Function at 0x7cfb55e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x380
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov ecx, 0xffffff5f
push edi
mov eax, dword [esi + 8]
cmp eax, ecx
ja 0x7cfb5b61
je 0x7cfb5b2e
cmp eax, 0xffffff4d
je 0x7cfb5b08
cmp eax, 0xffffff4f
je 0x7cfb5805
cmp eax, 0xffffff50
je 0x7cfb5734
cmp eax, 0xffffff51
jne 0x7cfb5fe1
push dword [esi + 0x10]
push dword [esi + 0x2c]
push ebx
call fcn.7cfb4b21
xor edi, edi
mov dword [ebp + 8], eax
cmp eax, edi
mov dword [ebp - 8], 0x10
je 0x7cfb5728
mov eax, dword [ebx + 0x90]
lea edx, [ebp - 8]
push edx
lea edx, [ebp + 8]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x7cfb5728
test byte [ebp - 8], 0x10
je 0x7cfb5728
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
or byte [ebx + 0x148], 0x80
push edi
push edi
push 0x1018
push dword [ebx + 0xd4]
call esi
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x7cfb5fe1
lea eax, [ebp - 4]
mov ecx, ebx
push eax
mov dword [ebp - 4], edi
push dword [ebp + 8]
push 0xd
call fcn.7cf5d4a3
cmp dword [ebp - 4], edi
je 0x7cfb56cc
push edi
push dword [ebp - 4]
push 0xc5
push dword [ebp - 0xc]
call esi
mov ebx, dword [ebx + 0x90]
lea ecx, [ebp - 0x168]
push ecx
push 0x1001
push dword [ebp + 8]
mov eax, dword [ebx]
push ebx
call dword [eax + 0x2c]
test eax, eax
jl 0x7cfb5fe1
lea eax, [ebp - 0x380]
push 0x104
push eax
lea eax, [ebp - 0x168]
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRetToBufW]
test eax, eax
jl 0x7cfb5fe1
lea eax, [ebp - 0x380]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x7cfb5fe1
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x7cfb5c98
and byte [ebx + 0x148], 0x7f
cmp dword [esi + 0x20], 0
je 0x7cfb5c98
push dword [esi + 0x10]
push dword [esi + 0x2c]
push ebx
call fcn.7cfb4b21
test eax, eax
mov dword [ebp + 8], eax
je 0x7cfb5fe1
lea eax, [ebp - 0x380]
push 0x104
push eax
push dword [esi + 0x20]
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToUnicode]
mov eax, ebx
mov edi, dword [sym.imp.SHLWAPI.dll_IUnknown_SetSite]
neg eax
lea ecx, [ebx + 8]
sbb eax, eax
and eax, ecx
push eax
push dword [ebx + 0x90]
call edi
mov eax, dword [ebx + 0x90]
push 0
lea edx, [ebp - 0x380]
push 1
mov ecx, dword [eax]
push edx
push dword [ebp + 8]
push dword [ebx + 0xcc]
push eax
call dword [ecx + 0x30]
test eax, eax
jl 0x7cfb57df
xor esi, esi
push esi
push esi
push 0x1000
push esi
call sym.SHELL32.dll_SHChangeNotify
mov ecx, dword [ebx + 0x9c]
cmp ecx, esi
je 0x7cfb57f6
mov eax, dword [ebx + 0x8c]
cmp eax, esi
jne 0x7cfb57d4
mov eax, ebx
mov edx, dword [ecx]
push 3
push eax
push ecx
call dword [edx + 0x10]
jmp 0x7cfb57f6
push dword [esi + 0x20]
push dword [esi + 0x10]
push 0x1076
push dword [ebx + 0xd4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [ebx + 0x90]
call edi
jmp 0x7cfb5fe1
test byte [esi + 0xc], 3
je 0x7cfb5fe1
push dword [esi + 0x10]
push dword [esi + 0x2c]
push ebx
call fcn.7cfb4b21
test eax, eax
mov dword [ebp + 8], eax
je 0x7cfb5fe1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x7cfb583b
lea ecx, [ebp - 0xc]
push ecx
push eax
mov ecx, ebx
call fcn.7cfb66eb
jmp 0x7cfb583f
and dword [ebp - 0xc], 0
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
or dword [esi + 0x28], 0xffffffff
or dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0xc]
and eax, 3
mov dword [ebp - 0x2c], ecx
test ecx, ecx
mov dword [ebp - 0x34], eax
jne 0x7cfb59e3
test al, 2
je 0x7cfb59e3
cmp dword [ebx + 0xb8], ecx
lea edi, [ebx + 0xb8]
jne 0x7cfb588b
mov eax, dword [ebx + 0x90]
push edi
push 0x7cf39730
push eax
mov ecx, dword [eax]
call dword [ecx]
cmp dword [edi], 0
mov dword [ebp - 4], 0x80000
jne 0x7cfb589e
mov dword [ebp - 4], 0xb0000
mov eax, dword [ebx + 0x90]
lea edx, [ebp - 4]
push edx
lea edx, [ebp + 8]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0x24]
test eax, eax
jge 0x7cfb58bc
and dword [ebp - 4], 0
or dword [ebp - 0x34], 8
or dword [esi + 0xc], 8
and dword [ebp - 0x28], 0
cmp dword [ebx + 0xb8], 0
mov edi, 0xf00
mov dword [ebp - 0x24], edi
je 0x7cfb596b
or eax, 0xffffffff
test byte [ebx + 0xa4], 8
je 0x7cfb590f
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, ebx
push dword [esi + 0x10]
push 0x47
call fcn.7cf5d4a3
mov eax, dword [ebp - 8]
test eax, eax
jle 0x7cfb590f
or dword [ebp - 0x24], edi
mov ecx, eax
shl ecx, 8
or dword [ebp - 0x28], ecx
cmp eax, 0xffffffff
jne 0x7cfb5987
mov eax, dword [ebx + 0xb8]
lea edx, [ebp - 8]
push edx
mov dword [ebp - 8], 0xffffeeee
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, reloc.COMCTL32.dll_DPA_SaveStream
jne 0x7cfb5944
push dword [ebp - 0x30]
mov ecx, ebx
push dword [ebp + 8]
call fcn.7cf64267
jmp 0x7cfb5987
test eax, eax
jl 0x7cfb5987
test byte [ebx + 0xa4], 8
je 0x7cfb5960
push dword [ebp - 8]
mov ecx, ebx
push dword [ebp - 0x30]
push 0x48
call fcn.7cf5d4a3
mov eax, dword [ebp - 8]
shl eax, 8
mov dword [ebp - 0x28], eax
jmp 0x7cfb5987
test byte [ebp - 2], 1
je 0x7cfb597a
mov dword [ebp - 0x28], 0x200
jmp 0x7cfb5987
test byte [ebp - 2], 2
je 0x7cfb5987
mov dword [ebp - 0x28], 0x100
test byte [ebp - 2], 8
je 0x7cfb5997
or dword [ebp - 0x24], 4
or dword [ebp - 0x28], 4
jmp 0x7cfb599f
or dword [ebp - 0x24], 4
and dword [ebp - 0x28], 0xfffffffb
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x18], eax
test byte [ebx + 0xa4], 8
je 0x7cfb59c4
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
push dword [esi + 0x10]
push 0x37
call fcn.7cf5d4a3
cmp dword [ebp - 0x18], 0xffffffff
jne 0x7cfb59da
lea eax, [ebp - 0x18]
push 1
push eax
mov ecx, ebx
push dword [ebp + 8]
call fcn.7cf6004a
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x34]
test al, 1
mov edi, 0x1000
je 0x7cfb5af6
xor ecx, ecx
cmp dword [esi + 0x24], ecx
