Function at 0x1002fe4d
Capabilities:
Get memory capacity
Log keystrokes via polling

Disassembly:
mov eax, 0x1005ae6b
call fcn.10059bf8
sub esp, 0x188
mov byte [ebp - 0x40], cl
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x44], esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10030611
lea eax, [ebp + 0xc]
mov dword [ebp - 0x48], esi
xor ebx, ebx
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x88], 7
mov dword [ebp - 0x8c], ebx
mov word [ebp - 0x9c], ax
mov dword [ebp - 4], ebx
push 0xfffffffffffffff6
pop esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], 0xe125d16d
mov dword [ebp - 0x1c], 0x9f4288a1
mov dword [ebp - 0x14], 0xf782a183
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0x1dfe4b28
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x3c], 0xcb61d225
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x20], 0xdfec
mov dword [ebp - 0x14], ebx
jmp 0x1002fef1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb0], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002fee0
lea eax, [ebp - 0x4c]
push eax
push 0x321e
push 0x3d51
push 0x3a67
push 0x6053
push 1
push 0x2328
call fcn.1002fdf7
add esp, 0x1c
cmp dword [ebp - 0x1c], ebx
jne 0x1002ff6b
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
xor ebx, ebx
add edx, 3
imul edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
cmp edx, 0x3927
setne bl
xor ecx, ecx
cmp eax, ebx
setge cl
xor ebx, ebx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jne 0x1002ff5f
cmp dword [ebp - 0x3c], ebx
jne 0x1002ff5f
mov eax, ebx
jmp 0x1002ff62
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jge 0x1002ff6b
mov eax, ebx
jmp 0x1002ff6e
xor eax, eax
inc eax
xor edx, edx
cmp eax, 0xfffe
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, 7
mov dword [ebp - 0xa8], ecx
je 0x1002ffb7
push 0x3760
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], esi
push ecx
xor eax, eax
lea ecx, [ebp - 0x60]
inc eax
push 0x262b
push eax
push ecx
mov dl, al
mov dword [ebp - 0x60], eax
mov cl, al
call fcn.1002fb4e
add esp, 0x14
jmp 0x1002ffe3
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x14], ebx
jmp 0x1002ffd4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa4], 0xb6f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002ffc3
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1c], eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x9c]
call fcn.1001d185
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x14], 0x1c
jmp 0x10030030
mov dword [ebp - 0x64], 0xffffffff
cmp dword [ebp - 0x14], ebx
je 0x10030026
xor dl, dl
lea ecx, [ebp - 0x64]
call fcn.10031079
mov eax, dword [ebp - 0x14]
jmp 0x1003002d
push ecx
call fcn.100310ac
pop ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jle 0x1003000b
mov eax, dword [0x10076918]
test al, 1
jne 0x1003005f
or eax, 1
mov dword [0x10076918], eax
push 0xca79
mov byte [ebp - 4], 1
call fcn.100296a7
pop ecx
mov word [0x10075588], ax
mov byte [ebp - 4], bl
mov dword [ebp - 0x18], 0x97f6af11
mov dword [ebp - 0x18], 0xfffffffe
cmp dword [ebp - 0x18], 0xffffffed
jne 0x100301ea
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x100300a9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x38], 0x1e29ea41
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1003009b
mov dword [ebp - 0x80], 0xfffffffd
mov dword [ebp - 0x2c], 0x2c34
cmp dword [ebp - 0x2c], 0x2f46
jle 0x10030110
