Function at 0x5009f645
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov eax, 0x1130
lea ebp, [esp - 0x74]
call fcn.50260700
push ebx
xor ebx, ebx
push esi
mov eax, 0x104
push edi
lea ecx, [ebp - 0xa94]
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x6c], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x48], ebx
call fcn.500a785c
lea ecx, [ebp - 0xeb4]
call fcn.500a785c
lea ecx, [ebp - 0x674]
call fcn.500a785c
lea eax, [ebp + 0x68]
push eax
mov eax, 0x5002a174
push eax
push eax
mov dword [ebp + 0x40], ebx
call fcn.501a5bb0
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
cmp dword [ebp + 0x68], ebx
je 0x5009fcb6
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp + 0x58]
push eax
mov eax, 0x5002a5b4
push eax
push eax
mov dword [ebp + 0x24], ebx
call fcn.501a5bb0
test eax, eax
jl 0x5009f704
mov eax, dword [ebp + 0x58]
cmp eax, ebx
je 0x5009f704
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x10]
lea eax, [ebp + 0x70]
push eax
call dword [0x5029af38]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
cmp eax, ebx
je 0x5009fcb6
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x14]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov edi, dword [ebp + 0x7c]
mov edx, dword [edi + 0x2c]
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
not edx
and edx, 2
push edx
push eax
call dword [ecx + 0x12c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x118]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x204]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x3c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x34]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
push dword [edi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
lea eax, [ebp + 0x48]
push eax
call fcn.5019e0ec
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
push dword [ebp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
mov esi, dword [edi + 0x18]
lea edx, [ebp + 0x64]
push edx
push eax
call dword [ecx + 0xc8]
cmp dword [ebp + 0x64], ebx
je 0x5009fcb6
cmp esi, ebx
je 0x5009f880
mov edi, dword [sym.imp.MSVCR70.dll_wcslen]
cmp word [esi], bx
je 0x5009f877
mov eax, dword [ebp + 0x64]
mov ecx, dword [eax]
push ebx
push esi
push eax
call dword [ecx + 0x18]
push 0x5000a69c
push esi
call dword [sym.imp.MSVCR70.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x5009f863
mov dword [ebp + 0x40], 1
push esi
call edi
lea esi, [esi + eax*2 + 2]
push esi
call edi
lea esi, [esi + eax*2 + 2]
cmp esi, ebx
pop ecx
pop ecx
jne 0x5009f83a
cmp dword [ebp + 0x40], ebx
jne 0x5009f921
mov esi, 0x32e0
push esi
call fcn.5005698e
shr eax, 0x10
test ax, ax
push esi
je 0x5009f8c5
call fcn.5005698e
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.50260700
mov edi, esp
push esi
call fcn.5005698e
push eax
push edi
call fcn.5024c7db
jmp 0x5009f8ca
call fcn.5005698e
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.MSVCR70.dll_wcscpy]
cmp word [ebp - 0x4c], bx
pop ecx
pop ecx
lea eax, [ebp - 0x4c]
je 0x5009f8f0
cmp word [eax], 0x3b
jne 0x5009f8e9
mov word [eax], bx
inc eax
inc eax
cmp word [eax], bx
jne 0x5009f8e0
mov word [eax + 2], bx
lea esi, [ebp - 0x4c]
cmp word [esi], bx
je 0x5009f921
mov eax, dword [ebp + 0x64]
mov ecx, dword [eax]
push ebx
push esi
push eax
call dword [ecx + 0x18]
mov edi, dword [sym.imp.MSVCR70.dll_wcslen]
push esi
call edi
lea esi, [esi + eax*2 + 2]
push esi
call edi
lea esi, [esi + eax*2 + 2]
cmp esi, ebx
pop ecx
pop ecx
jne 0x5009f8f7
mov edx, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x70]
push dword [edx + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc0]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov edx, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x70]
push dword [edx + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x54]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov edx, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x70]
push dword [edx + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xb8]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
lea edx, [ebp + 0x6c]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
je 0x5009fcb6
mov ecx, dword [eax]
push ebx
push 0xa
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xa
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xc
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xc
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xd
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xd
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xf
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xf
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0x11
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0x11
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
lea edx, [ebp + 0x54]
push edx
push eax
call dword [ecx + 0xcc]
cmp dword [ebp + 0x54], ebx
je 0x5009fcb6
mov eax, dword [ebp + 0x7c]
cmp dword [eax + 0x30], ebx
je 0x5009fb3b
lea eax, [ebp + 0x60]
push eax
call dword [0x5029af34]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x60]
cmp eax, ebx
je 0x5009fcb6
mov ecx, dword [eax]
push 0xa
push eax
call dword [ecx + 0x14]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov esi, 0x3616
push esi
call fcn.5005698e
shr eax, 0x10
test ax, ax
push esi
je 0x5009fb01
call fcn.5005698e
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.50260700
mov edi, esp
push esi
call fcn.5005698e
push eax
push edi
call fcn.5024c7db
jmp 0x5009fb06
call fcn.5005698e
mov ecx, dword [ebp + 0x60]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x54]
push dword [ebp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x60]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x110]
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push 0x5009ea98
push eax
call dword [ecx + 0x90]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov esi, dword [ebp + 0x7c]
push dword [esi + 0x28]
push 0x5009b7f9
call dword [0x5029af28]
mov eax, dword [esi + 4]
mov dword [ebp + 0x14], eax
mov eax, dword [esi + 0x30]
mov dword [ebp + 0x34], eax
lea eax, [ebp - 0x674]
pop ecx
mov dword [ebp + 4], eax
pop ecx
push dword [esi + 0xc]
lea eax, [ebp - 0xa94]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x2c]
lea ecx, [ebp - 0xa94]
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x28], eax
call fcn.500a6e2f
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
push dword [0x5029a6cc]
push 0x5009e45e
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [ebp + 0x24], eax
lea eax, [ebp + 4]
mov dword [0x5028e8b8], eax
mov eax, dword [ebp + 0x70]
mov dword [0x5028e8c0], eax
push dword [esi + 4]
call fcn.50272bbe
mov eax, dword [ebp + 0x68]
push ebx
mov dword [0x5028e8c0], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov edx, dword [ebp + 0x7c]
push dword [edx + 4]
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
lea edx, [ebp + 0x3c]
push edx
push eax
call dword [ecx + 0x88]
mov edi, eax
mov eax, dword [ebp + 0x68]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
cmp edi, ebx
mov esi, edi
jl 0x5009fe2c
mov eax, dword [ebp + 0x3c]
and eax, 0xff
cmp eax, 2
je 0x5009fc50
cmp eax, 4
je 0x5009fc50
mov esi, 0x8004000c
jmp 0x5009fe2c
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
lea edx, [ebp + 0x50]
push edx
push eax
call dword [ecx + 0xc4]
mov eax, dword [ebp + 0x50]
cmp eax, ebx
je 0x5009fcb6
mov ecx, dword [eax]
lea edx, [ebp + 0x5c]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
je 0x5009fcb6
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
cmp eax, 1
je 0x5009fc97
mov esi, 0x8000ffff
jmp 0x5009fe2c
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push ebx
lea edx, [ebp + 0x4c]
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
mov eax, dword [ebp + 0x4c]
cmp eax, ebx
jne 0x5009fcc0
mov esi, 0x8007000e
jmp 0x5009fe2c
mov ecx, dword [eax]
push 3
lea edx, [ebp + 0x44]
push edx
lea edx, [ebp - 0x254]
push edx
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, ebx
jl 0x5009fe2c
lea eax, [ebp - 0x254]
push 0x50007e60
push eax
call dword [sym.imp.MSVCR70.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x5009fd2c
push 0x30000000
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 0x10bc]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
je 0x5009fd2c
lea eax, [ebp - 0x10bc]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.MSVCR70.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x674]
call fcn.500a6e2f
push ebx
lea ecx, [ebp - 0xa94]
call fcn.50272bbe
push eax
lea ecx, [ebp - 0x674]
call fcn.50272bbe
lea ecx, [ebp - 0x674]
call fcn.50272bbe
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.MSVCR70.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x674]
call fcn.500a6e2f
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0xeb4]
call fcn.500a6e2f
lea ecx, [ebp - 0xeb4]
call fcn.50272bbe
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.MSVCR70.dll_wcslen]
mov edi, dword [ebp + 0x7c]
inc eax
cmp eax, dword [edi + 0x10]
pop ecx
mov dword [ebp + 0x44], eax
jbe 0x5009fdc1
mov esi, 0x3003
jmp 0x5009fe2c
lea eax, [ebp - 0x254]
push eax
push dword [edi + 0xc]
call dword [sym.imp.MSVCR70.dll_wcscpy]
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp + 0x44]
mov word [eax + ecx*2], bx
mov eax, dword [edi + 0xc]
push 0x5c
push eax
mov dword [ebp + 0x7c], eax
call dword [sym.imp.MSVCR70.dll_wcsrchr]
sub eax, dword [ebp + 0x7c]
push 0x2e
push dword [ebp + 0x7c]
sar eax, 1
inc eax
mov dword [edi + 0x20], eax
call dword [sym.imp.MSVCR70.dll_wcsrchr]
sub eax, dword [edi + 0xc]
add esp, 0x18
sar eax, 1
inc eax
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xbc]
lea ecx, [ebp - 0xeb4]
mov dword [edi + 0x1c], eax
call fcn.500a70fc
push eax
call dword [sym.imp.MSVCR70.dll__wchdir]
pop ecx
cmp dword [ebp + 0x24], ebx
je 0x5009fe3a
push dword [ebp + 0x24]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 0x68]
cmp eax, ebx
je 0x5009fe54
mov dword [ebp + 0x68], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x58]
cmp eax, ebx
je 0x5009fe64
mov dword [ebp + 0x58], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x70]
cmp eax, ebx
je 0x5009fe74
mov dword [ebp + 0x70], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x64]
cmp eax, ebx
je 0x5009fe84
mov dword [ebp + 0x64], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
je 0x5009fe94
mov dword [ebp + 0x6c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
je 0x5009fea4
mov dword [ebp + 0x54], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x50]
cmp eax, ebx
je 0x5009feb4
mov dword [ebp + 0x50], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
je 0x5009fec4
mov dword [ebp + 0x5c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x4c]
cmp eax, ebx
je 0x5009fed4
mov dword [ebp + 0x4c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp + 0x48]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp + 0x1c], ebx
jne 0x5009fee8
push ebx
call fcn.50272bbe
push 1
call fcn.50272bbe
lea ecx, [ebp - 0x674]
mov dword [0x5028e8b8], ebx
call fcn.501b7afc
lea ecx, [ebp - 0xeb4]
call fcn.501b7afc
lea ecx, [ebp - 0xa94]
call fcn.501b7afc
mov eax, esi
lea esp, [ebp - 0x10c8]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4