Function at 0x1005b8f0
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101c52b4]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [edi + 0x32d4]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, edx
jne 0x1005b93d
mov eax, dword [esp + 0xcc]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
cmp eax, 4
jne 0x1005ba8c
mov esi, esi
call fcn.10057030
test eax, eax
je 0x1005ba11
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov bh, bh
mov edx, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov cl, cl
mov eax, dword [esi]
cmp eax, 1
jne 0x1005b9cf
mov ax, word [esi + 4]
mov word [esp + 0x14], ax
mov al, al
mov cx, word [esi + 6]
mov word [esp + 0x16], cx
mov ebx, ebx
mov edx, dword [esi + 8]
mov dword [esp + 0x18], edx
mov bh, bh
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov cl, cl
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
mov ah, ah
jmp 0x1005ba11
cmp eax, ebx
jne 0x1005ba11
mov edx, dword [esi + 4]
mov dword [esp + 0x14], edx
mov ch, ch
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov esi, esi
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
mov dh, dh
mov edx, dword [esi + 0x10]
mov dword [esp + 0x20], edx
mov dl, dl
mov eax, dword [esi + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov ebx, ebx
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
mov dl, dl
mov edx, edx
mov dword [esp + 8], ebx
mov ch, ch
mov dword [esp + 0x34], 3
nop
mov dword [esp + 0x38], 1
push ebx
pop ebx
call fcn.10057030
test eax, eax
je 0x1005ba41
lea edx, [esp + 0xc]
mov dword [esp + 0x3c], edx
mov edi, edi
jmp 0x1005ba47
mov dword [esp + 0x3c], esi
mov edx, edx
mov bh, bh
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov dh, dh
mov edi, edi
push 1
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
lea edx, [esp + 0x44]
push 0xc
push edx
call fcn.10024760
add esp, 0x18
mov eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
cmp eax, 1
push ebp
mov ebp, 3
je 0x1005bdc3
cmp eax, ebp
je 0x1005bdc3
cmp eax, 0xa
je 0x1005bdc3
cmp eax, 0xb
je 0x1005bdc3
cmp eax, 2
jne 0x1005c1c4
mov dword [esp + 0xc], ebx
mov dl, dl
mov dword [esp + 0x38], ebp
mov al, al
mov eax, dword [esi]
cmp eax, 1
jne 0x1005bbd3
push ebx
pop ebx
mov edi, edi
mov dword [esp + 0x3c], 7
nop
movzx edx, word [esi + 4]
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0xbc]
push ecx
push edx
call fcn.10053720
add esp, 0xc
test eax, eax
je 0x1005c1c4
test byte [esi + 8], 2
je 0x1005bb71
mov al, byte [esp + 0xc0]
test al, al
jbe 0x1005c1c4
movzx esi, al
push esi
lea eax, [esp + 0xc5]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.101102f0
add esp, 0xc
mov ecx, ecx
mov dword [esp + 0x40], esi
push eax
pop eax
push 1
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
add esi, 0xc
lea eax, [esp + 0x48]
push esi
push eax
call fcn.10024760
add esp, 0x18
mov ah, ah
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
movzx esi, byte [esp + 0xb8]
push esi
lea ecx, [esp + 0xbd]
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.101102f0
add esp, 0xc
mov ebp, ebp
mov dword [esp + 0x40], esi
mov ecx, ecx
movzx ecx, byte [esp + 0xc0]
push 1
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
add ecx, 0xc
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.10024760
add esp, 0x18
push edx
pop edx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
cmp eax, ebx
jne 0x1005c1c4
mov ecx, ecx
xor ebp, ebp
mov ch, ch
mov dword [esp + 0x3c], 8
mov ah, ah
test byte [esi + 0x10], 1
je 0x1005bc1c
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.1005b620
add esp, 0x18
