Function at 0x10073ec0
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [edi + 0x32dc]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, edx
jne 0x10073f15
mov eax, dword [esp + 0xcc]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
cmp dword [0x101d08c0], 0xffffa7c6
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
cmp eax, 4
jne 0x100740c5
cmp dword [0x101d08b4], 0x5441
call fcn.1006f3c0
test eax, eax
je 0x10074029
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dh, dh
mov edx, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
cmp dword [0x101d08d4], 0xfffffede
mov eax, dword [esi]
cmp eax, 1
jne 0x10073fc7
mov ax, word [esi + 4]
mov word [esp + 0x14], ax
push edx
pop edx
mov cx, word [esi + 6]
mov word [esp + 0x16], cx
push ebx
pop ebx
mov edx, dword [esi + 8]
mov dword [esp + 0x18], edx
mov edi, edi
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
cmp dword [0x101d08d4], 0x121
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
cmp dword [0x101d08c0], 0x5839
jmp 0x10074029
cmp eax, ebx
jne 0x10074029
mov edx, dword [esi + 4]
mov dword [esp + 0x14], edx
cmp dword [0x101d08d4], 0x121
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
push edx
pop edx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
cmp dword [0x101d08cc], 0xffffb203
mov edx, dword [esi + 0x10]
mov dword [esp + 0x20], edx
cmp dword [0x101d08b4], 0x5441
mov eax, dword [esi + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov al, al
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
cmp dword [0x101d08c0], 0xffffa7c6
cmp dword [0x101d08b8], 0x2d0b
mov dword [esp + 8], ebx
mov ebp, ebp
mov dword [esp + 0x34], 3
push eax
pop eax
mov dword [esp + 0x38], 1
cmp dword [0x101d08b0], 0x2f18
call fcn.1006f3c0
test eax, eax
je 0x1007406a
lea edx, [esp + 0xc]
mov dword [esp + 0x3c], edx
mov ch, ch
jmp 0x10074078
mov dword [esp + 0x3c], esi
cmp dword [0x101d08c4], 0xab9
mov ecx, ecx
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov bl, bl
cmp dword [0x101d08b8], 0x2d0b
push 1
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
lea edx, [esp + 0x44]
push 0xc
push edx
call fcn.10026710
add esp, 0x18
mov bl, bl
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
cmp eax, 1
push ebp
mov ebp, 3
je 0x100744ac
cmp eax, ebp
je 0x100744ac
cmp eax, 0xa
je 0x100744ac
cmp eax, 0xb
je 0x100744ac
cmp eax, 2
jne 0x1007499e
mov dword [esp + 0xc], ebx
mov ecx, ecx
mov dword [esp + 0x38], ebp
mov bl, bl
mov eax, dword [esi]
cmp eax, 1
jne 0x10074225
cmp dword [0x101d08b0], 0x2f18
mov ebp, ebp
mov dword [esp + 0x3c], 7
cmp dword [0x101d08c0], 0xffffa7c6
movzx edx, word [esi + 4]
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0xbc]
push ecx
push edx
call fcn.1006b770
add esp, 0xc
test eax, eax
je 0x1007499e
test byte [esi + 8], 2
je 0x100741bb
mov al, byte [esp + 0xc0]
test al, al
jbe 0x1007499e
movzx esi, al
push esi
lea eax, [esp + 0xc5]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.1012fbf0
add esp, 0xc
mov cl, cl
mov dword [esp + 0x40], esi
mov edi, edi
push 1
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
add esi, 0xc
lea eax, [esp + 0x48]
push esi
push eax
call fcn.10026710
add esp, 0x18
mov edx, edx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
movzx esi, byte [esp + 0xb8]
push esi
lea ecx, [esp + 0xbd]
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.1012fbf0
add esp, 0xc
mov bh, bh
mov dword [esp + 0x40], esi
cmp dword [0x101d08d4], 0xfffffede
movzx ecx, byte [esp + 0xc0]
push 1
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
add ecx, 0xc
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.10026710
add esp, 0x18
mov bh, bh
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
cmp eax, ebx
jne 0x1007499e
cmp dword [0x101d08b0], 0x2f18
xor ebp, ebp
cmp dword [0x101d08c8], 0x764f
mov dword [esp + 0x3c], 8
mov dh, dh
test byte [esi + 0x10], 1
je 0x10074286
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.10073a00
add esp, 0x18
mov ebp, eax
cmp dword [0x101d08bc], 0x7693