je 0x7cfb59fd
mov eax, dword [esi + 0x20]
mov word [eax], cx
and byte [ebp - 0x168], 0
or dword [ebp - 0x64], 0xffffffff
cmp dword [ebp - 0x2c], ecx
mov dword [ebp - 0x16c], 2
jne 0x7cfb5a71
mov ebx, dword [ebx + 0x90]
lea ecx, [ebp - 0x16c]
push ecx
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x380]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x104
mov eax, dword [ebx]
push ebx
call dword [eax + 0x2c]
test eax, eax
jl 0x7cfb5af6
push dword [ebp - 0x1c]
lea eax, [ebp - 0x16c]
push dword [ebp - 0x20]
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRetToBufW]
push dword [esi + 0x24]
push dword [ebp - 0x20]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x7cfb5af6
mov eax, dword [ebx + 0x94]
cmp eax, ecx
je 0x7cfb5aa5
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push dword [ebp - 0x2c]
push eax
call dword [ecx + 0x40]
test eax, eax
jl 0x7cfb5aa5
test byte [ebp - 8], 0x20
je 0x7cfb5aa5
mov eax, dword [ebx + 0x14c]
shr eax, 1
test al, 1
je 0x7cfb5fea
or dword [esi + 0xc], edi
mov eax, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x178], eax
mov eax, dword [ebx + 0xe0]
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x178]
push eax
push dword [ebp - 0x2c]
call fcn.7cfb459c
test eax, eax
jl 0x7cfb5af6
push dword [esi + 0x24]
lea eax, [ebp - 0x16c]
push dword [esi + 0x20]
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRetToBufW]
mov eax, dword [ebp - 0x64]
cmp eax, 0xffffffff
je 0x7cfb5af6
test byte [esi + 0xc], 2
je 0x7cfb5af6
mov dword [esi + 0x28], eax
cmp dword [ebp - 0x2c], 0
jne 0x7cfb5fe1
or dword [esi + 0xc], edi
jmp 0x7cfb5fe1
or dword [ebp + 8], 0xffffffff
lea eax, [ebp + 8]
push esi
push eax
push 0x2d
mov ecx, ebx
call fcn.7cf5d4a3
test eax, eax
jl 0x7cfb5b26
mov eax, dword [ebp + 8]
jmp 0x7cfb5fe3
or eax, 0xffffffff
jmp 0x7cfb5fe3
cmp dword [ebx + 0x168], 0
je 0x7cfb5fe1
test byte [esi + 0xc], 1
je 0x7cfb5fe1
push dword [esi + 0x20]
mov ecx, ebx
push dword [esi + 0x24]
push 0x36
call fcn.7cf5d4a3
test eax, eax
jl 0x7cfb5fe1
jmp 0x7cfb5c98
mov ecx, 0xffffff65
cmp eax, ecx
ja 0x7cfb5b91
je 0x7cfb5b84
cmp eax, 0xffffff62
jne 0x7cfb5fe1
push esi
mov ecx, ebx
call fcn.7cfb54ad
jmp 0x7cfb5fe1
push esi
mov ecx, ebx
call fcn.7cfb4ac9
jmp 0x7cfb5fe1
cmp eax, 0xfffffff4
ja 0x7cfb5e8d
je 0x7cfb5e12
cmp eax, 0xffffff93
ja 0x7cfb5c67
je 0x7cfb5c49
cmp eax, 0xffffff8d
je 0x7cfb5c0e
cmp eax, 0xffffff8e
je 0x7cfb5bdd
cmp eax, 0xffffff8f
je 0x7cfb5bcc
cmp eax, 0xffffff91
je 0x7cfb5c49
jmp 0x7cfb5fe1
push esi
push 0
push 0x3e
mov ecx, ebx
call fcn.7cf5d4a3
jmp 0x7cfb5fe1
test byte [ebx + 0x149], 1
jne 0x7cfb5fe1
mov eax, dword [ebx + 0xd0]
test eax, eax
je 0x7cfb5c01
push 0
push 0
push 0x1f
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov ecx, ebx
call fcn.7cf6d42f
jmp 0x7cfb5fe1
mov edi, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
mov eax, edi
mov dword [ebp + 8], edi
xor eax, edx
test al, 2
je 0x7cfb5fe1
push 0xa
xor eax, eax
pop ecx
lea edi, [ebp - 0x5c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x60]
mov eax, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x4c], edx
push eax
jmp 0x7cfb5d06
mov eax, dword [ebx + 0x148]
shr eax, 8
test al, 1
jne 0x7cfb5fe1
push esi
mov ecx, ebx
call fcn.7cfb4f98
jmp 0x7cfb5fe3
cmp eax, 0xffffff94
je 0x7cfb5d2c
cmp eax, 0xffffff99
je 0x7cfb5d12
cmp eax, 0xffffff9b
je 0x7cfb5ca0
cmp eax, 0xffffff9c
jne 0x7cfb5fe1
mov eax, dword [ebx + 0x148]
shr eax, 8
test al, 1
je 0x7cfb5fe1
push 1
pop eax
jmp 0x7cfb5fe3
mov eax, dword [esi + 0x1c]
test al, 8
jne 0x7cfb5cc1
test al, 1
je 0x7cfb5fe1
test byte [ebx + 0x149], 0x20
push 1
pop eax
jne 0x7cfb5cbe
push 3
pop eax
push eax
jmp 0x7cfb5d21
mov eax, dword [esi + 0x18]
xor eax, dword [esi + 0x14]
test al, 3
je 0x7cfb5fe1
test byte [ebx + 0x148], 1
jne 0x7cfb5cf7
mov eax, dword [ebx + 0x9c]
test eax, eax
je 0x7cfb5cf7
mov ecx, dword [ebx + 0x8c]
test ecx, ecx
jne 0x7cfb5cee
mov ecx, ebx
mov edx, dword [eax]
push 2
push ecx
push eax
call dword [edx + 0x10]
mov eax, dword [esi + 0x18]
xor eax, dword [esi + 0x14]
test al, 2
je 0x7cfb5fe1
push esi
mov ecx, ebx
call fcn.7cf6d01e
jmp 0x7cfb5fe1
push dword [esi + 0x28]
mov ecx, ebx
push dword [esi + 0xc]
call fcn.7cfb4a7d
push 0xffffffffffffffff
push ebx
call fcn.7cfb4e05
jmp 0x7cfb5fe1
xor eax, eax
cmp dword [ebx + 0x94], eax
jne 0x7cfb5d4a
cmp dword [ebx + 0x10c], eax
jne 0x7cfb5d4a
cmp dword [ebx + 0x168], eax
je 0x7cfb5fe1
push 0xffffffffffffffff
mov ecx, ebx
call fcn.7cfb8256
test eax, eax
je 0x7cfb5fe1
mov eax, dword [ebx + 0x128]
mov edi, dword [ebx + 0x120]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x124]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
push eax
mov ecx, ebx
push dword [esi + 0x10]
call fcn.7cfb66eb
mov edx, dword [ebp + 8]
push 1
cmp dword [ebx + 0x128], edx
pop eax
jne 0x7cfb5d9f
mov ecx, dword [ebx + 0x124]
neg ecx
mov dword [ebx + 0x124], ecx
jmp 0x7cfb5da5
mov dword [ebx + 0x124], eax
mov ecx, dword [ebx + 0x10c]
test ecx, ecx
je 0x7cfb5db6
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x10]
test eax, eax
je 0x7cfb5ddd
push 0
mov ecx, ebx
push dword [ebp + 8]
push 0x18
call fcn.7cf5d4a3
test eax, eax
je 0x7cfb5ddd
push dword [ebp + 8]
mov ecx, dword [ebx + 4]
lea eax, [ebx + 4]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x7cfb5de2
mov eax, dword [ebp + 8]
jmp 0x7cfb5e07
mov eax, dword [ebp - 0xc]
mov ecx, ebx
mov dword [ebx + 0x124], eax
mov eax, dword [ebx + 0x120]
mov dword [ebx + 0x128], eax
mov dword [ebx + 0x120], edi
call fcn.7cfb69a5
mov eax, dword [ebp - 4]
mov dword [ebx + 0x128], eax
jmp 0x7cfb5fe1
mov eax, dword [esi + 0xc]
dec eax
je 0x7cfb5e76
sub eax, 0x10000
jne 0x7cfb5fe1
push dword [esi + 0x24]
push dword [esi + 0x2c]
push ebx
call fcn.7cfb4b21
test eax, eax
mov dword [ebp - 0xc], eax
je 0x7cfb5fe1
mov ebx, dword [ebx + 0x90]
lea ecx, [ebp + 8]
push ecx
mov edi, 0x4000000
lea ecx, [ebp - 0xc]
mov dword [ebp + 8], edi
mov eax, dword [ebx]
push ecx
push 1
push ebx
call dword [eax + 0x24]
test eax, eax
jl 0x7cfb5fe1
test dword [ebp + 8], edi
je 0x7cfb5fe1
call fcn.7cfb5584
mov dword [esi + 0x30], eax
jmp 0x7cfb5fe1
mov eax, dword [ebx + 0x148]
shr eax, 0x10
movzx eax, al
and eax, 1
shl eax, 5
jmp 0x7cfb5fe3
cmp eax, 0xfffffff8
je 0x7cfb5f9a
cmp eax, 0xfffffff9
je 0x7cfb5f22
cmp eax, 0xfffffffb
jne 0x7cfb5fe1
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x7cfb5fe1
mov eax, dword [esi + 0xc]
test eax, eax
jl 0x7cfb5fe1
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 2
push eax
push 0x102c
push dword [ebx + 0xd4]
call edi
test al, 2
jne 0x7cfb5fe1
and dword [ebp - 0x50], 0
lea eax, [ebp - 0x5c]
push eax
push 0xffffffffffffffff
push 0x102b
mov dword [ebp - 0x4c], 2
push dword [ebx + 0xd4]
call edi
push 2
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
push dword [esi + 0xc]
push 0x102b
push dword [ebx + 0xd4]
call edi
jmp 0x7cfb5fe1
mov eax, dword [ebx + 0x400]
cmp eax, 0xfffffffd
jne 0x7cfb5f3b
xor eax, eax
cmp dword [ebx + 0x430], 0xfffffffe
setne al
jmp 0x7cfb5f45
xor ecx, ecx
cmp eax, 0xfffffffe
setne cl
mov eax, ecx
test eax, eax
je 0x7cfb5f53
mov eax, dword [ebx]
push 2
push ebx
call dword [eax + 0x1c]
jmp 0x7cfb5f91
mov ecx, ebx
call fcn.7cf6ca61
mov eax, dword [ebx + 0x9c]
test eax, eax
je 0x7cfb5f79
mov ecx, dword [ebx + 0x8c]
test ecx, ecx
jne 0x7cfb5f70
mov ecx, ebx
mov edx, dword [eax]
push 0
push ecx
push eax
call dword [edx + 0x10]
push 2
mov ecx, ebx
call fcn.7cf5d4c9
mov ecx, ebx
call fcn.7cf5d520
push 0
push ebx
call fcn.7cf5d57c
or byte [ebx + 0x14b], 0x40
jmp 0x7cfb5fda
mov ecx, dword [ebx + 0x9c]
test ecx, ecx
je 0x7cfb5fb9
mov eax, dword [ebx + 0x8c]
test eax, eax
jne 0x7cfb5fb0
mov eax, ebx
mov edx, dword [ecx]
push 1
push eax
push ecx
call dword [edx + 0x10]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [ebx + 0xcc]
je 0x7cfb5fd3
push dword [ebx + 0xd4]
call dword [sym.imp.USER32.dll_UpdateWindow]
and byte [ebx + 0x14b], 0xbf
mov ecx, ebx
call fcn.7cfb6198
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x2c]
push dword [ebx + 0xe0]
push dword [ebp + 8]
push ebx
call fcn.7cffa8fd
test eax, eax
jl 0x7cfb5aa5
push 0x10000000
push 0
push 0x7cf39d00
push dword [ebp - 4]
push ebx
call fcn.7cf643b2
test eax, eax
je 0x7cfb5aa5
mov eax, dword [esi + 0x14]
and dword [ebp - 0x48], 0
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x5c]
push eax
push dword [esi + 0x10]
push 0x1074
push dword [ebx + 0xd4]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHLWAPI.dll_IUnknown_AtomicRelease]
jmp 0x7cfb5fe1