Function at 0x10029ad0
Capabilities:
Log keystrokes via polling
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x100d0320]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x138], ecx
xor eax, eax
mov word [ebp - 0x14c], ax
push 0x12c
push 0
lea ecx, [ebp - 0x130]
push ecx
call fcn.10051de0
add esp, 0xc
mov byte [ebp - 0x141], 1
mov edx, dword [ebp + 8]
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x138]
mov cl, byte [ebp + 0xc]
mov byte [eax], cl
mov edx, dword [ebp - 0x138]
mov byte [edx + 1], 0
mov eax, dword [ebp - 0x138]
mov byte [eax + 3], 0
mov ecx, dword [ebp - 0x138]
mov byte [ecx + 4], 0
mov edx, dword [ebp - 0x138]
mov byte [edx + 2], 0
mov eax, dword [ebp - 0x138]
mov byte [eax + 5], 0
mov ecx, dword [ebp - 0x148]
mov dl, byte [ecx]
mov byte [ebp - 0x131], dl
movsx eax, byte [ebp - 0x131]
test eax, eax
je 0x1002a1af
movsx ecx, byte [ebp - 0x131]
mov dword [ebp - 0x15c], ecx
mov edx, dword [ebp - 0x15c]
sub edx, 0x25
mov dword [ebp - 0x15c], edx
cmp dword [ebp - 0x15c], 0x59
ja case.0x10029ba8.1
mov eax, dword [ebp - 0x15c]
movzx ecx, byte [eax + 0x1002a200]
jmp dword [ecx*4 + 0x1002a1dc]
mov edx, dword [ebp - 0x138]
mov byte [edx + 1], 1
jmp 0x1002a19b
mov eax, dword [ebp - 0x138]
mov byte [eax + 1], 0
mov ecx, dword [ebp - 0x138]
call fcn.100295a0
jmp 0x1002a19b
mov ecx, dword [ebp - 0x138]
mov byte [ecx + 3], 1
push 0
push 0
push 1
push 0x12
mov ecx, dword [ebp - 0x138]
call fcn.100298d0
jmp 0x1002a19b
mov edx, dword [ebp - 0x138]
mov byte [edx + 2], 1
push 0
push 0
push 1
push 0x10
mov ecx, dword [ebp - 0x138]
call fcn.100298d0
jmp 0x1002a19b
mov eax, dword [ebp - 0x138]
mov byte [eax + 4], 1
push 0
push 0
push 1
push 0x11
mov ecx, dword [ebp - 0x138]
call fcn.100298d0
jmp 0x1002a19b
mov ecx, dword [ebp - 0x138]
mov byte [ecx + 5], 1
push 0
push 0
push 1
push 0x5b
mov ecx, dword [ebp - 0x138]
call fcn.100298d0
jmp 0x1002a19b
push 0
push 1
push 1
push 0xd
mov ecx, dword [ebp - 0x138]
call fcn.100298d0
mov ecx, dword [ebp - 0x138]
call fcn.100295a0
jmp 0x1002a19b
mov edx, dword [ebp - 0x148]
add edx, 1
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp - 0x13c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10029cbe
mov edx, dword [ebp - 0x13c]
movsx eax, byte [edx]
cmp eax, 0x7d
je 0x10029cbe
mov ecx, dword [ebp - 0x13c]
add ecx, 1
mov dword [ebp - 0x13c], ecx
jmp 0x10029c92
mov edx, dword [ebp - 0x13c]
sub edx, dword [ebp - 0x148]
mov dword [ebp - 0x150], edx
cmp dword [ebp - 0x150], 0x12c
jbe 0x10029ce3
xor al, al
jmp 0x1002a1ca
mov eax, dword [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x148]
add ecx, 1
push ecx
lea edx, [ebp - 0x130]
push edx
call fcn.10072538
add esp, 0xc
mov eax, dword [ebp - 0x150]
sub eax, 1
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x12c
jae 0x10029d20
jmp 0x10029d25
call fcn.1004d5c7
mov ecx, dword [ebp - 0x160]
mov byte [ebp + ecx - 0x130], 0
mov dword [ebp - 0x158], 0xffffffff
mov edx, dword [ebp - 0x148]
add edx, dword [ebp - 0x150]
mov dword [ebp - 0x148], edx
mov eax, 0xffff
mov word [ebp - 0x140], ax
push 4
push str.VKEY
lea ecx, [ebp - 0x130]
push ecx
call fcn.1007261a
add esp, 0xc
test eax, eax
jne 0x10029d9c
lea edx, [ebp - 0x12c]
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp - 0x13c]
push eax
call fcn.1005d9fc
add esp, 4
mov word [ebp - 0x140], ax
jmp 0x10029fd2
push 4
push str.BEEP
lea ecx, [ebp - 0x130]
push ecx
call fcn.1007261a
add esp, 0xc
test eax, eax
jne 0x10029e50
lea edx, [ebp - 0x12b]
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x154], eax
push 0x100ad8c8
mov ecx, dword [ebp - 0x13c]
push ecx
call fcn.10072808
add esp, 8
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
je 0x10029e4b
mov edx, dword [ebp - 0x154]
mov byte [edx], 0
mov eax, dword [ebp - 0x154]
add eax, 1
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x13c]
push ecx
call fcn.1005d9fc
add esp, 4
mov dword [ebp - 0x168], eax
mov edx, dword [ebp - 0x154]
push edx
call fcn.1005d9fc
add esp, 4
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
push eax
mov ecx, dword [ebp - 0x168]
push ecx
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x10029fd2
push 0xb
push str.APPACTIVATE
lea edx, [ebp - 0x130]
push edx
call fcn.1007261a
add esp, 0xc
test eax, eax
jne 0x10029e92
lea eax, [ebp - 0x124]
mov dword [ebp - 0x13c], eax
push 0
mov ecx, dword [ebp - 0x13c]
push ecx
call fcn.10028a00
add esp, 8
mov byte [ebp - 0x141], al
jmp 0x10029fd2
push 5
push str.DELAY
lea edx, [ebp - 0x130]
push edx
call fcn.1007261a
add esp, 0xc
test eax, eax
jne 0x10029f12
lea eax, [ebp - 0x12b]
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
movsx edx, byte [ecx]
cmp edx, 0x3d
jne 0x10029ee3
mov eax, dword [ebp - 0x13c]
add eax, 1
push eax
call fcn.1005d9fc
add esp, 4
mov ecx, dword [ebp - 0x138]
mov dword [ecx + 8], eax
jmp 0x10029f0d
mov edx, dword [ebp - 0x13c]
push edx
call fcn.1005d9fc
add esp, 4
mov ecx, dword [ebp - 0x138]
mov dword [ecx + 0xc], eax
push 1
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x10029fd2
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x130]
push edx
call fcn.1002a260
add esp, 8
mov word [ebp - 0x140], ax
cmp dword [ebp - 0x158], 0xffffffff
je 0x10029fd2
mov eax, 1
mov word [ebp - 0x14c], ax
mov ecx, dword [ebp - 0x158]
mov edx, dword [ecx*8 + 0x100d0038]
push edx
call fcn.1005bd80
add esp, 4
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x130]
push eax
call fcn.1005bd80
add esp, 4
cmp eax, dword [ebp - 0x150]
jbe 0x10029fa4
mov ecx, dword [ebp - 0x150]
lea edx, [ebp + ecx - 0x130]
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp - 0x13c]
push eax
call fcn.1005d9fc
add esp, 4
mov word [ebp - 0x14c], ax
mov ecx, dword [ebp - 0x158]
movzx edx, byte [ecx*8 + 0x100d003d]
test edx, edx
je 0x10029fd2
mov eax, dword [ebp - 0x158]
movzx ecx, byte [eax*8 + 0x100d003c]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov word [ebp - 0x140], ax
movzx edx, word [ebp - 0x140]
cmp edx, 0xffff
je 0x1002a009
push 1
movzx eax, word [ebp - 0x14c]
push eax
movzx ecx, word [ebp - 0x140]
push ecx
mov ecx, dword [ebp - 0x138]
call fcn.10029790
mov ecx, dword [ebp - 0x138]
call fcn.100295a0
jmp 0x1002a19b
movzx edx, byte [ebp - 0x131]
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov word [ebp - 0x140], ax
mov eax, dword [ebp - 0x138]
movzx ecx, byte [eax + 1]
test ecx, ecx
jne 0x1002a172
movsx edx, byte [ebp - 0x131]
cmp edx, 0x41
jl 0x1002a051
movsx eax, byte [ebp - 0x131]
cmp eax, 0x5a
jle 0x1002a155
movsx ecx, byte [ebp - 0x131]
cmp ecx, 0x5f
je 0x1002a155
movsx edx, byte [ebp - 0x131]
cmp edx, 0x3a
je 0x1002a155
movsx eax, byte [ebp - 0x131]
cmp eax, 0x3c
je 0x1002a155
movsx ecx, byte [ebp - 0x131]
cmp ecx, 0x3e
je 0x1002a155
movsx edx, byte [ebp - 0x131]
cmp edx, 0x3f
je 0x1002a155
movsx eax, byte [ebp - 0x131]
cmp eax, 0x2b
je 0x1002a155
movsx ecx, byte [ebp - 0x131]
cmp ecx, 0x7b
je 0x1002a155
movsx edx, byte [ebp - 0x131]
cmp edx, 0x7d
je 0x1002a155
movsx eax, byte [ebp - 0x131]
cmp eax, 0x7c
je 0x1002a155
movsx ecx, byte [ebp - 0x131]
cmp ecx, 0x21
je 0x1002a155
movsx edx, byte [ebp - 0x131]
cmp edx, 0x40
je 0x1002a155
movsx eax, byte [ebp - 0x131]
cmp eax, 0x23
je 0x1002a155
movsx ecx, byte [ebp - 0x131]
cmp ecx, 0x24
je 0x1002a155
movsx edx, byte [ebp - 0x131]
cmp edx, 0x25
je 0x1002a155
movsx eax, byte [ebp - 0x131]
cmp eax, 0x5e
je 0x1002a155
movsx ecx, byte [ebp - 0x131]
cmp ecx, 0x26
je 0x1002a155
movsx edx, byte [ebp - 0x131]
cmp edx, 0x2a
je 0x1002a155
movsx eax, byte [ebp - 0x131]
cmp eax, 0x28
je 0x1002a155
movsx ecx, byte [ebp - 0x131]
cmp ecx, 0x29
jne 0x1002a172
push 0
push 0
push 1
push 0x10
mov ecx, dword [ebp - 0x138]
call fcn.100298d0
mov edx, dword [ebp - 0x138]
mov byte [edx + 2], 1
push 0
push 1
push 1
movzx eax, word [ebp - 0x140]
and eax, 0xff
push eax
mov ecx, dword [ebp - 0x138]
call fcn.100298d0
mov ecx, dword [ebp - 0x138]
call fcn.100295a0
mov ecx, dword [ebp - 0x148]
add ecx, 1
mov dword [ebp - 0x148], ecx
jmp 0x10029b55
mov edx, dword [ebp - 0x138]
mov byte [edx + 1], 0
mov ecx, dword [ebp - 0x138]
call fcn.100295a0
mov al, byte [ebp - 0x141]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d440
mov esp, ebp
pop ebp
ret 8