Function at 0x1001e022
Capabilities:
Log keystrokes
Query environment variable

Disassembly:
mov eax, 0x1005e389
call fcn.1005d360
sub esp, 0x40
push ebx
push esi
push edi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x24], 0x1d42
cmp dword [ebp - 0x24], 0x746
push 0
pop ebx
jge 0x1001e1f9
lea eax, [ebp - 0x20]
mov esi, 0x10078c70
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
push ecx
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.100053e9
pop ecx
mov ecx, eax
call fcn.100053e9
pop ecx
mov ecx, eax
call fcn.100053e9
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea edx, [ebp - 0x48]
mov dword [ebp - 4], ebx
mov ecx, esi
call fcn.1000a1b6
mov ecx, dword [ebp - 0x38]
mov esi, ebx
test ecx, ecx
je 0x1001e0e6
mov edx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x48]
cmp edx, 0x10
lea eax, [ebp - 0x48]
cmovae eax, edi
cmp byte [eax + esi], 0x2e
jne 0x1001e0df
mov ebx, esi
jmp 0x1001e0c2
cmp edx, 0x10
lea eax, [ebp - 0x48]
cmovae eax, edi
cmp byte [eax + esi], 0x2e
jne 0x1001e0c6
inc esi
cmp esi, ecx
jb 0x1001e0b2
mov eax, esi
sub eax, ebx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.10025830
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x48]
inc esi
cmp esi, ecx
jb 0x1001e09f
xor ebx, ebx
mov ecx, dword [0x1010c4ec]
mov eax, ecx
sub eax, dword [0x1010c4e8]
test eax, 0xfffffffc
jne 0x1001e113
push ebx
mov ecx, 0x10078bb8
call fcn.100171aa
push eax
call fcn.100097f9
pop ecx
mov ecx, dword [0x1010c4ec]
mov eax, dword [0x1010c4e8]
mov edx, ebx
sub ecx, eax
mov dword [ebp - 0x24], edx
sar ecx, 2
mov esi, ebx
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x1001e1dc
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov eax, dword [eax + edx*4]
mov ecx, eax
mov dword [ebp - 0x20], eax
and ecx, 0x80000001
jns 0x1001e14a
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x1001e16c
cdq
sub eax, edx
sar eax, 1
cmp ebx, eax
jl 0x1001e15b
sub ebx, eax
add esi, eax
jmp 0x1001e15f
add esi, ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
cmp edi, eax
jl 0x1001e1be
sub edi, eax
add esi, eax
jmp 0x1001e1c2
mov ecx, dword [ebp - 0x20]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
cmp ebx, edi
jle 0x1001e1a3
cmp edi, eax
jl 0x1001e186
sub edi, eax
add esi, eax
jmp 0x1001e18a
add esi, edi
xor edi, edi
mov dword [ebp - 0x20], edi
cmp ebx, ecx
jl 0x1001e19a
sub ebx, ecx
add esi, ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1001e1c5
add esi, ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1001e1c5
cmp ebx, eax
jl 0x1001e1ad
sub ebx, eax
add esi, eax
jmp 0x1001e1b1
add esi, ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
cmp edi, ecx
jl 0x1001e1be
sub edi, ecx
add esi, ecx
jmp 0x1001e1c2
add esi, edi
xor edi, edi
mov dword [ebp - 0x20], edi
mov edx, dword [ebp - 0x24]
mov eax, dword [0x1010c4e8]
inc edx
mov dword [ebp - 0x24], edx
cmp edx, dword [ebp - 0x2c]
jb 0x1001e135
xor ebx, ebx
push esi
mov ecx, 0x10078bb8
call fcn.100171aa
push eax
call fcn.100097f9
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.10005d35
cmp byte [ebp - 0x14], 0
je 0x1001e214
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001e225
push 1
push ebx
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1001e225
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1001e225
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret