Function at 0x1000c6e0
Capabilities:
Log keystrokes via polling
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017b5ea
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x101e40b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 1
cmp edi, 0x486
ja 0x1000c98d
je case.0x1000c9ae.1161
cmp edi, 0x112
ja 0x1000c83e
je 0x1000c822
cmp edi, 0x10
ja 0x1000c7ad
je 0x1000c7a3
mov eax, edi
sub eax, 2
je 0x1000c796
sub eax, 1
je case.0x1000cd53.8027
sub eax, 2
mov dword [ebp - 0x48], 0
push dword [ebp + 0x10]
mov ecx, ebx
push esi
push edi
call fcn.10105a80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10177d47
mov esp, ebp
pop ebp
ret 0xc
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x1000ce92
call fcn.10011040
jmp 0x1000ce92
mov eax, edi
sub eax, 0x4a
je case.0x1000cd53.8026
sub eax, 0xb6
je 0x1000c7ca
sub eax, 0x11
je 0x1000ce9c
jmp case.0x1000cd53.8027
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns case.0x1000cd53.8027
cmp esi, 0x56
jne case.0x1000cd53.8027
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1000ce92
push 0xf
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1000c803
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1000ce92
push 0xf
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x1000c817
push eax
mov ecx, ebx
call fcn.10012ed0
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1000ce92
mov eax, dword [ebx]
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp + 0x10]
mov ecx, ebx
push esi
push 0x112
call dword [eax + 0x64]
mov dword [ebp - 0x58], eax
jmp 0x1000ce92
cmp edi, 0x20a
ja 0x1000c954
je case.0x1000cd53.8027
mov eax, edi
sub eax, 0x113
je 0x1000c86c
sub eax, 0xed
je case.0x1000cd53.8027
sub eax, 1
jmp case.0x1000cd53.8027
mov dword [ebp - 0x48], 0
cmp esi, 0x68
jne 0x1000c948
mov ecx, dword [ebx + 0x9a0]
mov eax, 0x2e8ba2e9
inc ecx
mov dword [ebp - 0x18], 0
imul ecx
push 0x1c
sar edx, 1
mov eax, edx
mov dword [ebp - 0x14], 0
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x18], 0
imul eax, eax, 0xb
push str.pngpichome_vipmembermember
mov dword [ebp - 0x14], 7
sub ecx, eax
xor eax, eax
mov dword [ebx + 0x9a0], ecx
lea ecx, [ebp - 0x28]
mov word [ebp - 0x28], ax
call fcn.100056d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
mov edx, dword [ebx + 0x9a0]
inc edx
call fcn.1000a750
mov byte [ebp - 4], 1
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x1000c8f3
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10008ba0
push 4
push str..png
mov ecx, eax
call fcn.10008ba0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10005660
mov edx, dword [ebx + 0x9a4]
test edx, edx
je 0x1000c939
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [edx]
cmovae ecx, dword [ebp - 0x28]
push ecx
mov ecx, edx
call dword [eax + 0x188]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005660
mov dword [ebp - 0x58], 0
jmp 0x1000ce92
cmp edi, 0x233
je 0x1000c982
cmp edi, 0x2e0
jne case.0x1000cd53.8027
mov edx, dword [ebx]
movzx eax, si
push eax
call dword [edx + 0x90]
push eax
lea ecx, [ebx + 0x30]
call fcn.100ff940
jmp case.0x1000cd53.8027
push esi
call fcn.10012ed0
jmp 0x1000ce92
cmp edi, 0x6bc
ja 0x1000cbb0
je 0x1000cb65
lea eax, [edi - 0x487]
cmp eax, 3
ja case.0x1000cd53.8027
jmp dword [eax*4 + 0x1000cea4]
call fcn.10013670
jmp 0x1000ce92
push str.2345Pic
lea ecx, [ebp - 0x40]
call fcn.10005530
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 9
mov ecx, str.__pro
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000ca01
sub ecx, edx
sar ecx, 1
push ecx
push str.__pro
lea ecx, [ebp - 0x28]
call fcn.10008ba0
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.10008ba0
mov edx, 0x101a9230
lea ecx, [edx + 2]
mov dword [ebp - 0x4c], ecx
nop
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x1000ca40
sub edx, dword [ebp - 0x4c]
mov ecx, eax
sar edx, 1
push edx
push 0x101a9230
call fcn.10008ba0
mov edx, str._userorder
lea ecx, [edx + 2]
mov dword [ebp - 0x4c], ecx
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x1000ca70
sub edx, dword [ebp - 0x4c]
mov ecx, eax
sar edx, 1
push edx
push str._userorder
call fcn.10008ba0
call fcn.100b29e0
lea ecx, [ebp - 0x28]
call fcn.100b2c70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
call fcn.10005660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10005660
jmp 0x1000ce92
call fcn.10013420
jmp 0x1000ce92
mov ecx, dword [0x101e9a8c]
mov eax, 0x2aaaaaab
sub ecx, dword [0x101e9a88]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp + 0x10], eax
jae 0x1000ce9c
call fcn.1001d5d0
mov al, byte [eax + 0x80]
test al, al
jne 0x1000cb4d
push 7
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.2345Pic
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.100056d0
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
call fcn.100b2e60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005660
jmp 0x1000ce92
mov eax, dword [ebp + 0x10]
lea ecx, [eax + eax*2]
mov eax, dword [0x101e9a88]
lea ecx, [eax + ecx*8]
call fcn.100b2f80
jmp 0x1000ce92
lea ecx, [ebp - 0x40]
test esi, esi
jne 0x1000cb7f
push str.Opening_login_page__please_wait...
