Function at 0x1003d8e1
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x10065b2d
call fcn.100641f8
sub esp, 0x4c
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
je 0x1003d941
cmp byte [ebp + 0x18], 0
je 0x1003d91d
push 0
push 0x910
push 0x15ab
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1003db52
mov byte [ebp + 0x27], 0
cmp byte [ebp + 0x27], 0
je 0x1003db52
push 0x425d
push ecx
push ecx
xor dl, dl
call fcn.1003d1e2
add esp, 0xc
jmp 0x1003db52
cmp byte [ebp + 0x28], 0
je 0x1003db45
mov dword [ebp + 0x24], 0x708a
xor esi, esi
cmp dword [ebp + 0x24], 0x72bc
jle 0x1003d99b
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edi, esi
mov ebx, esi
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x10081de8
cdq
push edx
push eax
call fcn.1000d012
inc ebx
cmp ebx, 0x4b6c
jl 0x1003d976
inc edi
cmp edi, 0x72be
jl 0x1003d974
mov dword [ebp - 4], esi
cmp dword [ebp + 0x24], 0x6e3f
jge 0x1003d9b6
mov edx, str.nefur_udvjpyrxo_fzdpqenl_zlgrwtcax_gyp
mov ecx, 0x10081de8
call fcn.1000ff9e
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x7710
cmp dword [ebp - 0x14], 0x79af
jle 0x1003da28
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edi, esi
mov ebx, esi
mov ecx, esi
mov dword [ebp + 0x24], esi
lea eax, [ebx + edi]
and eax, ecx
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d9f5
mov eax, dword [eax]
push eax
call fcn.1004c39e
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.1000205a
mov ecx, dword [ebp + 0x24]
inc ecx
mov dword [ebp + 0x24], ecx
cmp ecx, 0x6a27
jl 0x1003d9db
inc ebx
cmp ebx, 0x643c
jl 0x1003d9d6
inc edi
cmp edi, 0x659a
jl 0x1003d9d4
cmp dword [ebp - 0x14], 0x739f
jge 0x1003da3c
push str.lpcginfgz_djovrkadd_njt_uamgu_lusdlniy_jsvkpnesk_rigcrxxvy_izovo_wxh_gnpnrx
call fcn.1004c39e
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x76d7
cmp dword [ebp - 0x1c], 0x7701
jle 0x1003daca
mov edi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x14], esi
mov ecx, ebx
mov dword [ebp - 0x20], esi
mov edx, edi
mov ebx, esi
sar edx, cl
mov dword [ebp + 0x24], edx
mov edi, esi
mov eax, edi
lea ecx, [ebp - 0x58]
xor eax, ebx
or eax, edx
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003da85
mov eax, dword [eax]
push eax
call fcn.1004c39e
pop ecx
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.1000205a
mov edx, dword [ebp + 0x24]
inc edi
cmp edi, 0x5c38
jl 0x1003da6a
inc ebx
cmp ebx, 0x5437
jl 0x1003da68
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x7d26
jl 0x1003da5a
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x6357
jl 0x1003da55
cmp dword [ebp - 0x1c], 0x76a5
jge 0x1003dade
push str.rmxlg_ctumtitr_danmtkanl_lbe_rxph_imiq_xxmpsyv_rmgeol_kuqjyfiqk_wrqbzf_odjxqmdav
call fcn.1004c39e
pop ecx
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x20]
dec dword [eax]
mov eax, dword [edx]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov eax, dword [ebp + 0x14]
cmp dword [eax], esi
je 0x1003db25
mov eax, dword [ebp - 0x28]
cmp dword [eax], esi
je 0x1003db25
xor eax, eax
inc eax
jmp 0x1003db27
mov eax, esi
mov ecx, 0xbe7e5505
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
add ecx, eax
mov eax, dword [edx]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp + 0x10]
setg dl
mov dword [eax], edx
jmp 0x1003db52
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret