Function at 0x37191f92
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x281c
call fcn.3719c800
mov ax, word [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp ax, 0x7500
push edi
mov dword [ebp - 4], esi
jne 0x37191fb5
push 0xfffffffffffffffd
jmp 0x37191ffe
cmp ax, 0x7501
jne 0x37191fc8
push 0
lea eax, [esi + 0xa68]
jmp 0x371924a1
cmp ax, 0x7502
jne 0x37191fd2
push 0xffffffffffffffff
jmp 0x37191ffe
movzx eax, ax
sub eax, 0x7503
js 0x371924a9
movzx ecx, word [esi + 0xe74]
cmp eax, ecx
jge 0x371924a9
mov eax, dword [esi + eax*4 + 0xe78]
cmp dword [eax], 4
jne 0x3719200a
push dword [eax + 8]
mov ecx, esi
call fcn.37193dba
jmp 0x371924a9
mov ecx, eax
xor edi, edi
cmp ecx, edi
mov dword [ebp - 0x14], ecx
je 0x371924a9
cmp dword [ecx + 0x108], edi
lea eax, [ecx + 0x108]
jle 0x37192046
mov ax, word [eax]
push eax
lea eax, [esi + 0x26c]
push eax
call fcn.37197146
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp - 0x14], eax
je 0x371924a9
mov ecx, eax
mov eax, dword [ecx]
cmp eax, 3
jne 0x37192065
mov eax, dword [ecx + 0x104]
movzx ecx, word [eax + 0x800]
mov dword [ebp + 8], ecx
lea ebx, [eax + 0x802]
jmp 0x37192084
cmp eax, 6
jne 0x371924a9
mov eax, dword [ecx + 0x104]
movzx ecx, word [eax + 0xc00]
mov dword [ebp + 8], ecx
lea ebx, [eax + 0xc02]
push 0x1000
lea eax, [ebp - 0x141c]
push edi
push eax
mov dword [ebp - 8], 1
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 0
mov dword [ebp - 0x18], edi
mov edi, 0x400
jle 0x371921ac
lea eax, [ebp - 0x141c]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
push eax
lea eax, [esi + 0x26c]
push eax
call fcn.37197146
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x371924a9
push edi
lea eax, [ebp - 0x41c]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebx]
add esp, 0xc
dec eax
je 0x371922c6
dec eax
je 0x37192293
sub eax, 3
jne 0x3719216d
mov eax, dword [ebx + 8]
mov eax, dword [esi + eax*4 + 0x178]
test eax, eax
je 0x3719211a
add eax, 0xfffffffc
mov dword [ebp - 0x1c], eax
jmp 0x37192121
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x3719216d
lea esi, [eax + 4]
lea eax, [ebp - 0x41c]
push edi
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x41c]
push eax
call fcn.37197f08
test eax, eax
pop ecx
jle 0x3719216a
add ebx, 0x8d
lea eax, [ebp - 0x41c]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x37192224
and dword [ebp - 8], eax
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x41c]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jne 0x37192181
and dword [ebp - 8], eax
push edi
lea eax, [ebp - 0x41c]
push dword [ebp - 0x10]
push 0xffffffffffffffff
push eax
call fcn.371954e7
add dword [ebp - 0xc], 2
add dword [ebp - 0x10], edi
add esp, 0x10
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 8]
jl 0x371920be
mov eax, dword [ebp - 0x14]
mov ax, word [eax + 0x100]
push eax
lea eax, [esi + 0x26c]
push eax
call fcn.37197146
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x371924a9
mov eax, dword [ebx]
dec eax
dec eax
je 0x3719235c
dec eax
je 0x37192332
sub eax, 3
jne 0x371924a9
cmp dword [ebp - 8], 0
jne 0x3719232a
mov eax, dword [ebx + 0x104]
lea edi, [ebx + 0x104]
mov esi, 0x800
add eax, esi
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x37192327
mov eax, dword [edi]
push 0
add eax, esi
mov ecx, dword [ebp - 4]
push eax
jmp 0x371924a4
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x41c]
push 0xffffffffffffffff
push eax
call fcn.37191212
cmp eax, 0xffffffff
jne 0x3719216a
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
push eax
push esi
call fcn.3719bea9
add esp, 0xc
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x14f
push dword [esi]
call ebx
lea eax, [ebp - 0x41c]
push eax
push 0
push 0x143
push dword [esi]
call ebx
test eax, eax
jl 0x3719216a
push 0
push eax
push 0x14e
push dword [esi]
call ebx
jmp 0x3719216a
mov eax, dword [ebx + 8]
mov eax, dword [esi + eax*4 + 0x178]
test eax, eax
je 0x371922a6
add eax, 0xfffffffc
jmp 0x371922a8
xor eax, eax
test eax, eax
je 0x3719216d
push dword [eax + 0x28]
lea eax, [ebp - 0x41c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x3719216d
mov eax, dword [ebx + 8]
mov eax, dword [esi + eax*4 + 0x178]
test eax, eax
je 0x371922d9
add eax, 0xfffffffc
jmp 0x371922db
xor eax, eax
test eax, eax
je 0x3719216d
lea ecx, [ebp - 0x41c]
push edi
push ecx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x41c]
push eax
call fcn.37197f08
add ebx, 0x8d
lea eax, [ebp - 0x41c]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0xc
test eax, eax
jne 0x3719216d
and dword [ebp - 8], eax
jmp 0x3719216d
mov esi, dword [ebp - 4]
mov ebx, dword [ebx + 0x104]
jmp 0x3719237c
cmp dword [ebp - 8], 0
jne 0x3719232a
mov eax, dword [ebx + 0x104]
lea esi, [ebx + 0x104]
add eax, edi
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x37192327
mov eax, dword [esi]
push 0
add eax, edi
jmp 0x3719221b
mov eax, dword [ebx + 8]
mov eax, dword [esi + eax*4 + 0x178]
test eax, eax
je 0x3719236f
add eax, 0xfffffffc
jmp 0x37192371
xor eax, eax
test eax, eax
je 0x371924a9
mov ebx, dword [eax + 0x28]
test ebx, ebx
je 0x371924a9
push 0x3719f098
push ebx
call fcn.37197f8f
xor edi, edi
pop ecx
cmp dword [ebp + 8], edi
pop ecx
je 0x371923a1
cmp eax, dword [ebp + 8]
jne 0x371924a9
push 0x1400
lea eax, [ebp - 0x281c]
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
sub eax, edi
je 0x3719247e
dec eax
je 0x3719245f
dec eax
je 0x37192439
dec eax
je 0x3719240c
dec eax
jne 0x371924a9
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x141c]
push eax
push ebx
lea eax, [ebp - 0x281c]
push 0x13ff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x1c
jmp 0x3719248d
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x141c]
push eax
push ebx
lea eax, [ebp - 0x281c]
push 0x13ff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x18
jmp 0x3719248d
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x141c]
push eax
push ebx
lea eax, [ebp - 0x281c]
push 0x13ff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
jmp 0x3719248d
lea eax, [ebp - 0x141c]
push eax
push ebx
lea eax, [ebp - 0x281c]
push 0x13ff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
jmp 0x3719248d
lea eax, [ebp - 0x281c]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x4000
push eax
lea eax, [ebp - 0x281c]
push eax
mov ecx, esi
call fcn.37192869
pop edi
pop esi
pop ebx
leave
ret 4