Function at 0x10019c07
Capabilities:
Get file size
Get system information on windows
Log keystrokes via polling

Disassembly:
mov eax, 0x10081af8
call fcn.100812e0
sub esp, 0xa8
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0x28], ebx
inc esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x18], 0x54dbbe5
mov dword [ebp - 0x1c], 0xffff
push 4
call fcn.100177e6
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], edx
jmp 0x10019c5c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10019c4c
mov dword [ebp - 0x14], edx
jmp 0x10019c75
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3c], 0xf0451807
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10019c67
cmp dword [ebp - 0x18], edx
je 0x10019c83
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
push 0xffffffffffffffff
cmp dword [eax + 4], 0xa6b2
setg cl
imul ecx, dword [eax + 0xc]
pop eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], edx
je 0x10019cd5
mov byte [ebp - 0x1d], dl
cmp byte [ebp - 0x1d], dl
je 0x10019d18
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor edx, edx
jmp 0x10019d18
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xfffffffa
jl 0x10019cff
mov byte [ebp - 0x1d], dl
cmp byte [ebp - 0x1d], 0
je 0x10019cf3
push edx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
xor edx, edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
jge 0x10019ce1
or eax, 0xffffffff
mov dword [ebp - 0x10], edx
jmp 0x10019d12
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x14], edx
jne 0x10019d18
inc dword [ebp - 0x1c]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffe
jne 0x10019d04
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 3
jg 0x10019e25
or edi, 0xffffffff
jmp 0x10019d2c
xor edx, edx
mov dword [ebp - 0x2c], 0x600ac80e
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 0x642ee1e3
mov dword [ebp - 0x24], 0xac77acae
mov dword [ebp - 0x1c], edx
push 3
call fcn.100177e6
mov dword [ebp - 0x24], 0x3efbb05d
mov dword [ebp - 0x14], 0
jmp 0x10019d79
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa4], 0x8140a971
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10019d68
mov dword [ebp - 0x14], 0
jmp 0x10019d98
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 0x3f8c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10019d88
mov dword [ebp - 0x10], 0x2a6add33
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
sub eax, 0xc2888a0
jne 0x10019de0
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 4], 0
jne 0x10019de0
xor eax, eax
jmp 0x10019de2
mov eax, esi
mov edx, dword [ebp - 0x18]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x48]
sete cl
xor ebx, ebx
cmp dword [eax + edx*4], ecx
lea ecx, [ebp - 0x6c]
mov eax, dword [ebp - 0x2c]
setne bl
sub ebx, eax
xor eax, eax
cmp ebx, 0x7f1a9f13
setne al
mov dword [ebp - 0x10], eax
call fcn.10018003
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x10019d2a
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x28]
or eax, 0xffffffff
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], eax
call fcn.10018003
cmp byte [ebp + 8], 0
je 0x10019f25
mov dword [ebp + 8], 7
xor ebx, ebx
mov dword [ebp - 0x1c], 3
cmp dword [ebp + 8], ebx
je 0x10019ecc
or eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x10], ebx
jne 0x10019e8e
mov eax, dword [ebp + 8]
xor edx, edx
cmp eax, esi
setle dl
sub edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, ebx
setne cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xfe5a
jg 0x10019e90
mov edx, esi
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp + 8]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x10]
neg ecx
je 0x10019ebb
cmp dword [ebp + 8], ebx
jne 0x10019ebd
mov esi, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp esi, eax
setg cl
mov dword [ebp - 0x28], ecx
jmp 0x10019f0f
mov dword [ebp + 8], 0xe
jmp 0x10019ef6
mov dword [ebp - 0x10], ebx
jmp 0x10019ee8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x30], 0x74b6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10019eda
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x25
jge 0x10019ed5
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x10019f0f
push 0x9dc
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [ebp - 0x1c]
push ebx
mov dword [ebp - 0x1c], 8
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x1001a1a3
mov dword [ebp - 0x10], 0xc07e17f7
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x14], 0
mov dword [ebp + 8], 0xfffffffa
mov dword [ebp + 8], 8
push 2
call fcn.100177e6
xor ecx, ecx
mov dword [ebp + 8], 0xfffa
mov dword [ebp + 8], ecx
jmp 0x10019f63
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x54], ecx
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x10019f59
mov dword [ebp + 8], ecx
jmp 0x10019f7e
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], 0x3147f59e
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x10019f6e
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
add eax, ecx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setl dl
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x14]
add eax, edx
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
or ecx, 0xffffffff
inc eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x78]
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
cmp eax, edx
setl cl
imul eax, ecx, 3
lea ecx, [ebp - 0x78]
add eax, 0x73598422
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], eax
call fcn.10018003
mov dword [ebp - 0x14], esi
or ecx, 0xffffffff
mov dword [ebp + 8], ecx
mov dword [ebp + 8], 0xfffffffb
mov dword [ebp + 8], 0x69576881
push 9
pop eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp + 8], 0x9b46
mov dword [ebp - 0x14], 0xfffffff0
jmp 0x1001a0f1
mov dword [ebp - 0x10], 0xa12b57e8
mov dword [ebp + 8], esi
mov dword [ebp + 8], 0xb64b5c6f
mov dword [ebp + 8], 0xfffffffd
mov dword [ebp + 8], 0xa75a592c
mov dword [ebp + 8], 0xbae0fc36
mov dword [ebp + 8], 0x678e045d
mov dword [ebp + 8], ecx
mov dword [ebp - 0x10], 0xffffffed
cmp dword [ebp - 0x10], 0xfffffff4
jl 0x1001a0ee
mov dword [ebp + 8], 0x2c9cc141
lea ecx, [ebp - 0x94]
mov dword [ebp + 8], 0xfa5f9c71
mov dword [ebp + 8], 0x3f0d3ecf
push 2
call fcn.100177e6
xor edx, edx
mov dword [ebp - 0x1c], 0xb7e2
mov dword [ebp + 8], edx
jmp 0x1001a0be
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x94]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x1001a0ab
dec dword [ebp - 0x1c]
mov byte [ebp + 0xb], dl
cmp byte [ebp + 0xb], dl
je 0x1001a0d7
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [ebp - 0x94]
call fcn.10018003
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff4
jge 0x1001a07b
or ecx, 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
jge 0x1001a03e
push esi
lea ecx, [ebp - 0x60]
call fcn.100177e6
mov dword [ebp + 8], 0
jmp 0x1001a11e
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0xb4], 0xdc85
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jl 0x1001a10d
mov dword [ebp + 8], 0
jmp 0x1001a13d
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x60]
mov dword [eax + ecx*4], 0xe76f5020
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x1001a12d
mov eax, dword [ebp - 0x60]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [eax], 3
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xb4], 0
jne 0x1001a181
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x1001a17a
push 0x2131
push 0
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x60]
dec dword [eax]
jns 0x1001a151
lea ecx, [ebp - 0x60]
call fcn.10018003
mov dword [edi], 0
jmp 0x1001a19e
mov ecx, dword [edi]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xd594484f
inc dword [edi]
cmp dword [edi], 2
jl 0x1001a191
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret