Function at 0x401ee2
Capabilities:
Log keystrokes via polling
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x174
mov dword [ebp - 0x15c], ecx
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x160], al
mov dword [ebp - 0x154], 0
lea edx, [ebp - 0x150]
mov eax, 0
mov ecx, 0x4a
mov edi, edx
rep stosd dword es:[edi], eax
mov byte [ebp - 0x15], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x15c]
movzx edx, byte [ebp - 0x160]
mov byte [eax], dl
mov eax, dword [ebp - 0x15c]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x15c]
movzx edx, byte [eax + 1]
mov eax, dword [ebp - 0x15c]
mov byte [eax + 3], dl
mov eax, dword [ebp - 0x15c]
movzx edx, byte [eax + 3]
mov eax, dword [ebp - 0x15c]
mov byte [eax + 4], dl
mov eax, dword [ebp - 0x15c]
movzx edx, byte [eax + 4]
mov eax, dword [ebp - 0x15c]
mov byte [eax + 2], dl
mov eax, dword [ebp - 0x15c]
movzx edx, byte [eax + 2]
mov eax, dword [ebp - 0x15c]
mov byte [eax + 5], dl
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
setne al
test al, al
je 0x4024d4
movsx eax, byte [ebp - 0x16]
cmp eax, 0x7e
je 0x40211c
cmp eax, 0x7e
jg case.0x401fe9.38
cmp eax, 0x7b
je 0x40215d
cmp eax, 0x7b
jg case.0x401fe9.38
cmp eax, 0x40
jg 0x401feb
cmp eax, 0x25
jl case.0x401fe9.38
sub eax, 0x25
cmp eax, 0x1b
ja case.0x401fe9.38
mov eax, dword [eax*4 + 0x4d01f4]
jmp eax
cmp eax, 0x5e
je 0x4020a0
jmp case.0x401fe9.38
mov eax, dword [ebp - 0x15c]
mov byte [eax + 1], 1
jmp 0x4024cb
mov eax, dword [ebp - 0x15c]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x15c]
mov ecx, eax
call method.CSendKeys.PopUpShiftKeys__
jmp 0x4024cb
mov eax, dword [ebp - 0x15c]
mov byte [eax + 3], 1
mov eax, dword [ebp - 0x15c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x12
mov ecx, eax
call method.CSendKeys.SendKeyDown_unsigned_char__unsigned_short__bool__bool_
sub esp, 0x10
jmp 0x4024cb
mov eax, dword [ebp - 0x15c]
mov byte [eax + 2], 1
mov eax, dword [ebp - 0x15c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x10
mov ecx, eax
call method.CSendKeys.SendKeyDown_unsigned_char__unsigned_short__bool__bool_
sub esp, 0x10
jmp 0x4024cb
mov eax, dword [ebp - 0x15c]
mov byte [eax + 4], 1
mov eax, dword [ebp - 0x15c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x11
mov ecx, eax
call method.CSendKeys.SendKeyDown_unsigned_char__unsigned_short__bool__bool_
sub esp, 0x10
jmp 0x4024cb
mov eax, dword [ebp - 0x15c]
mov byte [eax + 5], 1
mov eax, dword [ebp - 0x15c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x5b
mov ecx, eax
call method.CSendKeys.SendKeyDown_unsigned_char__unsigned_short__bool__bool_
sub esp, 0x10
jmp 0x4024cb
mov eax, dword [ebp - 0x15c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 0xd
mov ecx, eax
call method.CSendKeys.SendKeyDown_unsigned_char__unsigned_short__bool__bool_
sub esp, 0x10
mov eax, dword [ebp - 0x15c]
mov ecx, eax
call method.CSendKeys.PopUpShiftKeys__
jmp 0x4024cb
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
je 0x402180
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x7d
je 0x402180
add dword [ebp - 0x14], 1
jmp 0x402166
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x12c
jbe 0x40219c
mov eax, 0
jmp 0x4024f0
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
lea eax, [ebp - 0x154]
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov byte [ebp + eax - 0x154], 0
mov dword [ebp - 0x158], 0xffffffff
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x10], eax
mov word [ebp - 0xa], 0xffff
mov dword [esp + 8], 4
mov dword [esp + 4], str.VKEY
lea eax, [ebp - 0x154]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__strnicmp]
call eax
test eax, eax
sete al
test al, al
je 0x402228
lea eax, [ebp - 0x154]
add eax, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._atoi
mov word [ebp - 0xa], ax
jmp 0x40243e
mov dword [esp + 8], 4
mov dword [esp + 4], str.BEEP
lea eax, [ebp - 0x154]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__strnicmp]
call eax
test eax, eax
sete al
test al, al
je 0x4022cc
lea eax, [ebp - 0x154]
add eax, 5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0x20
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
setne al
test al, al
je 0x40243e
mov eax, dword [ebp - 0x20]
lea edx, [eax + 1]
mov dword [ebp - 0x20], edx
mov byte [eax], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._atoi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._atoi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_Beep]
call eax
sub esp, 8
jmp 0x40243e
mov dword [esp + 8], 0xb
mov dword [esp + 4], str.APPACTIVATE
lea eax, [ebp - 0x154]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__strnicmp]
call eax
test eax, eax
sete al
test al, al
je 0x402319
lea eax, [ebp - 0x154]
add eax, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call method.CSendKeys.AppActivate_char_const__char_const_
jmp 0x40243e
mov dword [esp + 8], 5
mov dword [esp + 4], str.DELAY
lea eax, [ebp - 0x154]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__strnicmp]
call eax
test eax, eax
sete al
test al, al
je 0x402391
lea eax, [ebp - 0x154]
add eax, 5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x3d
jne 0x402376
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [esp], eax
call sym._atoi
mov edx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax + 8], edx
jmp 0x40243e
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._atoi
mov edx, eax
mov eax, dword [ebp - 0x15c]
mov dword [eax + 0xc], edx
jmp 0x40243e
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
lea eax, [ebp - 0x154]
mov dword [esp], eax
call method.CSendKeys.StringToVKey_char_const__int_
mov word [ebp - 0xa], ax
mov eax, dword [ebp - 0x158]
cmp eax, 0xffffffff
je 0x40243e
mov word [ebp - 0xc], 1
mov eax, dword [ebp - 0x158]
mov eax, dword [eax*8 + 0x4ce020]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x154]
mov dword [esp], eax
call sym._strlen
cmp dword [ebp - 0x1c], eax
jae 0x40240a
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._atoi
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x158]
movzx eax, byte [eax*8 + 0x4ce025]
test al, al
je 0x40243e
mov eax, dword [ebp - 0x158]
movzx eax, byte [eax*8 + 0x4ce024]
movsx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_VkKeyScanA]
call eax
sub esp, 4
mov word [ebp - 0xa], ax
cmp word [ebp - 0xa], 0xffff
je 0x4024ca
movzx ecx, word [ebp - 0xc]
movzx edx, word [ebp - 0xa]
mov eax, dword [ebp - 0x15c]
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, eax
call method.CSendKeys.SendKey_unsigned_short__unsigned_short__bool_
sub esp, 0xc
mov eax, dword [ebp - 0x15c]
mov ecx, eax
call method.CSendKeys.PopUpShiftKeys__
jmp 0x4024ca
movsx eax, byte [ebp - 0x16]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_VkKeyScanA]
call eax
sub esp, 4
mov word [ebp - 0xa], ax
movzx edx, word [ebp - 0xa]
mov eax, dword [ebp - 0x15c]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], edx
mov ecx, eax
call method.CSendKeys.SendKey_unsigned_short__unsigned_short__bool_
sub esp, 0xc
mov eax, dword [ebp - 0x15c]
mov ecx, eax
call method.CSendKeys.PopUpShiftKeys__
jmp 0x4024cb
nop
add dword [ebp - 0x10], 1
jmp 0x401f88
mov eax, dword [ebp - 0x15c]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x15c]
mov ecx, eax
call method.CSendKeys.PopUpShiftKeys__
mov eax, 1
mov edi, dword [ebp - 4]
leave
ret 8