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0xc8]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a21
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100300e9
mov eax, dword [eax]
push eax
call fcn.10041a06
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xc8]
call fcn.10001e51
inc edi
cmp edi, 0x35ab
jl 0x100300ca
inc esi
cmp esi, 0x708f
jl 0x100300c8
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], 0xd
je 0x100301cb
mov dword [ebp - 0x24], 0x2a57
cmp dword [ebp - 0x24], 0x2cff
jle 0x1003015d
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10073e38
cdq
push edx
push eax
call fcn.10001ae9
inc edi
cmp edi, 0x5991
jl 0x10030138
inc esi
cmp esi, 0x677e
jl 0x10030136
mov dword [ebp - 0x14], 0x1dfe0091
mov byte [ebp - 4], 2
cmp dword [ebp - 0x24], 0x27e4
jge 0x100301a4
mov edx, str.lqcmvlaan_iukdjo_kly_ibwaxif_ttlhxl_czxrswg_xhra_cyegfti_npyjc
mov ecx, 0x10073e38
call fcn.100034b8
jmp 0x100301a4
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
jmp 0x100301bd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100301ac
inc dword [ebp - 0x38]
jmp 0x10030113
cmp dword [ebp - 0x2c], 0x2c02
jge 0x100301df
push str.ttvlk_mezkons_auzhz_nwghzua_gwjvga_mynvpf_fypcoy_olqwlzops_fam_lmcmxr_ihbre_rlhfbxudy_rvnkxypv_hjt
call fcn.10041a06
pop ecx
mov dword [ebp - 4], ebx
dec dword [ebp - 0x18]
jmp 0x1003006d
mov eax, dword [0x10076918]
test al, 2
jne 0x10030213
or eax, 2
mov dword [0x10076918], eax
push 0x88fd
mov byte [ebp - 4], 6
call fcn.100296a7
pop ecx
mov word [0x10076930], ax
mov byte [ebp - 4], bl
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x34]
cmp ecx, dword [eax]
jae 0x100304c8
call fcn.1002f346
push 0x24
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x20], 0x5da7
cmp dword [ebp - 0x20], 0x5fef
jle 0x100302aa
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 0x495f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], 0x2a2
mov edi, dword [ebp - 0x14]
mov esi, ebx
mov eax, edi
mov ecx, 0x10073e38
and eax, esi
cdq
push edx
push eax
call fcn.10001ae9
inc esi
cmp esi, 0x38d6
jl 0x10030265
mov edi, dword [ebp - 0x24]
add dword [ebp - 0x14], edi
dec dword [ebp - 0x2c]
jne 0x10030260
mov esi, dword [ebp - 0x3c]
add edi, esi
dec dword [ebp - 0x18]
mov dword [ebp - 0x24], edi
jne 0x10030256
inc esi
mov dword [ebp - 0x3c], esi
cmp esi, 0x3d1a
jl 0x1003024c
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov byte [ebp - 4], 7
cmp dword [ebp - 0x20], 0x5d67
jge 0x100302ea
mov edx, str.viddu_xmv_mngjdetk_jharubup_rhokmhexm_uyrdcmguk_zsri_pcopnby_seaydji_ulu_zefqkhrux_bupxfuoi_neyfiarbh
mov ecx, 0x10073e38
call fcn.100034b8
jmp 0x100302ea
mov dword [ebp - 4], ebx
mov dword [ebp - 0x74], 0x9570a50b
mov dword [ebp - 0x20], 0x2388
cmp dword [ebp - 0x20], 0xd00
jge 0x10030455
push 0xc8
lea eax, [ebp - 0x190]
mov dword [ebp - 0x194], ebx
push ebx
push eax
call fcn.10041ac0
add esp, 0xc
lea eax, [ebp - 0x50]
mov ecx, 0x10073f58
push eax
call fcn.1001912e
mov edi, dword [ebp - 0x50]
test edi, edi
jle 0x10030352
lea esi, [ebp - 0x194]
push esi
mov ecx, 0x10073f58
call fcn.1001912e
add esi, 4
dec edi
jne 0x1003033e
mov edi, dword [ebp - 0x50]
mov ecx, dword [0x100753f0]
lea edx, [edi - 1]
mov dword [ebp - 0x14], edx
test edx, edx
js 0x100303fc
lea esi, [ebp - 0x194]
lea esi, [esi + edx*4]
mov eax, dword [esi]
cmp byte [eax + 0x10074fa0], 0
jne 0x100303ed
