Function at 0x10005e40
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, eax
div dword [ebx + 0xc8]
test edx, edx
jne 0x10006103
call fcn.10007020
xor edx, edx
mov eax, esi
div dword [ebx + 0xc8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
test eax, eax
jle 0x10006103
push edi
nop
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov eax, dword [ebx + 0xc8]
imul eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc0]
push 0x76
push ecx
mov dword [ebx + 0xc4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec eax
mov dword [ebp + 8], eax
mov edx, dword [ebx + 0xc4]
fild dword [ebp + 8]
push 0x75
fnstcw word [ebp + 0xa]
movzx eax, word [ebp + 0xa]
fdivr qword [0x1005aa08]
or eax, 0xc00
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0xc0]
mov edi, edx
push eax
fimul dword [edx + 0x10]
fldcw word [ebp - 8]
fistp qword [ebp - 0x14]
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x14]
fldcw word [ebp + 0xa]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec eax
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x10]
fild dword [ebp + 8]
fnstcw word [ebp + 0xa]
fdivr qword [0x1005aa08]
movzx eax, word [ebp + 0xa]
or eax, 0xc00
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
fimul dword [edi + 0x14]
fldcw word [ebp - 8]
fistp qword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
fldcw word [ebp + 0xa]
cmp eax, 0x200
ja 0x10006014
je 0x10006004
sub eax, 0x100
cmp eax, 5
ja case.default.0x10006022
jmp dword [eax*4 + 0x1000610c]
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x10005f81
cmp eax, 0x27
je 0x10005f81
cmp eax, 0x26
je 0x10005f81
cmp eax, 0x28
je 0x10005f81
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebx + 0xc4]
movzx edx, byte [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10006022
push 0
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
mov eax, dword [ebx + 0xc4]
movzx ecx, byte [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10006022
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x10005fe0
cmp eax, 0x27
je 0x10005fe0
cmp eax, 0x26
je 0x10005fe0
cmp eax, 0x28
je 0x10005fe0
push 0
push 2
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [ebx + 0xc4]
push eax
movzx eax, byte [edx + 8]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10006022
push 0
push 3
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebx + 0xc4]
movzx edx, byte [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10006022
push 0
push 0
push edi
push esi
push 0x8001
jmp 0x100060ec
sub eax, 0x201
cmp eax, 9
ja case.default.0x10006022
jmp dword [eax*4 + 0x10006124]
push 0
push 0
push edi
push esi
push 0x8002
jmp 0x100060ec
push 0
push 0
push edi
push esi
push 0x8004
jmp 0x100060ec
push 0
push 0
push edi
push esi
push 0x8008
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8010
jmp 0x100060ec
push 0
push 0
push edi
push esi
push 0x8006
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8006
jmp 0x100060ec
push 0
push 0
push edi
push esi
push 0x8018
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8018
jmp 0x100060ec
push 0
push 0
push edi
push esi
push 0x8020
jmp 0x100060ec
push 0
push 0
push edi
push esi
push 0x8040
jmp 0x100060ec
push 0
push 0
push edi
push esi
push 0x8060
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8060
jmp 0x100060ec
movsx eax, word [ecx + 0xa]
push 0
push eax
push edi
push esi
push 0x8800
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x18]
jl 0x10005e80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8