Function at 0x401200
Capabilities:
Enumerate gui resources
Execute command
Hide graphical window
Log keystrokes
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x404004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 4
push esi
mov esi, dword [ebp + 0xc]
je 0x401238
push 0x403160
call fcn.00401010
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040143a
mov esp, ebp
pop ebp
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov edi, dword [esi + 4]
add esp, 4
mov esi, dword [esi + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x18], edi
push eax
push 0x4011a0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40141a
push ebx
push str.find_window_n
call fcn.00401010
push edi
push str.name:_s_n
call fcn.00401010
push esi
push str.passwd:_s_n
call fcn.00401010
add esp, 0x14
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, eax
push 1
push edi
push ebx
call esi
push 1
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetFocus]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push ebx
call esi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.echo_off__clip
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ebx, dword [ebp - 0x18]
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401316
sub esi, ecx
lea eax, [esi + 1]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor edx, edx
test esi, esi
jle 0x40134e
nop word [eax + eax]
mov cl, byte [edx + ebx]
lea eax, [eax + 1]
inc edx
mov byte [eax - 1], cl
cmp edx, esi
jl 0x401340
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0x1d
push 0x11
call edi
push 0
push 0
push 0x2f
push 0x56
call edi
push 0
push 2
push 0x2f
push 0x56
call edi
push 0
push 2
push 0x1d
push 0x11
call edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call ebx
push 0
push 0
push 0x1c
push 0xd
call edi
push 0
push 2
push 0x1c
push 0xd
call edi
push 0x3e8
call ebx
mov ebx, dword [ebp - 0x14]
xor esi, esi
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013c4
sub ecx, edx
je 0x4013f3
nop
mov cl, byte [esi + ebx]
call fcn.00401040
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, ebx
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013e6
sub eax, edx
cmp esi, eax
jb 0x4013d0
push 0
push 0
push 0x1c
push 0xd
call edi
push 0
push 2
push 0x1c
push 0xd
call edi
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040143a
mov esp, ebp
pop ebp
ret
push str.not_find
call fcn.00401010
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
or eax, 0xffffffff
pop edi
pop esi
call fcn.0040143a
mov esp, ebp
pop ebp
ret