test byte [esi + 0x10], 2
je 0x100742c5
cmp dword [0x101d08b4], 0xffffabbe
mov ebp, ebp
mov byte [esp + 0x44], 9
nop
mov byte [esp + 0x45], bl
cmp dword [0x101d08c4], 0xfffff546
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov al, al
mov ebp, 4
cmp dword [0x101d08c8], 0x764f
test byte [esi + 0x10], 8
je 0x100742fc
cmp dword [0x101d08b4], 0xffffabbe
mov ebp, ebp
mov byte [esp + 0x44], 0xa
nop
mov byte [esp + 0x45], bl
cmp dword [0x101d08c4], 0xfffff546
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov al, al
mov ebp, 4
mov esi, esi
test byte [esi + 0x10], 0x20
je 0x1007433c
cmp dword [0x101d08b4], 0xffffabbe
mov ebp, ebp
mov byte [esp + 0x44], 0xc
cmp dword [0x101d08bc], 0xffff896c
mov byte [esp + 0x45], bl
cmp dword [0x101d08c4], 0xfffff546
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov al, al
mov ebp, 4
mov al, al
test dword [esi + 0x10], 0x800
je 0x100743be
mov ebx, dword [esi + 0xc]
cmp dword [0x101d08b4], 0xffffabbe
mov ebp, ebp
test ebx, ebx
mov byte [esp + 0x44], 8
je 0x10074393
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x10074373
or byte [esp + 0x44], 1
mov bh, bh
push 2
call ebp
test ax, ax
je 0x10074383
or byte [esp + 0x44], 2
mov bl, bl
push 4
call ebp
test ax, ax
je 0x10074393
or byte [esp + 0x44], 4
mov ecx, ecx
mov byte [esp + 0x45], 0
cmp dword [0x101d08c4], 0xfffff546
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], bl
mov al, al
mov ebp, 4
cmp dword [0x101d08c0], 0x5839
xor ebx, ebx
test byte [esi + 0x10], 1
jne 0x100743fb
cmp ebp, ebx
jne 0x100743fb
cmp dword [0x101d08b4], 0xffffabbe
mov ebp, ebp
mov byte [esp + 0x44], 8
mov byte [esp + 0x45], 0
cmp dword [0x101d08c4], 0xfffff546
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
mov al, al
mov ebp, 4
mov ecx, ecx
mov dword [esp + 0x40], ebp
cmp dword [0x101d08b4], 0x5441
test byte [esi + 0x10], 1
je 0x10074478
cmp dword [edi + 0x3300], ebx
je 0x10074478
mov eax, dword [edi + 0x37d0]
cmp eax, 0x398
jae 0x10074478
push ebp
lea edx, [esp + 0x48]
push edx
lea eax, [edi + eax + 0x3380]
push eax
call fcn.1012fbf0
add esp, 0xc
mov eax, eax
mov dword [edi + 0x37d4], 4
cmp dword [0x101d08b0], 0x2f18
add dword [edi + 0x37d0], ebp
cmp dword [0x101d08b8], 0xffffd2f4
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
push 1
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
add ebp, 0xc
lea edx, [esp + 0x48]
push ebp
push edx
call fcn.10026710
add esp, 0x18
mov esi, esi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
mov ch, ch
mov dword [esp + 0x38], ebp
cmp dword [0x101d08c0], 0xffffa7c6
mov eax, dword [esi]
cmp eax, 1
jne 0x10074738
mov eax, dword [edi + 0x32dc]
cmp eax, ebp
mov ebx, 2
jne 0x100744ea
mov dword [esp + 0x3c], 0x14
cmp dword [0x101d08cc], 0x4dfc
jmp 0x10074522
cmp eax, 0xa
jne 0x100744fb
mov dword [esp + 0x3c], 0
mov ecx, ecx
jmp 0x10074522
cmp eax, 0xb
jne 0x10074514
mov dword [esp + 0x3c], 0x10000
cmp dword [0x101d08d0], 0xffffb36b
jmp 0x10074522
mov dword [esp + 0x3c], ebx
cmp dword [0x101d08bc], 0x7693
mov ax, word [esi + 6]
mov word [esp + 0x40], ax
mov eax, dword [esi + 8]
test al, 1
je 0x10074543
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x42], cx
jmp 0x10074563
test al, 2
je 0x1007455a
mov word [esp + 0x42], 1
cmp dword [0x101d08b8], 0xffffd2f4
jmp 0x10074563
mov word [esp + 0x42], 0
push edx
pop edx
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x10074653
mov eax, dword [esi + 8]
test al, 1
je 0x10074653
test al, 2
je 0x100745e9
mov word [esp + 0x40], 0x37
nop
mov word [esp + 0x42], bp
mov ah, ah
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10073d80
cmp dword [0x101d08bc], 0xffff896c
mov word [esp + 0x40], 0x2a
mov edx, edx
mov word [esp + 0x42], bp
cmp dword [0x101d08cc], 0x4dfc
lea edx, [esi + 0xc]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10073d80
mov ebp, ebp
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
mov word [esp + 0x40], 0x2a
push eax
pop eax
mov word [esp + 0x42], bx
mov cl, cl
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10073d80
cmp dword [0x101d08b4], 0x5441
mov word [esp + 0x40], 0x37
cmp dword [0x101d08b4], 0x5441
mov word [esp + 0x42], bx
push edx
pop edx
lea edx, [esi + 0xc]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10073d80
xchg ebx, eax
xchg ebx, eax
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
cmp cx, 0x13
jne 0x10074706
mov eax, dword [esi + 8]
test al, 1
je 0x10074706
test al, 2
jne 0x1007499e
mov ebp, 0x1d
mov word [esp + 0x40], bp
nop
mov word [esp + 0x42], 4
mov edx, edx
xor esi, esi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10073d80
cmp dword [0x101d08cc], 0xffffb203
mov word [esp + 0x40], 0x45
mov dl, dl
mov word [esp + 0x42], si
mov ecx, ecx
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10073d80
push eax
pop eax
mov word [esp + 0x40], bp
mov ebx, ebx
mov word [esp + 0x42], 5
cmp dword [0x101d08cc], 0xffffb203
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10073d80
cmp dword [0x101d08c8], 0x764f
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10073d80
cmp dword [0x101d08b4], 0x5441
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
cmp eax, ebx
jne 0x1007499e
mov dl, dl
xor ecx, ecx
mov ebx, ebx
xor edx, edx
mov ch, ch
xor ebp, ebp
cmp dword [0x101d08bc], 0xffff896c
xor ebx, ebx
cmp dword [0x101d08bc], 0xffff896c
mov bh, bh
mov eax, dword [edi + 0x32dc]
cmp eax, 3
jne 0x1007477a
mov dword [esp + 0x3c], 0x1e
nop
jmp 0x100747b2
cmp eax, 0xa
jne 0x1007478f
mov dword [esp + 0x3c], ecx
cmp dword [0x101d08c4], 0xab9
jmp 0x100747b2
cmp eax, 0xb
jne 0x100747a0
mov dword [esp + 0x3c], 0x10000
push ebx
pop ebx
jmp 0x100747b2
mov dword [esp + 0x3c], 3
cmp dword [0x101d08c4], 0xfffff546
test dword [esi + 0x10], 0x8000
je 0x100747cc
mov eax, 3
cmp dword [0x101d08c0], 0x5839
jmp 0x100747d8
xor eax, eax
cmp dword [0x101d08bc], 0x7693
test byte [esi + 0x10], 1
je 0x100747f8
mov ebp, dword [esi + 4]
cmp dword [0x101d08c4], 0xab9
mov ebx, dword [esi + 8]
cmp dword [0x101d08bc], 0xffff896c
test byte [esi + 0x10], 2
je 0x10074817
mov ecx, 1
cmp dword [0x101d08b0], 0xffffd0e7
cmp dword [0x101d08d4], 0x121
test byte [esi + 0x10], 4
je 0x1007482a
or ecx, 2
cmp dword [0x101d08d4], 0x121
test byte [esi + 0x10], 8
je 0x10074847
or ecx, 4
cmp dword [0x101d08c4], 0xfffff546
cmp dword [0x101d08d0], 0xffffb36b
test byte [esi + 0x10], 0x10
je 0x1007485a
or ecx, 8
cmp dword [0x101d08b0], 0x2f18
test byte [esi + 0x10], 0x20
je 0x1007486f
or ecx, 0x10
mov bh, bh
cmp dword [0x101d08b4], 0xffffabbe
test byte [esi + 0x10], 0x40
je 0x1007487a
or ecx, 0x20
mov dh, dh
test dword [esi + 0x10], 0x800
je 0x100748a1
or ecx, 0x400
cmp dword [0x101d08c0], 0xffffa7c6
movzx edx, word [esi + 0xc]
cmp dword [0x101d08b0], 0x2f18
mov word [esp + 0x40], ax
cmp dword [0x101d08b8], 0x2d0b
mov word [esp + 0x42], cx
push ecx
pop ecx
mov word [esp + 0x44], dx
push eax
pop eax
mov edx, edx
mov dword [esp + 0x46], ebp
cmp dword [0x101d08c4], 0xab9
mov dword [esp + 0x4a], ebx
mov edi, edi
cmp dword [edi + 0x3300], 0
je 0x10074980
mov eax, dword [edi + 0x3360]
cmp eax, 6
jae 0x10074980
mov dx, word [esp + 0x40]
mov word [edi + eax*2 + 0x330c], dx
cmp dword [0x101d08b0], 0xffffd0e7
mov eax, dword [edi + 0x3360]
mov cx, word [esp + 0x42]
mov word [edi + eax*2 + 0x3318], cx
mov ch, ch
mov edx, dword [edi + 0x3360]
mov ax, word [esp + 0x44]
mov word [edi + edx*2 + 0x3324], ax
mov edi, edi
mov ecx, dword [edi + 0x3360]
mov edx, dword [esp + 0x46]
mov dword [edi + ecx*4 + 0x3330], edx
push eax
pop eax
mov eax, dword [edi + 0x3360]
mov ecx, dword [esp + 0x4a]
mov dword [edi + eax*4 + 0x3348], ecx
push eax
pop eax
add dword [edi + 0x3360], 1
cmp dword [0x101d08b4], 0x5441
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret
mov edx, edx
cmp dword [0x101d08b8], 0xffffd2f4
xor esi, esi
lea edx, [esi + 0x16]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10073e20
mov eax, eax
mov ecx, dword [esp + 0xc8]
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.1012e3ba
add esp, 0xc0
ret