Function at 0xf79432d
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov eax, dword [esp + 0xc]
mov ebp, esp
sub esp, 0x21c
cmp word [eax], 0xa
push ebx
push esi
push edi
jne 0xf794350
cmp dword [eax + 8], 0x80020004
mov cx, 0xffff
je 0xf794353
xor cx, cx
mov word [ebp - 0x1c], 1
test cx, cx
je 0xf79442d
mov word [ebp - 2], 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call fcn.0f73651e
cmp word [eax], 8
mov dword [ebp + 8], eax
jne 0xf794473
push dword [eax + 8]
push 0
call fcn.0f789346
mov esi, eax
test esi, esi
jne 0xf794422
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov eax, 0
test ecx, ecx
je 0xf7943a9
mov eax, dword [ecx - 4]
shr eax, 1
push 0
push 0
push 0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push eax
push ecx
push 0
push 0
call esi
mov edi, eax
test edi, edi
jne 0xf79443c
xor ebx, ebx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0xf794418
test ebx, ebx
je 0xf794422
push 0x1ff
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push edi
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.MSVCRT20.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0xf794418
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0xf7943dc
test ebx, ebx
je 0xf794422
push ebx
call fcn.0f726e12
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0xf7944fd
push eax
call fcn.0f7348f7
mov word [ebp - 2], ax
jmp 0xf794368
push edi
call fcn.0f726e61
mov ebx, eax
test ebx, ebx
je 0xf7943c7
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov eax, 0
test ecx, ecx
je 0xf794460
mov eax, dword [ecx - 4]
shr eax, 1
push 0
push 0
push edi
push ebx
push eax
push ecx
push 0
push 0
call esi
jmp 0xf7943c7
push dword [ebp + 8]
call fcn.0f7348b4
mov ebx, eax
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
je 0xf7944c9
lea eax, [ebp - 8]
push eax
push esi
call edi
cmp dword [ebp - 8], ebx
jne 0xf7944ba
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0xf7944ba
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0xf7944c9
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0xf794498
test esi, esi
jne 0xf7944fd
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0xf7944fd
lea eax, [ebp - 8]
push eax
push esi
call edi
cmp dword [ebp - 8], ebx
je 0xf7944fd
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0xf7944e2
push 0xf7ae740
call fcn.0f7a212f
test esi, esi
jne 0xf794512
push 5
call fcn.0f72689c
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0xf794528
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0xf794583
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
test ebx, ebx
je 0xf79457a
push 4
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
cmp eax, esi
jne 0xf794567
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0xf79455a
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0xf794576
mov esi, ebx
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
push 2
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
test ebx, ebx
jne 0xf794537
test ebx, ebx
jne 0xf794581
push 5
call fcn.0f72689c
mov esi, ebx
cmp word [ebp - 2], 0
je 0xf79458f
call fcn.0f77214c
push 1
lea eax, [ebp - 0xc]
push eax
push esi
call edi
push eax
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 0
call ebx
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0
lea eax, [ebp - 0xc]
push eax
push esi
call edi
push eax
push 0
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8