Function at 0x47f12f
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xcc
mov eax, dword [ebp + 0x70]
push ebx
push esi
push edi
push dword [eax + 4]
mov dword [ebp + 0x50], edx
mov dword [ebp + 0x54], ecx
call dword [sym.imp.USER32.dll_GetParent]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
push edi
push edi
push 0x1004
push eax
mov dword [ebp + 0x64], eax
call esi
push edi
push edi
push 0x101f
push dword [ebp + 0x64]
mov dword [ebp + 0x58], eax
call esi
push edi
push edi
push 0x1200
push eax
call esi
push 0x1e
pop ecx
mov dword [ebp + 0x60], eax
dec eax
cmp ecx, eax
push 0x80
lea eax, [ebp - 0x64]
sbb bl, bl
push edi
push eax
inc bl
call fcn.005251f0
add esp, 0xc
test bl, bl
je 0x47f208
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0x60]
push 0x103b
push dword [ebp + 0x64]
call esi
test eax, eax
je 0x47f208
mov ebx, dword [ebp + 0x78]
xor eax, eax
cmp dword [ebp + 0x60], edi
mov dword [ebp + 0x5c], eax
jle 0x47f226
cmp ebx, dword [ebp + eax*4 - 0x64]
je 0x47f1d3
inc eax
cmp eax, dword [ebp + 0x60]
mov dword [ebp + 0x5c], eax
jl 0x47f1c2
jmp 0x47f226
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x47f1f6
mov ebx, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x5c]
lea eax, [ebx - 1]
cmp ecx, eax
jge 0x47f1f3
mov ebx, dword [ebp + ecx*4 - 0x60]
jmp 0x47f226
inc ebx
jmp 0x47f226
mov eax, dword [ebp + 0x5c]
cmp eax, edi
jle 0x47f203
mov ebx, dword [ebp + eax*4 - 0x68]
jmp 0x47f226
or ebx, 0xffffffff
jmp 0x47f226
push 0x10
mov dword [ebp + 0x5c], 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x47f220
or dword [ebp + 0x5c], 0xffffffff
mov ebx, dword [ebp + 0x78]
add ebx, dword [ebp + 0x5c]
cmp ebx, edi
jge 0x47f23f
cmp dword [ebp + 0x7c], edi
jle 0x47f312
mov eax, dword [ebp + 0x60]
dec dword [ebp + 0x7c]
mov ebx, dword [ebp + eax*4 - 0x68]
jmp 0x47f2ac
cmp ebx, dword [ebp + 0x60]
jle 0x47f2ac
mov eax, dword [ebp + 0x58]
dec eax
cmp dword [ebp + 0x7c], eax
jge 0x47f252
inc dword [ebp + 0x7c]
jmp 0x47f2a9
push edi
push edi
push 0x1037
push dword [ebp + 0x64]
call esi
test al, 1
je 0x47f312
push edi
push edi
push 0x1004
push dword [ebp + 0x64]
mov dword [ebp + 0x1c], 0xd
call esi
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x3c], eax
lea eax, [ebp + 0x1c]
push eax
push edi
push 0x104d
push dword [ebp + 0x64]
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x28], edi
mov dword [ebp + 0x2c], edi
mov dword [ebp + 0x30], 0x53ec98
call esi
mov ecx, dword [ebp + 0x70]
mov edx, dword [ecx]
push eax
mov dword [ebp + 0x7c], eax
call dword [edx]
mov ebx, dword [ebp - 0x64]
mov edx, dword [ebp + 0x7c]
cmp edx, dword [ebp + 0x58]
mov eax, dword [ebp + 0x70]
jne 0x47f2bc
cmp ebx, dword [eax + 0x21]
jge 0x47f312
mov ecx, dword [eax + 0x1d]
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, 4
je 0x47f301
cmp ecx, edi
je 0x47f301
mov eax, dword [eax + 4]
cmp eax, edi
je 0x47f2e0
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp + 0x70]
mov dword [eax + 4], edi
push 1
push dword [ebp + 0x7c]
push 0x1013
push dword [ebp + 0x64]
call esi
mov ecx, dword [ebp + 0x70]
push edi
push ebx
push dword [ebp + 0x7c]
push dword [ebp + 0x64]
call fcn.0047fe06
jmp 0x47f312
mov ecx, dword [ebp + 0x54]
push edx
mov edx, dword [ebp + 0x50]
push ebx
push dword [ebp + 0x74]
push eax
call fcn.0047f12f
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10