Function at 0x100036a0
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [0x10058338]
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, ebx
and esi, 0xff
push edi
shl esi, 2
test ecx, ecx
mov al, byte [esi + 0x10050a38]
mov edi, 1
jne 0x1000385e
mov ecx, dword [0x1005833c]
test ecx, ecx
jne 0x1000380a
cmp word [esp + 0x18], 0
jne 0x10003777
cmp al, 1
je 0x1000375e
cmp al, 2
je 0x1000375e
cmp al, 4
je 0x1000375e
cmp al, 0xe0
jne 0x1000372e
movzx ax, byte [esi + 0x10050a39]
mov ebx, dword [esp + 0x1c]
push 2
push eax
call ebx
mov edi, eax
mov al, byte [esi + 0x10050a3a]
add esp, 8
test al, al
je 0x1000399a
xor cx, cx
push 2
mov cl, al
push ecx
call ebx
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp al, 0xe1
jne 0x1000399a
movzx dx, byte [esi + 0x10050a39]
mov edi, dword [esp + 0x1c]
push 4
push edx
call edi
movzx ax, byte [esi + 0x10050a3a]
push 0
push eax
call edi
add esp, 0x10
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
movzx cx, byte [esi + 0x10050a39]
push 0
push ecx
call dword [esp + 0x24]
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp al, 1
je 0x100037f1
cmp al, 2
je 0x100037f1
cmp al, 4
je 0x100037f1
cmp al, 0xe0
jne 0x100037b9
mov al, byte [esi + 0x10050a3a]
mov edi, dword [esp + 0x1c]
test al, al
je 0x100037a2
xor dx, dx
push 3
mov dl, al
push edx
call edi
add esp, 8
movzx ax, byte [esi + 0x10050a39]
push 3
push eax
call edi
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp al, 0xe1
jne 0x100037e5
movzx cx, byte [esi + 0x10050a39]
mov edi, dword [esp + 0x1c]
push 5
push ecx
call edi
movzx dx, byte [esi + 0x10050a3a]
push 1
push edx
call edi
add esp, 0x10
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp al, 3
jne 0x1000399a
push 1
jmp 0x10003828
movzx cx, byte [esi + 0x10050a39]
push 1
push ecx
call dword [esp + 0x24]
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
xor cl, cl
cmp al, 0xe0
jne 0x10003814
mov cl, 2
jmp 0x1000381a
cmp al, 0xe1
jne 0x1000381a
mov cl, 4
cmp word [esp + 0x18], 0
jne 0x1000383f
xor dx, dx
mov dl, cl
push edx
movzx ax, byte [esi + 0x10050a39]
push eax
call dword [esp + 0x24]
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
movzx dx, byte [esi + 0x10050a39]
or cl, 1
movzx cx, cl
push ecx
push edx
call dword [esp + 0x24]
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ecx, 1
jne 0x100038d2
mov al, byte [esi + 0x10050a3b]
test al, al
mov byte [esp + 0x14], al
je 0x1000399a
mov edi, dword [esp + 0x18]
push ebx
mov si, di
dec si
neg si
sbb esi, esi
and esi, 0xfffffffe
add esi, 2
call fcn.10003530
add esp, 4
test ah, 1
je 0x1000389a
or esi, 1
cmp bl, 0xe1
jne 0x100038a2
or esi, 1
push 0
push esi
mov esi, dword [esp + 0x1c]
push 0
mov eax, esi
and eax, 0xff
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push esi
call dword [sym.imp.USER32.dll_keybd_event]
push edi
push 0
call dword [esp + 0x24]
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ecx, 2
jne 0x1000393c
mov al, byte [esi + 0x10050a3b]
test al, al
mov byte [esp + 0x14], al
je 0x1000399a
mov ebp, dword [esp + 0x18]
push ebx
mov si, bp
dec si
neg si
sbb esi, esi
add esi, 0x101
call fcn.10003530
and eax, 0xffff
add esp, 4
shl eax, 0x10
or al, 1
cmp bp, 1
jne 0x1000391b
or eax, 0xc0000000
mov ecx, dword [esp + 0x14]
mov edx, dword [0x10058340]
and ecx, 0xff
push eax
push ecx
push esi
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ecx, 3
jne 0x1000399a
mov al, byte [esi + 0x10050a3b]
test al, al
mov byte [esp + 0x14], al
je 0x1000399a
mov ebp, dword [esp + 0x18]
push ebx
mov si, bp
dec si
neg si
sbb esi, esi
add esi, 0x101
call fcn.10003530
and eax, 0xffff
add esp, 4
shl eax, 0x10
or al, 1
cmp bp, 1
jne 0x10003981
or eax, 0xc0000000
mov ecx, dword [0x10058340]
push eax
mov eax, dword [esp + 0x18]
and eax, 0xff
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret