx, ebx
jle 0x466687
push 0xea60
push 0xea60
push 0xb1
mov eax, dword [ebp - 4]
push dword [eax + 0x758]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov edx, dword [ebp - 4]
push dword [edx + 0x758]
call sub.USER32.dll_SendMessageA
push 0x550160
push 0
push 0xc2
mov ecx, dword [ebp - 4]
push dword [ecx + 0x758]
call sub.USER32.dll_SendMessageA
mov eax, dword [ebp - 4]
push dword [eax + 0x758]
call sub.USER32.dll_UpdateWindow
push 0xea60
push 0xea60
push 0xb1
mov edx, dword [ebp - 4]
push dword [edx + 0x758]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov ecx, dword [ebp - 4]
push dword [ecx + 0x758]
call sub.USER32.dll_SendMessageA
mov dword [ebp - 0x10], 2
jmp 0x466687
mov eax, dword [ebp - 4]
cmp dword [eax + 0x770], 0
je 0x4660a5
push 0
push 0
push 0xb0
mov edx, dword [ebp - 4]
push dword [edx + 0x758]
call sub.USER32.dll_SendMessageA
mov dword [0x571c44], eax
push 0
push 0
push 0xe
mov ecx, dword [ebp - 4]
push dword [ecx + 0x758]
call sub.USER32.dll_SendMessageA
mov edx, dword [0x571c44]
shr edx, 0x10
and dx, 0xffff
movzx ecx, dx
cmp eax, ecx
jg 0x466687
push 0
push 0
push 0xe
mov eax, dword [ebp - 4]
push dword [eax + 0x758]
call sub.USER32.dll_SendMessageA
mov ebx, eax
mov dword [0x571c44], ebx
test ebx, ebx
jle 0x466687
add ebx, 0xa
push ebx
call fcn.00545a4c
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x466687
push dword [ebp - 8]
mov eax, dword [0x571c44]
add eax, 5
push eax
push 0xd
mov edx, dword [ebp - 4]
push dword [edx + 0x758]
call sub.USER32.dll_SendMessageA
mov dword [0x571c44], eax
push 0x550164
push 0
push 0xc
mov ecx, dword [ebp - 4]
push dword [ecx + 0x758]
call sub.USER32.dll_SendMessageA
mov eax, dword [ebp - 4]
push dword [eax + 0x758]
call sub.USER32.dll_UpdateWindow
cmp dword [0x571c44], 0
jg 0x466145
cmp dword [ebp + 0xc], 0
je 0x466680
push 0
call fcn.0041c2be
jmp 0x466680
mov edx, dword [ebp - 8]
mov ecx, dword [0x571c44]
mov byte [edx + ecx], 0
cmp dword [0x5558fc], 0
je 0x466181
push dword [0x55b3c8]
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x466687
push dword [0x55b3c8]
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x466687
mov eax, dword [ebp - 4]
cmp dword [eax + 0x770], 0
jne 0x466206
cmp dword [0x550154], 0
je 0x466206
jmp 0x4661ea
push 0x550168
push dword [ebp - 8]
call fcn.005398cc
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4661b6
mov byte [ebx], 0
lea esi, [ebx + 2]
jmp 0x4661d2
push 0x55016c
push dword [ebp - 8]
call fcn.005398cc
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4661f2
mov byte [ebx], 0
lea esi, [ebx + 1]
cmp byte [esi], 0
je 0x4661ea
push esi
call fcn.005395b8
pop ecx
inc eax
push eax
push esi
push ebx
call fcn.005393ec
add esp, 0xc
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x466198
mov edx, dword [ebp - 8]
cmp byte [edx], 0
jne 0x466206
push 0
call fcn.0041c2be
jmp 0x466687
mov eax, dword [ebp - 8]
mov edx, 0x55016f
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x46622a
test cl, cl
je 0x466278
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x46622a
add eax, 2
add edx, 2
test cl, cl
jne 0x46620e
je 0x466278
mov eax, dword [ebp - 8]
mov edx, 0x550172
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x466250
test cl, cl
je 0x466278
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x466250
add eax, 2
add edx, 2
test cl, cl
jne 0x466234
je 0x466278
mov eax, dword [ebp - 8]
mov edx, 0x550177
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x466283
test cl, cl
je 0x466276
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x466283
add eax, 2
add edx, 2
test cl, cl
jne 0x46625a
jne 0x466283
push edi
call fcn.0042066e
jmp 0x466680
mov eax, dword [ebp - 8]
mov edx, 0x55017b
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4662a7
test cl, cl
je 0x466301
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4662a7
add eax, 2
add edx, 2
test cl, cl
jne 0x46628b
je 0x466301
mov eax, dword [ebp - 8]
mov edx, str.___r_n
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4662cd
test cl, cl
je 0x466301
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4662cd
add eax, 2
add edx, 2
test cl, cl
jne 0x4662b1
je 0x466301
mov eax, dword [ebp - 8]
mov edx, 0x550185
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x466393
test cl, cl
je 0x4662fb
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x466393
add eax, 2
add edx, 2
test cl, cl
jne 0x4662d7
jne 0x466393
cmp dword [0x550148], 0
jne 0x466316
push 0
call fcn.0041c2be
jmp 0x466687
push 0x55018a
push dword [0x550148]
call fcn.005398cc
add esp, 8
mov esi, eax
test esi, esi
je 0x466332
mov byte [esi], 0
push dword [0x550148]
push 0
push 0xc
mov eax, dword [ebp - 4]
push dword [eax + 0x758]
call sub.USER32.dll_SendMessageA
push dword [0x550148]
call fcn.005395b8
pop ecx
push eax
push dword [0x550148]
call fcn.005395b8
pop ecx
push eax
push 0xb1
mov edx, dword [ebp - 4]
push dword [edx + 0x758]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov ecx, dword [ebp - 4]
push dword [ecx + 0x758]
call sub.USER32.dll_SendMessageA
jmp 0x466680
mov eax, dword [0x55a4e8]
test eax, eax
je 0x4663ba
mov dword [0x571c40], eax
jmp 0x4663b1
xor edx, edx
mov dword [eax + 0x1c], edx
mov ecx, dword [eax + 0x34]
mov dword [0x571c40], ecx
mov eax, dword [0x571c40]
test eax, eax
jne 0x4663a3
xor edx, edx
mov dword [0x550150], edx
mov ecx, dword [ebp - 8]
mov al, byte [ecx]
cmp al, 0x2f
je 0x4663fc
cmp al, byte [0x557958]
je 0x4663fc
push edi
call fcn.00427798
mov dword [0x571c3c], eax
mov eax, dword [0x571c3c]
test eax, eax
je 0x4663fc
cmp dword [eax + 0x51c], 3
je 0x4663fc
push 0
call fcn.0041c2be
jmp 0x466687
xor edx, edx
mov dword [0x55015c], edx
xor ecx, ecx
mov dword [0x550158], ecx
push 0xd
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x466430
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x466450
mov dword [0x550158], 1
jmp 0x466450
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x466446
mov dword [0x550158], 1
mov dword [0x55015c], 1
mov ebx, dword [ebp - 8]
jmp 0x4665fd
push 0x55018e
push ebx
call fcn.005398cc
add esp, 8
mov esi, eax
test esi, esi
je 0x466474
mov byte [esi], 0
add esi, 2
jmp 0x46648c
push 0x550192
push ebx
call fcn.005398cc
add esp, 8
mov esi, eax
test esi, esi
je 0x46648c
mov byte [esi], 0
inc esi
push ebx
call fcn.005395b8
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4665f7
cmp dword [ebp - 0xc], 0x3b5
jle 0x4664b0
mov dword [ebp - 0xc], 0x3b5
mov eax, dword [ebp - 0xc]
mov dl, byte [ebx + eax]
mov byte [0x571c48], dl
mov ecx, dword [ebp - 0xc]
mov byte [ebx + ecx], 0
push esi
push edi
mov esi, 0x571c7c
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, dword [ebp - 0xc]
mov dl, byte [0x571c48]
mov byte [ebx + eax], dl
mov eax, dword [0x550148]
test eax, eax
je 0x466507
push eax
call fcn.00545938
pop ecx
push 0x571c7c
call fcn.005395b8
pop ecx
add eax, 0xa
push eax
call fcn.00545a4c
pop ecx
mov ebx, eax
mov dword [0x550148], ebx
test ebx, ebx
je 0x466550
push esi
push edi
mov esi, ebx
mov edi, 0x571c7c
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x571c7c
push edi
call fcn.00420553
mov ebx, 1
cmp dword [0x558a48], 0
je 0x46659d
mov eax, dword [0x55014c]
mov dword [ebp - 0x14], eax
mov dword [0x55014c], edi
xor edx, edx
mov dword [0x558f34], edx
push 0
push 0x1d
push 0x550195
push 0
call fcn.004efac0
test eax, eax
jne 0x466595
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [0x55014c], eax
push edi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4665b3
push dword [ebp - 4]
call fcn.00514157
test eax, eax
jne 0x4665ba
xor edi, edi
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4665f3
test edi, edi
je 0x4665f3
cmp dword [0x550158], 0
je 0x4665e0
push 0
push 0
push 3
push 0
push 0x571c7c
push edi
call fcn.0049bc6c
jmp 0x4665f3
push 0
push 0
push 0
push 0
push 0x571c7c
push edi
call fcn.0049bc6c
test edi, edi
je 0x466606
test esi, esi
je 0x466606
mov ebx, esi
cmp byte [ebx], 0
jne 0x466458
push dword [ebp - 4]
call fcn.00514157
test eax, eax
je 0x466680
mov eax, dword [ebp - 4]
cmp dword [eax + 0x758], 0
je 0x466680
mov edx, dword [ebp - 4]
cmp byte [edx + 0x974], 0
je 0x466680
mov ebx, dword [ebp - 4]
add ebx, 0x974
push ebx
push 0
push 0xc
mov eax, dword [ebp - 4]
push dword [eax + 0x758]
call sub.USER32.dll_SendMessageA
push ebx
call fcn.005395b8
pop ecx
push eax
push ebx
call fcn.005395b8
pop ecx
push eax
push 0xb1
mov edx, dword [ebp - 4]
push dword [edx + 0x758]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov ecx, dword [ebp - 4]
push dword [ecx + 0x758]
call sub.USER32.dll_SendMessageA
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x466696
push dword [ebp - 8]
call fcn.00545938
pop ecx
xor eax, eax
mov dword [0x550158], eax
xor edx, edx
mov dword [0x55015c], edx
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8