call fcn.10005530
mov dword [ebp - 4], 2
jmp 0x1000cb90
push str.Opening_member_center__please_wait...
call fcn.10005530
mov dword [ebp - 4], 3
push ecx
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.1000d350
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10005660
jmp 0x1000ce92
cmp edi, 0x1f58
ja 0x1000cd3d
je 0x1000cd2f
cmp edi, 0x1850
ja 0x1000cc04
je 0x1000cbec
cmp edi, 0x1788
je 0x1000cbec
cmp edi, 0x17eb
jbe case.0x1000cd53.8027
cmp edi, 0x17ed
ja case.0x1000cd53.8027
call fcn.1001d5d0
mov ecx, eax
call fcn.1001d830
mov ecx, ebx
call fcn.1000cf30
jmp 0x1000ce92
cmp edi, 0x18b4
je 0x1000cbec
cmp edi, 0x1b70
jne case.0x1000cd53.8027
push str.btn_all
lea ecx, [ebp - 0x40]
call fcn.10005530
mov dword [ebp - 4], 4
lea eax, [ebp - 0x40]
push eax
mov ecx, ebx
call fcn.10013730
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10005660
mov edx, dword [ebx + 0x7e4]
lea esi, [ebx + 0x7e0]
push ecx
mov ecx, dword [esi]
call fcn.10014e60
mov eax, dword [esi]
mov dword [esi + 4], eax
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
call fcn.10014e60
mov eax, dword [esi + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
add esi, 0x24
mov ecx, esi
call fcn.10019430
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x1c]
push esi
call fcn.1001af00
lea esi, [ebx + 0x7e0]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 1
cmp esi, eax
je 0x1000cccf
mov ecx, esi
call fcn.10013e60
mov edx, dword [ebp - 0x54]
mov ecx, dword [edx]
mov dword [esi], ecx
mov eax, dword [edx + 4]
mov dword [esi + 4], eax
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov eax, 1
mov dword [ebp - 0x50], eax
and eax, 0xfffffffe
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.10013e60
mov eax, dword [esi]
mov ecx, dword [esi + 4]
cmp eax, ecx
je 0x1000cd19
push dword [ebp - 0x54]
sub ecx, eax
mov eax, 0x66666667
imul ecx
mov ecx, dword [esi]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esi + 4]
push eax
call fcn.1001c480
add esp, 8
mov ecx, esi
call fcn.1001c000
mov ecx, ebx
call fcn.100123b0
mov esi, dword [ebp - 0x4c]
jmp 0x1000ce92
push dword [ebp + 0x10]
push esi
call fcn.1000eac0
jmp 0x1000ce92
lea eax, [edi - 0x1f59]
cmp eax, 0x64
ja case.0x1000cd53.8027
movzx eax, byte [eax + 0x1000cec8]
jmp dword [eax*4 + 0x1000ceb4]
test esi, esi
je 0x1000ce9c
push esi
lea ecx, [ebp - 0x40]
call fcn.10005590
mov dword [ebp - 4], 6
add esi, 0xfffffffc
push fcn.100054f0
push dword [esi]
push 0x18
push dword [ebp - 0x4c]
call fcn.10177fee
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 4]
push eax
push esi
call fcn.10177fe0
mov ecx, dword [ebx + 0x9a8]
add esp, 8
test ecx, ecx
je 0x1000ce67
mov eax, dword [ecx + 0x550]
add ecx, 0x550
call dword [eax + 0xc]
test eax, eax
jle 0x1000ce67
mov esi, dword [ebp - 0x50]
xor edi, edi
nop word [eax + eax]
mov ecx, dword [ebx + 0x9a8]
add ecx, 0x550
push edi
mov eax, dword [ecx]
call dword [eax]
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 7
lea ecx, [eax + 0x6b0]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10005590
or esi, 2
mov dword [ebp - 0x50], esi
mov ecx, dword [ebp - 0x30]
cmp dword [eax + 0x10], ecx
je 0x1000ce0b
mov byte [ebp - 0x41], 0
jmp 0x1000ce28
cmp dword [ebp - 0x2c], 8
lea edx, [ebp - 0x40]
cmovae edx, dword [ebp - 0x40]
cmp dword [eax + 0x14], 8
jb 0x1000ce1e
mov eax, dword [eax]
mov ecx, eax
call fcn.100308b0
mov byte [ebp - 0x41], al
and esi, 0xfffffffd
mov dword [ebp - 0x50], esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.10005660
cmp byte [ebp - 0x41], 0
je 0x1000ce4a
mov ecx, dword [ebp - 0x54]
push 1
call fcn.10005130
mov ecx, dword [ebx + 0x9a8]
inc edi
add ecx, 0x550
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp edi, eax
jl 0x1000cdd0
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10005660
mov esi, dword [ebp - 0x4c]
jmp 0x1000ce92
call fcn.10012660
jmp 0x1000ce92
call fcn.10012eb0
jmp 0x1000ce92
push dword [ebp + 0x10]
push esi
call fcn.1000e7e0
cmp dword [ebp - 0x48], 0
je 0x1000c76c
mov eax, dword [ebp - 0x58]
jmp 0x1000c778