Function at 0x4013b0
Capabilities:
Check if file exists
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x54e1bc
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4013d3
xor eax, eax
jmp 0x40180f
mov edx, dword [ebp + 8]
mov dword [0x54e124], edx
mov dword [0x54e10c], ebp
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x48], 1
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 1
mov dword [0x5e89ac], 0
jmp 0x401487
mov eax, dword [0x5e89ac]
add eax, 1
mov dword [0x5e89ac], eax
cmp dword [0x5e89ac], 0x372c
jae 0x40149f
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x40147a
call dword [sym.imp.USER32.dll_GetMessageTime]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.GDI32.dll_GetTextCharacterExtra]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.USER32.dll_CloseWindowStation]
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsCharUpperA]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.GDI32.dll_SaveDC]
call dword [sym.imp.USER32.dll_GetCursor]
call dword [sym.imp.USER32.dll_GetCapture]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_GetMenuContextHelpId]
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.GDI32.dll_CancelDC]
movzx ecx, word [ebp - 0x38]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.GDI32.dll_GetTextColor]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.GDI32.dll_CloseMetaFile]
movzx edx, byte [ebp - 0x44]
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.GDI32.dll_DeleteColorSpace]
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.GDI32.dll_GetGraphicsMode]
call dword [sym.imp.USER32.dll_ReleaseCapture]
push str.bRYFwPobfq
call dword [sym.imp.USER32.dll_CharUpperA]
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.GDI32.dll_GetStretchBltMode]
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.GDI32.dll_GetDCPenColor]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
movzx edx, byte [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.GDI32.dll_FlattenPath]
push 0x54e1cc
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4015d5
xor eax, eax
jmp 0x40180f
push 0x54e1d0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4015f2
xor eax, eax
jmp 0x40180f
push 0x54e1d4
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40160f
xor eax, eax
jmp 0x40180f
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
je 0x40162d
xor eax, eax
jmp 0x40180f
mov ecx, dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [0x5e89f8], ecx
call fcn.004011c0
call fcn.00401380
push 0xa569
call fcn.00401190
add esp, 4
mov dword [0x54e0f8], eax
mov edx, dword [0x54e0f8]
mov dword [0x5e89fc], edx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x5e8a00], eax
mov edx, dword [0x54e134]
push edx
mov eax, eax
mov eax, dword [0x54e13c]
push eax
mov eax, eax
mov eax, dword [0x5e89fc]
push eax
mov eax, eax
mov eax, dword [0x5e89b4]
push eax
mov eax, eax
mov eax, dword [0x54e138]
push eax
mov eax, eax
mov edx, dword [0x5e8a00]
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
push 0x4016db
push edx
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
ret
mov esp, ebp
pop ebp
ret