mov ebp, eax
mov eax, eax
test byte [esi + 0x10], 2
je 0x1005bc43
mov dh, dh
mov ecx, ecx
mov byte [esp + 0x44], 9
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x45], bl
mov edx, edx
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov edx, edx
mov ebp, 4
nop
test byte [esi + 0x10], 8
je 0x1005bc6b
mov dh, dh
mov ecx, ecx
mov byte [esp + 0x44], 0xa
mov al, al
mov byte [esp + 0x45], bl
mov edx, edx
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov edx, edx
mov ebp, 4
push eax
pop eax
test byte [esi + 0x10], 0x20
je 0x1005bc93
mov dh, dh
mov ecx, ecx
mov byte [esp + 0x44], 0xc
mov ebp, ebp
mov byte [esp + 0x45], bl
mov edx, edx
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov edx, edx
mov ebp, 4
mov cl, cl
test dword [esi + 0x10], 0x800
je 0x1005bcfd
mov ebx, dword [esi + 0xc]
mov dh, dh
mov ecx, ecx
test ebx, ebx
mov byte [esp + 0x44], 8
je 0x1005bce2
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x1005bcc2
or byte [esp + 0x44], 1
mov dl, dl
push 2
call ebp
test ax, ax
je 0x1005bcd2
or byte [esp + 0x44], 2
mov bl, bl
push 4
call ebp
test ax, ax
je 0x1005bce2
or byte [esp + 0x44], 4
push edx
pop edx
mov byte [esp + 0x45], 0
mov edx, edx
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], bl
mov edx, edx
mov ebp, 4
mov dl, dl
xor ebx, ebx
test byte [esi + 0x10], 1
jne 0x1005bd2a
cmp ebp, ebx
jne 0x1005bd2a
mov dh, dh
mov ecx, ecx
mov byte [esp + 0x44], 8
mov byte [esp + 0x45], 0
mov edx, edx
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
mov edx, edx
mov ebp, 4
mov edx, edx
mov dword [esp + 0x40], ebp
mov al, al
test byte [esi + 0x10], 1
je 0x1005bd8f
cmp dword [edi + 0x32f8], ebx
je 0x1005bd8f
mov eax, dword [edi + 0x37c8]
cmp eax, 0x398
jae 0x1005bd8f
push ebp
lea edx, [esp + 0x48]
push edx
lea eax, [edi + eax + 0x3378]
push eax
call fcn.101102f0
add esp, 0xc
mov edx, edx
mov dword [edi + 0x37cc], 4
mov esi, esi
add dword [edi + 0x37c8], ebp
mov ecx, ecx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
push 1
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
add ebp, 0xc
lea edx, [esp + 0x48]
push ebp
push edx
call fcn.10024760
add esp, 0x18
xchg ebx, eax
xchg ebx, eax
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
push ebx
pop ebx
mov dword [esp + 0x38], ebp
mov ebp, ebp
mov eax, dword [esi]
cmp eax, 1
jne 0x1005c00b
mov eax, dword [edi + 0x32d4]
cmp eax, ebp
mov ebx, 2
jne 0x1005bdf1
mov dword [esp + 0x3c], 0x14
mov ah, ah
jmp 0x1005be19
cmp eax, 0xa
jne 0x1005be02
mov dword [esp + 0x3c], 0
mov esi, esi
jmp 0x1005be19
cmp eax, 0xb
jne 0x1005be13
mov dword [esp + 0x3c], 0x10000
mov ebx, ebx
jmp 0x1005be19
mov dword [esp + 0x3c], ebx
mov ecx, ecx
mov ax, word [esi + 6]
mov word [esp + 0x40], ax
mov eax, dword [esi + 8]
test al, 1
je 0x1005be3a
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x42], cx
jmp 0x1005be51
test al, 2
je 0x1005be48
mov word [esp + 0x42], 1
nop
jmp 0x1005be51
mov word [esp + 0x42], 0
mov cl, cl
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x1005bf35
mov eax, dword [esi + 8]
test al, 1
je 0x1005bf35
test al, 2
je 0x1005bed1
mov word [esp + 0x40], 0x37
push edx
pop edx
mov word [esp + 0x42], bp
push ecx
pop ecx
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.10054610
add esp, 4
mov bh, bh
mov word [esp + 0x40], 0x2a
mov edi, edi
mov word [esp + 0x42], bp
nop
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.10054610
add esp, 4
mov dh, dh
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
mov word [esp + 0x40], 0x2a
push ebx
pop ebx
mov word [esp + 0x42], bx
push ecx
pop ecx
