Function at 0x100b06c
Capabilities:
Log keystrokes via application hook

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xdc
push esi
push edi
xor esi, esi
xor eax, eax
lea edi, [ebp - 0xc]
push 0xc8
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
lea eax, [ebp - 0xd8]
push esi
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xdc], esi
call fcn.0101bc52
add esp, 0xc
cmp dword [0x1031b90], esi
jne 0x100ae8d
cmp dword [ebp + 8], esi
jl 0x100ae8d
push esi
push dword [0x1031b88]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100adf7
push esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x100ae8d
push ebx
mov ebx, dword [ebp + 0x14]
cmp ebx, esi
mov esi, dword [ebp + 0x10]
je 0x100ae0c
push 6
lea edi, [ebp - 0xd4]
jmp 0x100ae14
push 5
lea edi, [ebp - 0xbc]
pop ecx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xa8], 0x14
call dword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
jne 0x100ae93
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100ae53
mov eax, 0x54f
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x100ae7a
test byte [ecx + 0x1c], 1
je 0x100ae7a
push eax
push 0x1001eac
push GdipAlloc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010062be
mov ecx, dword [0x1031b94]
push 2
push reloc.KERNEL32.dll_GlobalReAlloc
call fcn.01009eb3
pop ebx
pop edi
pop esi
leave
ret 0x10
mov ecx, dword [0x1031b98]
lea eax, [ebp - 0xdc]
push eax
call fcn.010094d6
test eax, eax
jne 0x100ae8c
lea eax, [ebp - 0x94]
push eax
xor edi, edi
push edi
mov dword [ebp - 0x94], 0x30
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
jne 0x100aef7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x100aed6
mov eax, 0x54f
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x100ae7a
test byte [ecx + 0x1c], 1
je 0x100ae7a
push eax
push 0x1001eac
push reloc.USER32.dll_SetWindowPos
jmp 0x100ae6f
cmp ebx, edi
je 0x100af12
push dword [ebp - 0xd0]
push dword [ebp - 0xd4]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov dword [ebp - 0x5c], eax
jmp 0x100af41
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x5c], eax
cmp eax, edi
jne 0x100af76
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x5c], eax
cmp eax, edi
jne 0x100af3b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
cmp eax, edi
jne 0x100af76
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ae7a
test byte [eax + 0x1c], 1
je 0x100ae7a
push 0x1001eac
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x100ae7a
lea ecx, [ebp - 0x60]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x64], eax
cmp eax, edi
jne 0x100afc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x100af97
mov eax, 0x54f
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x100ae7a
test byte [ecx + 0x1c], 1
je 0x100ae7a
push eax
push 0x1001eac
push 0x24
jmp 0x100ae6f
mov ecx, dword [0x1031b98]
lea eax, [ebp - 0xdc]
push eax
call fcn.01007e8a
test eax, eax
je 0x100b007
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ae8c
test byte [eax + 0x1c], 4
je 0x100ae8c
push 0x1001eac
push 0x25
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x100ae8c
push 0x1031ba0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x1031b98]
xor esi, esi
lea eax, [ebp - 0xdc]
cmp dword [ebp - 0x24], edi
je 0x100b02e
push edi
push eax
call fcn.01007540
jmp 0x100b034
push eax
call fcn.010075f2
test eax, eax
jne 0x100b03b
xor esi, esi
inc esi
call fcn.0100a7b4
test eax, eax
je 0x100b046
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp esi, edi
je 0x100b130
mov ecx, dword [0x1031b98]
call fcn.01007537
mov ecx, dword [0x1031b98]
mov dword [ebp - 0x2c], eax
call fcn.0100751d
or dword [ebp - 0x14], 1
push 0xcc
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x100b0ae
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ae7a
test byte [eax + 0x1c], 1
je 0x100ae7a
push 0x1001eac
push 0x26
jmp 0x100af66
push 0x33
pop ecx
push eax
push 0x1007b70
mov edi, eax
push 0x100aca0
lea eax, [ebp - 4]
lea esi, [ebp - 0xdc]
push eax
rep movsd dword es:[edi], dword [esi]
push dword [0x1031ba8]
call fcn.0101cb97
test eax, eax
je 0x100b110
mov eax, dword [section..data]
cmp eax, section..data
je 0x100b0fd
test byte [eax + 0x1c], 1
je 0x100b0fd
push 0x1001eac
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
push dword [ebp + 0x10]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100ae7a
push dword [ebp - 4]
push dword [0x1031ba8]
call fcn.0101cefe
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [0x1031ba8]
call fcn.0101c9bd
push 0xcc
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x100b16d
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ae7a
test byte [eax + 0x1c], 1
je 0x100ae7a
push 0x1001eac
push 0x28
jmp 0x100af66
push 0x33
pop ecx
push eax
push 0x1007b70
mov edi, eax
push 0x100a80c
lea eax, [ebp - 8]
lea esi, [ebp - 0xdc]
push eax
rep movsd dword es:[edi], dword [esi]
push dword [0x1031ba4]
call fcn.0101cb97
test eax, eax
je 0x100b1be
mov eax, dword [section..data]
cmp eax, section..data
je 0x100b0fd
test byte [eax + 0x1c], 1
je 0x100b0fd
push 0x1001eac
push 0x29
jmp 0x100b0f2
push dword [ebp - 8]
push dword [0x1031ba4]
call fcn.0101cefe
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [0x1031ba4]
call fcn.0101c9bd
xor esi, esi
push 0xfa
cmp dword [ebp - 0x10], esi
je 0x100b1fa
push 1
lea eax, [ebp - 0x10]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x100b203
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [0x1031ba4]
call fcn.0101c9e2
push dword [ebp - 8]
push dword [0x1031ba4]
call fcn.0101c94e
cmp dword [ebp - 0x10], esi
je 0x100b24b
cmp dword [ebp - 4], esi
je 0x100b24b
push dword [ebp - 0x10]
push dword [ebp - 4]
push dword [0x1031ba8]
call fcn.0101c9e2
push dword [ebp - 4]
push dword [0x1031ba8]
call fcn.0101c94e
mov ecx, dword [0x1031b94]
push 0x10020a4
push dword [ebp - 0x34]
call fcn.0100a3ea
jmp 0x100ae8c