Function at 0x4e246c
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0xd0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rbx, r8
mov ebp, edx
mov rdi, rcx
mov r12d, 0x100
cmp edx, r12d
je 0x4e25aa
cmp rbx, 9
je 0x4e24fd
cmp rbx, 0xd
je 0x4e24bb
mov rax, qword [rsp + 0x110]
and dword [rax], 0
jmp 0x4e250b
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
ja 0x4e24f0
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
ja 0x4e24f0
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
jbe 0x4e250b
mov rax, qword [rsp + 0x110]
and dword [rax], 0
jmp 0x4e250b
mov rax, qword [rsp + 0x110]
mov dword [rax], 1
cmp ebp, 0x102
jne 0x4e25a3
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rdi + 0x270]
jne 0x4e25a3
cmp rbx, 0xd
je 0x4e25a3
cmp rbx, 9
je 0x4e25a3
cmp rbx, 8
je 0x4e25a3
mov rcx, qword [rdi + 0xeb0]
test rcx, rcx
je 0x4e256d
call fcn.005db44c
cmp byte [rax + 0x2e7e], 0
jne 0x4e2565
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x4e2565
lea edx, [rbp - 0x7c]
call fcn.004083bc
jmp 0x4e259b
add rax, 0x1958
jmp 0x4e259b
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x2f06], 0
jne 0x4e2595
mov rcx, qword [rax + 0xb8]
test rcx, rcx
je 0x4e2595
mov edx, 0x86
call fcn.004083bc
jmp 0x4e259b
add rax, 0x19e0
mov rcx, rax
call fcn.0058ee60
xor eax, eax
jmp 0x4e2b29
cmp rbx, 9
jne 0x4e25da
mov rsi, qword [rcx + 0x270]
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, rsi
jne 0x4e25d1
mov rcx, qword [rdi + 0x3d8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x4e25da
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetFocus]
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rdi + 0x270]
je 0x4e25fb
mov rax, qword [rsp + 0x110]
and dword [rax], 0
xor eax, eax
jmp 0x4e2b29
sub rbx, 0xd
je 0x4e2add
sub rbx, 0x14
je 0x4e2aa5
sub rbx, 1
je 0x4e2a68
sub rbx, 1
je 0x4e29ea
sub rbx, 1
je 0x4e289d
sub rbx, 2
je 0x4e2734
cmp rbx, 2
je 0x4e264d
mov rax, qword [rsp + 0x110]
and dword [rax], 0
jmp 0x4e2b27
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x4e2682
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
jne 0x4e2682
mov rax, qword [rsp + 0x110]
and dword [rax], 0
jmp 0x4e2b27
mov r8, qword [rdi + 0xf90]
inc r8
mov rcx, qword [rdi + 0xf30]
sub rcx, qword [rdi + 0xf28]
movabs r9, 0x6666666666666667
mov rax, r9
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r8, rdx
jae 0x4e26e9
mov qword [rdi + 0xf90], r8
lea rax, [r8 + r8*4]
add rax, rax
mov rdx, qword [rdi + 0xf28]
mov rdx, qword [rdx + rax*8 + 0x48]
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x4e2b27
mov rcx, qword [rdi + 0xf30]
sub rcx, qword [rdi + 0xf28]
mov rax, r9
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r8, rdx
jne 0x4e2b27
mov rdx, qword [rdi + 0xf88]
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_SetWindowTextW]
inc qword [rdi + 0xf90]
jmp 0x4e2b27
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x4e2769
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
jne 0x4e2769
mov rax, qword [rsp + 0x110]
and dword [rax], 0
jmp 0x4e2b27
mov r8, qword [rdi + 0xf90]
test r8, r8
je 0x4e2b27
mov rcx, qword [rdi + 0xf30]
sub rcx, qword [rdi + 0xf28]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 5
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
or rsi, 0xffffffffffffffff
cmp r8, rdx
jne 0x4e286a
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
add eax, 2
movsxd rcx, eax
lea eax, [rsi + 3]
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.006a43c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
mov rdx, rbx
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0xf8]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.004023b4
nop
lea rcx, [rdi + 0xf40]
cmp rax, rcx
je 0x4e282d
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
call fcn.00406d38
nop
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
cmp rcx, rax
je 0x4e2862
test rcx, rcx
je 0x4e2862
mov rax, qword [rsp + 0x30]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r12
jbe 0x4e285c
call fcn.006a4944
jmp 0x4e2862
call fcn.006a3610
nop
mov rcx, rbx
call fcn.006a5088
add qword [rdi + 0xf90], rsi
mov rax, qword [rdi + 0xf90]
lea rcx, [rax + rax*4]
add rcx, rcx
mov rdx, qword [rdi + 0xf28]
mov rdx, qword [rdx + rcx*8 + 0x48]
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x4e2b27
mov rax, qword [rdi + 0xf30]
mov esi, 0x8000
cmp qword [rdi + 0xf28], rax
je 0x4e28c2
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
jne 0x4e28d6
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x4e29da
and qword [rdi + 0xf90], 0
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
add eax, 2
movsxd rcx, eax
mov eax, 2
mul rcx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.006a43c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
mov rdx, rbx
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0xf8]
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.004023b4
nop
lea rcx, [rdi + 0xf40]
cmp rax, rcx
je 0x4e2968
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
call fcn.00406d38
nop
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rax
je 0x4e29a5
test rcx, rcx
je 0x4e29a5
mov rax, qword [rsp + 0x80]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r12
jbe 0x4e29a0
call fcn.006a4944
jmp 0x4e29a5
call fcn.006a3610
mov rcx, qword [rdi + 0xf28]
mov rax, qword [rdi + 0xf90]
lea rdx, [rax + rax*4]
add rdx, rdx
mov rdx, qword [rcx + rdx*8 + 0x48]
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_SetWindowTextW]
nop
mov rcx, rbx
call fcn.006a5088
jmp 0x4e2b27
mov rax, qword [rsp + 0x110]
and dword [rax], 0
jmp 0x4e2b27
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x4e2a1f
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
jne 0x4e2a1f
mov rax, qword [rsp + 0x110]
and dword [rax], 0
jmp 0x4e2b27
mov rcx, qword [rdi + 0xf30]
sub rcx, qword [rdi + 0xf28]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rdi + 0xf90], rdx
mov rdx, qword [rdi + 0xf88]
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x4e2b27
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
mov r11w, ax
mov r8d, 0x8000
and r8d, r11d
or r8d, 0x6000
shr r8d, 0xd
xor r9d, r9d
mov edx, 0x115
mov rcx, qword [rdi + 0x3d8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4e2b27
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
mov r11w, ax
mov r8d, 0x8000
and r8d, r11d
bts r8d, 0xe
shr r8d, 0xd
xor r9d, r9d
mov edx, 0x115
mov rcx, qword [rdi + 0x3d8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4e2b27
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x4e2b1c
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
jne 0x4e2b1c
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
jne 0x4e2b1c
mov rcx, rdi
call fcn.004e3154
jmp 0x4e2b27
mov rax, qword [rsp + 0x110]
and dword [rax], 0
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret