Function at 0x408ecc
Capabilities:
Log keystrokes via polling
Read file on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdd0
mov esi, eax
push 0
mov eax, dword [esi + 0xc8]
xor ecx, ecx
mov edx, 0x18b
call fcn.00408de8
mov ebx, eax
test ebx, ebx
je 0x409282
lea eax, [esp + 0x130]
push eax
call sub.user32.dll_GetKeyboardState
push 0
mov eax, dword [esi + 0xd0]
xor ecx, ecx
mov edx, 0xb
call fcn.00408de8
mov al, byte [esp + 0x141]
and al, 0x80
test al, al
je 0x408f59
push 0
mov eax, dword [esi + 0xc4]
xor ecx, ecx
mov edx, 0x184
call fcn.00408de8
push 0
mov eax, dword [esi + 0xd0]
xor ecx, ecx
mov edx, 0x184
call fcn.00408de8
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
jmp 0x408f89
push 0
mov eax, dword [esi + 0xd0]
xor ecx, ecx
mov edx, 0x188
call fcn.00408de8
mov dword [esp + 4], eax
push 0
mov eax, dword [esi + 0xd0]
xor ecx, ecx
mov edx, 0x18b
call fcn.00408de8
mov dword [esp + 8], eax
mov al, byte [esp + 0x140]
and al, 0x80
test al, al
je 0x408fa1
cmp dword [esp + 8], 0
je 0x408fa1
xor eax, eax
jmp 0x408fa3
mov al, 1
neg al
sbb eax, eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x408fbc
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
jmp 0x408fc4
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
dec eax
mov dword [esp + 0x10], eax
xor edi, edi
mov eax, 0x400
call fcn.004024ec
mov dword [esp + 0x20], eax
mov eax, 0x400
call fcn.004024ec
mov dword [esp + 0x24], eax
mov eax, 0x21
call fcn.004024ec
mov dword [esp + 0x28], eax
dec ebx
test ebx, ebx
jl 0x4091fa
inc ebx
mov dword [esp + 0x2c], ebx
mov dword [esp], 0
mov eax, dword [esp + 8]
cmp eax, dword [0x43befc]
jge 0x4091fa
mov ebx, dword [esp + 0x20]
push ebx
mov eax, dword [esi + 0xc8]
mov ecx, dword [esp + 4]
mov edx, 0x189
call fcn.00408de8
mov dword [esp + 0x14], 0xffffffff
mov edx, dword [esp + 0x20]
mov eax, esi
call fcn.00410cf0
test eax, eax
je 0x40906e
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov eax, dword [esp + 0x38]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0xffffffff
je 0x4091ed
push 0
lea eax, [esp + 0x1c]
push eax
push pe_nt_image_headers32
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.kernel32.dll_ReadFile_1
cmp dword [esp + 0x18], 0
je 0x4091ed
cmp dword [esp + 0x1c], 0
je 0x4090bb
push ebx
mov eax, dword [esi + 0xc4]
xor ecx, ecx
mov edx, 0x180
call fcn.00408de8
jmp 0x4090d4
push ebx
mov ecx, dword [esp + 8]
add ecx, dword [esp + 4]
mov eax, dword [esi + 0xc4]
mov edx, 0x181
call fcn.00408de8
lea edx, [esp + 0x30]
mov eax, esi
call fcn.00410b18
cmp byte [esp + 0x12f], 0
je 0x4090f0
cmp byte [esp + 0x5e], 0
jne 0x409132
push 0x400
mov eax, dword [esp + 0x28]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x3ff
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
call sub.comdlg32.dll_GetFileTitleA
push 0x21
mov eax, dword [esp + 0x2c]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x20
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x30]
push eax
call sub.kernel32.dll_RtlMoveMemory
jmp 0x40914f
push 0x21
mov eax, dword [esp + 0x2c]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x20
lea eax, [esp + 0x62]
push eax
mov eax, dword [esp + 0x30]
push eax
call sub.kernel32.dll_RtlMoveMemory
mov eax, dword [esp + 0x28]
mov ecx, 0x20
mov dl, byte [eax]
test dl, dl
jbe 0x409163
cmp dl, 0x20
jb 0x409168
cmp dl, 0x7f
jne 0x40916b
mov byte [eax], 0x20
inc eax
dec ecx
jne 0x409158
cmp dword [esp + 0x1c], 0
je 0x4091a5
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esi + 0xd0]
xor ecx, ecx
mov edx, 0x180
call fcn.00408de8
push 0
mov eax, dword [esi + 0xd0]
mov ecx, dword [esp + 0xc]
mov edx, 0x19a
call fcn.00408de8
jmp 0x4091d8
mov eax, dword [esp + 0x28]
push eax
mov ebx, dword [esp + 8]
add ebx, dword [esp + 4]
mov ecx, ebx
mov eax, dword [esi + 0xd0]
mov edx, 0x181
call fcn.00408de8
push 0
mov ecx, ebx
mov eax, dword [esi + 0xd0]
mov edx, 0x19a
call fcn.00408de8
or edi, 0xffffffff
inc dword [esp + 8]
inc dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
inc dword [esp]
dec dword [esp + 0x2c]
jne 0x40900e
mov eax, dword [esp + 0x20]
call fcn.0040250c
mov eax, dword [esp + 0x24]
call fcn.0040250c
mov eax, dword [esp + 0x28]
call fcn.0040250c
push 0
mov eax, dword [esi + 0xc8]
xor ecx, ecx
mov edx, 0x184
call fcn.00408de8
push 0
mov eax, dword [esi + 0xd0]
mov ecx, 1
mov edx, 0xb
call fcn.00408de8
mov eax, dword [esi + 0xd0]
call fcn.00408d88
test edi, edi
je 0x40927b
push 0
mov eax, dword [esi + 0xd0]
mov ecx, dword [esp + 0x14]
mov edx, 0x186
call fcn.00408de8
push 0
mov eax, dword [esi + 0xd0]
mov ecx, dword [esp + 0x10]
mov edx, 0x186
call fcn.00408de8
mov eax, esi
call fcn.00415530
add esp, 0x230
pop edi
pop esi
pop ebx
ret