cmp esi, ecx
jae 0x100303b6
cmp dword [0x100753ec], esi
ja 0x100303b6
mov edi, esi
sub edi, dword [0x100753ec]
sar edi, 2
cmp ecx, dword [0x100753f4]
jne 0x100303a8
push ecx
call fcn.10031ab5
mov ecx, dword [0x100753f0]
mov edx, dword [ebp - 0x14]
test ecx, ecx
je 0x100303db
mov eax, dword [0x100753ec]
mov eax, dword [eax + edi*4]
jmp 0x100303d3
cmp ecx, dword [0x100753f4]
jne 0x100303cf
push ecx
call fcn.10031ab5
mov ecx, dword [0x100753f0]
mov edx, dword [ebp - 0x14]
mov eax, dword [esi]
test ecx, ecx
je 0x100303db
mov dword [ecx], eax
mov ecx, dword [0x100753f0]
mov eax, dword [esi]
add ecx, 4
mov dword [0x100753f0], ecx
mov byte [eax + 0x10074fa0], 1
dec edx
sub esi, 4
mov dword [ebp - 0x14], edx
test edx, edx
jns 0x1003036f
sub ecx, dword [0x100753ec]
sar ecx, 2
push ecx
mov ecx, 0x10073e38
call fcn.10019550
push eax
call fcn.1001c19b
mov esi, dword [0x100753f0]
mov eax, dword [0x100753ec]
sub esi, eax
sar esi, 2
dec esi
pop ecx
js 0x1003044a
push dword [eax + esi*4]
mov ecx, 0x10073e38
call fcn.1001943e
mov dl, 0x20
mov ecx, eax
call fcn.1001c1f2
dec esi
js 0x1003044a
mov eax, dword [0x100753ec]
jmp 0x1003042a
push 0x10073e38
call fcn.1001c19b
pop ecx
lea eax, [ebp - 0x74]
mov dword [ebp - 0x68], 0x78e0
push eax
push 0x7572
lea eax, [ebp - 0x70]
mov dword [ebp - 0x58], 0xe2cf4565
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], 0xfffffffa
push eax
push 0x3bbe
push ecx
mov dword [ebp - 0x6c], ebx
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x20], 9
lea ecx, [ebp - 0x58]
call fcn.100314e1
add esp, 0x18
mov byte [ebp - 0x26], bl
lea eax, [ebp - 0x26]
push eax
push ecx
call fcn.10031807
pop ecx
lea eax, [ebp - 0x5c]
push eax
sub esp, 0xc
lea ecx, [ebp - 0x9c]
call fcn.100313ea
mov ecx, dword [ebp - 0x1c]
add esp, 0x14
inc ecx
mov dword [ebp - 0x1c], ecx
jmp 0x10030218
mov dword [ebp - 0x18], 0xb4ffb87
xor ecx, ecx
mov dword [ebp - 0x1c], 0xfffffffa
inc ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
jmp 0x100304ef
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100304e1
push ecx
push 0x61f1
push 0xcc9
push ecx
mov byte [ebp - 0x27], bl
lea ecx, [ebp - 0x27]
push 0x2f3e
xor dl, dl
call fcn.100310cf
add esp, 0x14
mov dword [ebp - 0x18], ebx
jmp 0x100305e0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x100305dd
mov dword [ebp - 0x1c], 0x401dbdae
xor ebx, ebx
inc ebx
xor ecx, ecx
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x18]
test eax, eax
setns cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0x1c], 0xbc9b780f
sbb eax, eax
xor ecx, ecx
neg eax
imul edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
sub edx, 6
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
imul ecx, ecx, 0xfffa
mov eax, dword [ebp + eax*4 - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg bl
xor ecx, ecx
cmp ebx, eax
setg cl
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x14]
jns 0x10030533
xor ebx, ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1003051d
mov esi, dword [ebp - 0x44]
lea eax, [ebp - 0x9c]
cmp esi, eax
je 0x10030601
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.10007120
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.10006eef
jmp 0x10030636
push 0x3745
push 0x3f87
lea eax, [ebp - 0x25]
mov byte [ebp - 0x25], 0
push eax
mov dl, 1
push 0
push 0x56fa
mov cl, dl
call fcn.1002fb4e
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret