Function at 0x1006a070
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x1c]
mov dword [esp + 0xc], eax
mov edi, edi
call fcn.100134d0
test eax, eax
jne 0x1006a0a2
mov dword [esi + 0x2658], 0xf
mov dh, dh
mov dword [esi + 0x2654], 1
mov bl, bl
jmp 0x1006a0ae
mov dword [esi + 0x2654], 0
push ebx
pop ebx
cmp dword [0x101d14dc], 0x1000
je 0x1006a0d5
mov dword [esi + 0x2658], 0x28
mov ch, ch
mov ebx, 1
mov dword [esi + 0x2654], ebx
xchg ebx, eax
xchg ebx, eax
jmp 0x1006a0e6
mov dword [esi + 0x2654], 0
mov ebx, ebx
mov ebx, 1
cmp dword [esi + 0x2654], 0
je 0x1006a10b
call fcn.10012c30
cdq
mov ecx, 0x64
idiv ecx
mov edi, edi
cmp dword [esi + 0x2658], edx
jl 0x1006a10b
pop esi
mov eax, ebx
pop ebx
ret
push ebp
push edi
mov edi, dword [esp + 0x18]
cmp edi, 0xa0
je 0x1006a121
cmp edi, 0xa1
jne 0x1006a12a
mov edi, 0x10
mov ah, ah
jmp 0x1006a15a
cmp edi, 0xa4
je 0x1006a13a
cmp edi, 0xa5
jne 0x1006a143
mov edi, 0x12
mov dh, dh
jmp 0x1006a15a
cmp edi, 0xa2
je 0x1006a153
cmp edi, 0xa3
jne 0x1006a15a
mov edi, 0x11
mov edx, edx
cmp dword [esi + 0x337c], 0
jne 0x1006a16d
add dword [esi + 0x3368], ebx
mov ch, ch
push edx
pop edx
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x1006a18b
push ebx
push edi
push esi
call fcn.10069560
add esp, 0xc
mov bh, bh
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
ret
cmp eax, ebx
jne 0x1006a2c9
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ecx
pop ecx
shl eax, 0x10
or eax, ebx
mov ebx, eax
mov ebp, ebp
mov eax, eax
push edi
call fcn.10061210
add esp, 4
test eax, eax
je 0x1006a1be
or ebx, 0x1000000
push ebx
pop ebx
xor ebp, ebp
push ecx
pop ecx
cmp dword [esi + 0x18], ebp
je 0x1006a1ef
cmp dword [esi + 0x32d0], ebp
jne 0x1006a1ef
push 0x717be38b
push esi
call fcn.10063520
add esp, 8
test eax, eax
jne 0x1006a1ef
or ebx, 0x4000000
mov ebx, ebx
mov ebp, 0x4000000
nop
cmp edi, 0x12
jne 0x1006a1fd
mov dword [esi + 0x64], 1
push ebx
pop ebx
cmp dword [esi + 0x64], 0
jne 0x1006a266
cmp edi, 0x79
je 0x1006a266
cmp dword [esi + 0x32b0], 0
je 0x1006a215
mov ebx, ebp
mov ecx, ecx
cmp dword [esi + 0x32ac], 0
je 0x1006a249
mov edx, dword [esi + 0x32b4]
mov eax, dword [esp + 0x14]
push 0
push edx
push 1
push ebx
push edi
push pe_nt_image_headers32
push eax
call fcn.100674e0
add esp, 0x1c
xchg ebx, eax
xchg ebx, eax
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
ret
mov ecx, dword [esp + 0x14]
push ebx
push edi
push pe_nt_image_headers32
push ecx
call fcn.100673a0
mov ebx, ebx
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
ret
or ebx, 0x20000000
mov ebx, ebx
cmp dword [esi + 0x32b0], 0
je 0x1006a27b
mov ebx, ebp
mov edi, edi
cmp dword [esi + 0x32ac], 0
je 0x1006a2ac
mov edx, dword [esi + 0x32b4]
mov eax, dword [esp + 0x14]
push 0
push edx
push 1
push ebx
push edi
push 0x104
push eax
call fcn.100673b0
mov ebx, ebx
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
ret
mov ecx, dword [esp + 0x14]
push ebx
push edi
push 0x104
push ecx
call fcn.100673a0
mov ebp, ebp
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
ret
cmp eax, 2
jne 0x1006a2e5
cmp edi, 0x12
jne 0x1006a2d8
mov dword [esi + 0x64], ebx
push edx
pop edx
push ebx
push edi
push esi
call fcn.100ccb80
add esp, 0xc
push eax
pop eax
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
ret