lea ecx, [esp + 0x38]
push ecx
mov edx, 0xc
mov eax, edi
call fcn.10054610
add esp, 4
mov esi, esi
mov word [esp + 0x40], 0x37
mov ah, ah
mov word [esp + 0x42], bx
mov al, al
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.10054610
add esp, 4
mov ah, ah
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
cmp cx, 0x13
jne 0x1005bfdd
mov eax, dword [esi + 8]
test al, 1
je 0x1005bfdd
test al, 2
jne 0x1005c1c4
mov esi, 0x1d
mov word [esp + 0x40], si
mov ebx, ebx
mov word [esp + 0x42], 4
mov esi, esi
lea eax, [esp + 0x38]
push eax
lea edx, [esi - 0x11]
mov eax, edi
call fcn.10054610
add esp, 4
mov ecx, ecx
mov word [esp + 0x40], 0x45
mov eax, eax
mov word [esp + 0x42], 0
mov ah, ah
lea ecx, [esp + 0x38]
push ecx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.10054610
add esp, 4
mov ch, ch
mov word [esp + 0x40], si
push eax
pop eax
mov word [esp + 0x42], 5
mov ecx, ecx
lea edx, [esp + 0x38]
push edx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.10054610
add esp, 4
mov edx, edx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.10054610
add esp, 4
push edx
pop edx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
cmp eax, ebx
jne 0x1005c1c4
mov ecx, ecx
xor ecx, ecx
mov eax, eax
xor edx, edx
nop
xor ebp, ebp
mov eax, eax
xor ebx, ebx
push eax
pop eax
mov dh, dh
mov eax, dword [edi + 0x32d4]
cmp eax, 3
jne 0x1005c03d
mov dword [esp + 0x3c], 0x1e
mov esi, esi
jmp 0x1005c064
cmp eax, 0xa
jne 0x1005c04a
mov dword [esp + 0x3c], ecx
push eax
pop eax
jmp 0x1005c064
cmp eax, 0xb
jne 0x1005c05a
mov dword [esp + 0x3c], 0x10000
nop
jmp 0x1005c064
mov dword [esp + 0x3c], 3
mov al, al
test dword [esi + 0x10], 0x8000
je 0x1005c076
mov eax, 3
push eax
pop eax
jmp 0x1005c07a
xor eax, eax
push eax
pop eax
test byte [esi + 0x10], 1
je 0x1005c08a
mov ebp, dword [esi + 4]
mov cl, cl
mov ebx, dword [esi + 8]
mov ah, ah
test byte [esi + 0x10], 2
je 0x1005c099
mov ecx, 1
mov ebp, ebp
push edx
pop edx
test byte [esi + 0x10], 4
je 0x1005c0a4
or ecx, 2
mov dh, dh
test byte [esi + 0x10], 8
je 0x1005c0b1
or ecx, 4
mov edx, edx
mov ebx, ebx
test byte [esi + 0x10], 0x10
je 0x1005c0bc
or ecx, 8
push ecx
pop ecx
test byte [esi + 0x10], 0x20
je 0x1005c0c9
or ecx, 0x10
mov ebx, ebx
mov dh, dh
test byte [esi + 0x10], 0x40
je 0x1005c0d4
or ecx, 0x20
push ecx
pop ecx
test dword [esi + 0x10], 0x800
je 0x1005c0eb
or ecx, 0x400
mov ah, ah
movzx edx, word [esi + 0xc]
mov ebp, ebp
mov word [esp + 0x40], ax
mov ch, ch
mov word [esp + 0x42], cx
mov dh, dh
mov word [esp + 0x44], dx
push edx
pop edx
push eax
pop eax
mov dword [esp + 0x46], ebp
push ebx
pop ebx
mov dword [esp + 0x4a], ebx
mov cl, cl
cmp dword [edi + 0x32f8], 0
je 0x1005c1aa
mov eax, dword [edi + 0x3358]
cmp eax, 6
jae 0x1005c1aa
mov cx, word [esp + 0x40]
mov word [edi + eax*2 + 0x3304], cx
mov esi, esi
mov edx, dword [edi + 0x3358]
mov ax, word [esp + 0x42]
mov word [edi + edx*2 + 0x3310], ax
mov eax, eax
mov ecx, dword [edi + 0x3358]
mov dx, word [esp + 0x44]
mov word [edi + ecx*2 + 0x331c], dx
mov ah, ah
mov eax, dword [edi + 0x3358]
mov ecx, dword [esp + 0x46]
mov dword [edi + eax*4 + 0x3328], ecx
mov cl, cl
mov edx, dword [edi + 0x3358]
mov eax, dword [esp + 0x4a]
mov dword [edi + edx*4 + 0x3340], eax
mov bh, bh
add dword [edi + 0x3358], 1
mov edx, edx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret
mov cl, cl
mov edx, edx
lea ecx, [esp + 0x38]
push ecx
mov edx, 0x16
mov eax, edi
call fcn.10054640
add esp, 4
mov ecx, ecx
mov ecx, dword [esp + 0xc8]
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.1010e4d7
add esp, 0xc0
ret