Function at 0x100536a0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 4], ecx
call fcn.10011d50
test eax, eax
jne 0x100536d5
mov edx, dword [ebp + 8]
mov dword [edx + 0x2658], 0xf
mov eax, dword [ebp + 8]
mov dword [eax + 0x2654], 1
jmp 0x100536e2
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2654], 0
cmp dword [0x101af47c], 0x1000
je 0x1005370a
mov edx, dword [ebp + 8]
mov dword [edx + 0x2658], 0x28
mov eax, dword [ebp + 8]
mov dword [eax + 0x2654], 1
jmp 0x10053717
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2654], 0
mov edx, dword [ebp + 8]
cmp dword [edx + 0x2654], 0
je 0x1005374a
call fcn.100114b0
cdq
mov ecx, 0x64
idiv ecx
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2658]
cmp eax, dword [ebp - 0x18]
jl 0x1005374a
mov dword [ebp - 0x1c], 0
jmp 0x10053751
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
jne 0x10053761
mov eax, 1
jmp 0x10053b1e
cmp dword [ebp + 0xc], 0xa0
je 0x10053773
cmp dword [ebp + 0xc], 0xa1
jne 0x1005377a
mov dword [ebp + 0xc], 0x10
cmp dword [ebp + 0xc], 0xa4
je 0x1005378c
cmp dword [ebp + 0xc], 0xa5
jne 0x10053793
mov dword [ebp + 0xc], 0x12
cmp dword [ebp + 0xc], 0xa2
je 0x100537a5
cmp dword [ebp + 0xc], 0xa3
jne 0x100537ac
mov dword [ebp + 0xc], 0x11
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x337c], 0
jne 0x100537cd
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3368]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3368], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x40], 0
jne 0x100537ed
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10053140
add esp, 0xc
jmp 0x10053b19
mov edx, dword [ebp + 8]
cmp dword [edx + 0x40], 1
jne 0x10053a99
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
shl ecx, 0x10
or ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.1004b7e0
add esp, 4
test eax, eax
je 0x10053837
mov ecx, dword [ebp - 8]
or ecx, 0x1000000
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 0
je 0x1005387b
mov eax, dword [ebp + 8]
cmp dword [eax + 0x32d0], 0
jne 0x1005387b
push 0x717be38b
mov ecx, dword [ebp + 8]
push ecx
call fcn.1004dc90
add esp, 8
test eax, eax
jne 0x1005387b
mov edx, dword [ebp - 8]
or edx, 0x4000000
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0x4000000
cmp dword [ebp + 0xc], 0x12
jne 0x1005388b
mov eax, dword [ebp + 8]
mov dword [eax + 0x64], 1
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x64], 0
jne 0x1005389a
cmp dword [ebp + 0xc], 0x79
jne 0x10053905
mov edx, dword [ebp - 8]
or edx, 0x20000000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x32b0], 0
je 0x100538b8
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x32ac], 0
je 0x100538ed
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x32b4]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x104
mov ecx, dword [ebp - 4]
push ecx
call fcn.10051510
add esp, 0x1c
jmp 0x10053903
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x104
mov ecx, dword [ebp - 4]
push ecx
call fcn.10051590
jmp 0x10053962
mov edx, dword [ebp + 8]
cmp dword [edx + 0x32b0], 0
je 0x10053917
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x32ac], 0
je 0x1005394c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x32b4]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x100
mov eax, dword [ebp - 4]
push eax
call fcn.10051510
add esp, 0x1c
jmp 0x10053962
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x100
mov eax, dword [ebp - 4]
push eax
call fcn.10051590
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x2608], 0
je 0x10053985
mov edx, dword [ebp + 8]
mov esi, dword [edx + 0x263c]
call fcn.1004b870
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x10053995
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x263c]
push ecx
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebp + 0xc], 0x12
jne 0x100539a5
mov edx, dword [ebp + 8]
mov dword [edx + 0x64], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x64], 0
jne 0x100539b4
cmp dword [ebp + 0xc], 0x79
jne 0x10053a2b
mov ecx, dword [ebp - 8]
or ecx, 0x20000000
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
or edx, 0xc0000000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x32b0], 0
je 0x100539de
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x32ac], 0
je 0x10053a13
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x32b4]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x105
mov ecx, dword [ebp - 4]
push ecx
call fcn.10051510
add esp, 0x1c
jmp 0x10053a29
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x105
mov ecx, dword [ebp - 4]
push ecx
call fcn.10051590
jmp 0x10053a94
mov edx, dword [ebp - 8]
or edx, 0xc0000000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x32b0], 0
je 0x10053a49
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x32ac], 0
je 0x10053a7e
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x32b4]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x101
mov ecx, dword [ebp - 4]
push ecx
call fcn.10051510
add esp, 0x1c
jmp 0x10053a94
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x101
mov ecx, dword [ebp - 4]
push ecx
call fcn.10051590
jmp 0x10053b19
mov edx, dword [ebp + 8]
cmp dword [edx + 0x40], 2
jne 0x10053b19
cmp dword [ebp + 0xc], 0x12
jne 0x10053ab2
mov eax, dword [ebp + 8]
mov dword [eax + 0x64], 1
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100b06c0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2608], 0
je 0x10053ae7
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 0x2640]
call fcn.1004b870
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x10053af7
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2640]
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebp + 0xc], 0x12
jne 0x10053b07
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x64], 0
push 2
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100b06c0
add esp, 0xc
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret