Function at 0x10053f30
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101b23cc]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [edi + 0x32dc]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, edx
jne 0x10053f7d
mov eax, dword [esp + 0xcc]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
mov dh, dh
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
cmp eax, 4
jne 0x100540cd
mov ch, ch
call fcn.10050300
test eax, eax
je 0x10054051
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dh, dh
mov edx, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
push ecx
pop ecx
mov eax, dword [esi]
cmp eax, 1
jne 0x1005400f
mov ax, word [esi + 4]
mov word [esp + 0x14], ax
mov ebx, ebx
mov cx, word [esi + 6]
mov word [esp + 0x16], cx
xchg ebx, eax
xchg ebx, eax
mov edx, dword [esi + 8]
mov dword [esp + 0x18], edx
mov bl, bl
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
push edx
pop edx
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
mov ah, ah
jmp 0x10054051
cmp eax, ebx
jne 0x10054051
mov edx, dword [esi + 4]
mov dword [esp + 0x14], edx
mov dh, dh
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
push eax
pop eax
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
mov cl, cl
mov edx, dword [esi + 0x10]
mov dword [esp + 0x20], edx
mov edx, edx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov ah, ah
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
mov bl, bl
mov dh, dh
mov dword [esp + 8], ebx
mov bh, bh
mov dword [esp + 0x34], 3
push ecx
pop ecx
mov dword [esp + 0x38], 1
mov esi, esi
call fcn.10050300
test eax, eax
je 0x10054082
lea edx, [esp + 0xc]
mov dword [esp + 0x3c], edx
push ecx
pop ecx
jmp 0x10054088
mov dword [esp + 0x3c], esi
push edx
pop edx
push eax
pop eax
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
push ecx
pop ecx
mov al, al
push 1
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
lea edx, [esp + 0x44]
push 0xc
push edx
call fcn.1001f580
add esp, 0x18
mov esi, esi
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
cmp eax, 1
push ebp
mov ebp, 3
je 0x10054406
cmp eax, ebp
je 0x10054406
cmp eax, 0xa
je 0x10054406
cmp eax, 0xb
je 0x10054406
cmp eax, 2
jne 0x10054806
mov dword [esp + 0xc], ebx
mov ebx, ebx
mov dword [esp + 0x38], ebp
mov ch, ch
mov eax, dword [esi]
cmp eax, 1
jne 0x10054215
push eax
pop eax
mov cl, cl
mov dword [esp + 0x3c], 7
mov cl, cl
movzx edx, word [esi + 4]
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0xbc]
push ecx
push edx
call fcn.1004c920
add esp, 0xc
test eax, eax
je 0x10054806
test byte [esi + 8], 2
je 0x100541b3
mov al, byte [esp + 0xc0]
test al, al
jbe 0x10054806
movzx esi, al
push esi
lea eax, [esp + 0xc5]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.100fe3e0
add esp, 0xc
mov bh, bh
mov dword [esp + 0x40], esi
mov dl, dl
push 1
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
add esi, 0xc
lea eax, [esp + 0x48]
push esi
push eax
call fcn.1001f580
add esp, 0x18
push eax
pop eax
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
movzx esi, byte [esp + 0xb8]
push esi
lea ecx, [esp + 0xbd]
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.100fe3e0
add esp, 0xc
mov al, al
mov dword [esp + 0x40], esi
mov cl, cl
movzx ecx, byte [esp + 0xc0]
push 1
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
add ecx, 0xc
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.1001f580
add esp, 0x18
mov esi, esi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
cmp eax, ebx
jne 0x10054806
mov ebx, ebx
xor ebp, ebp
mov cl, cl
mov dword [esp + 0x3c], 8
mov ebp, ebp
test byte [esi + 0x10], 1
je 0x1005425e
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.10053c60
add esp, 0x18
mov ebp, eax
mov ecx, ecx
test byte [esi + 0x10], 2
je 0x10054286
mov bh, bh
mov edx, edx
mov byte [esp + 0x44], 9
push eax
pop eax
mov byte [esp + 0x45], bl
mov eax, eax
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov eax, eax
mov ebp, 4
push edx
pop edx
test byte [esi + 0x10], 8
je 0x100542ae
mov bh, bh
mov edx, edx
mov byte [esp + 0x44], 0xa
push edx
pop edx
mov byte [esp + 0x45], bl
mov eax, eax
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov eax, eax
mov ebp, 4
mov esi, esi
test byte [esi + 0x10], 0x20
je 0x100542d6
mov bh, bh
mov edx, edx
mov byte [esp + 0x44], 0xc
push ecx
pop ecx
mov byte [esp + 0x45], bl
mov eax, eax
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov eax, eax
mov ebp, 4
mov ah, ah
test dword [esi + 0x10], 0x800
je 0x10054340
mov ebx, dword [esi + 0xc]
mov bh, bh
mov edx, edx
test ebx, ebx
mov byte [esp + 0x44], 8
je 0x10054325
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x10054305
or byte [esp + 0x44], 1
mov ebp, ebp
push 2
call ebp
test ax, ax
je 0x10054315
or byte [esp + 0x44], 2
mov ecx, ecx
push 4
call ebp
test ax, ax
je 0x10054325
or byte [esp + 0x44], 4
mov eax, eax
mov byte [esp + 0x45], 0
mov eax, eax
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], bl
mov eax, eax
mov ebp, 4
xchg ebx, eax
xchg ebx, eax
xor ebx, ebx
test byte [esi + 0x10], 1
jne 0x1005436d
cmp ebp, ebx
jne 0x1005436d
mov bh, bh
mov edx, edx
mov byte [esp + 0x44], 8
mov byte [esp + 0x45], 0
mov eax, eax
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
mov eax, eax
mov ebp, 4
mov ah, ah
mov dword [esp + 0x40], ebp
mov bh, bh
test byte [esi + 0x10], 1
je 0x100543d2
cmp dword [edi + 0x3300], ebx
je 0x100543d2
mov eax, dword [edi + 0x37d0]
cmp eax, 0x398
jae 0x100543d2
push ebp
lea edx, [esp + 0x48]
push edx
lea eax, [edi + eax + 0x3380]
push eax
call fcn.100fe3e0
add esp, 0xc
xchg ebx, eax
xchg ebx, eax
mov dword [edi + 0x37d4], 4
push ecx
pop ecx
add dword [edi + 0x37d0], ebp
mov al, al
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
push 1
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
add ebp, 0xc
lea edx, [esp + 0x48]
push ebp
push edx
call fcn.1001f580
add esp, 0x18
mov eax, eax
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
nop
mov dword [esp + 0x38], ebp
mov bh, bh
mov eax, dword [esi]
cmp eax, 1
jne 0x1005464d
mov eax, dword [edi + 0x32dc]
cmp eax, ebp
mov ebx, 2
jne 0x10054433
mov dword [esp + 0x3c], 0x14
mov cl, cl
jmp 0x1005445b
cmp eax, 0xa
jne 0x10054444
mov dword [esp + 0x3c], 0
push eax
pop eax
jmp 0x1005445b
cmp eax, 0xb
jne 0x10054455
mov dword [esp + 0x3c], 0x10000
mov dh, dh
jmp 0x1005445b
mov dword [esp + 0x3c], ebx
push ecx
pop ecx
mov ax, word [esi + 6]
mov word [esp + 0x40], ax
mov eax, dword [esi + 8]
test al, 1
je 0x1005447c
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x42], cx
jmp 0x10054494
test al, 2
je 0x1005448b
mov word [esp + 0x42], 1
mov edx, edx
jmp 0x10054494
mov word [esp + 0x42], 0
push ecx
pop ecx
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x10054578
mov eax, dword [esi + 8]
test al, 1
je 0x10054578
test al, 2
je 0x10054514
mov word [esp + 0x40], 0x37
mov bh, bh
mov word [esp + 0x42], bp
mov ch, ch
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.1004d810
add esp, 4
mov ah, ah
mov word [esp + 0x40], 0x2a
nop
mov word [esp + 0x42], bp
xchg ebx, eax
xchg ebx, eax
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.1004d810
add esp, 4
mov eax, eax
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
mov word [esp + 0x40], 0x2a
push ebx
pop ebx
mov word [esp + 0x42], bx
mov ebp, ebp
lea ecx, [esp + 0x38]
push ecx
mov edx, 0xc
mov eax, edi
call fcn.1004d810
add esp, 4
push ebx
pop ebx
mov word [esp + 0x40], 0x37
push ebx
pop ebx
mov word [esp + 0x42], bx
xchg ebx, eax
xchg ebx, eax
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.1004d810
add esp, 4
mov ebx, ebx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
cmp cx, 0x13
jne 0x1005461f
mov eax, dword [esi + 8]
test al, 1
je 0x1005461f
test al, 2
jne 0x10054806
mov esi, 0x1d
mov word [esp + 0x40], si
mov ch, ch
mov word [esp + 0x42], 4
nop
lea eax, [esp + 0x38]
push eax
lea edx, [esi - 0x11]
mov eax, edi
call fcn.1004d810
add esp, 4
mov ebp, ebp
mov word [esp + 0x40], 0x45
mov ah, ah
mov word [esp + 0x42], 0
mov esi, esi
lea ecx, [esp + 0x38]
push ecx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.1004d810
add esp, 4
mov ecx, ecx
mov word [esp + 0x40], si
mov dh, dh
mov word [esp + 0x42], 5
push eax
pop eax
lea edx, [esp + 0x38]
push edx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.1004d810
add esp, 4
mov ah, ah
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.1004d810
add esp, 4
push eax
pop eax
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
cmp eax, ebx
jne 0x10054806
mov ch, ch
xor ecx, ecx
mov esi, esi
xor edx, edx
mov ah, ah
xor ebp, ebp
mov dh, dh
xor ebx, ebx
mov ebp, ebp
mov esi, esi
mov eax, dword [edi + 0x32dc]
cmp eax, 3
jne 0x10054680
mov dword [esp + 0x3c], 0x1e
push edx
pop edx
jmp 0x100546a8
cmp eax, 0xa
jne 0x1005468d
mov dword [esp + 0x3c], ecx
xchg ebx, eax
xchg ebx, eax
jmp 0x100546a8
cmp eax, 0xb
jne 0x1005469e
mov dword [esp + 0x3c], 0x10000
mov eax, eax
jmp 0x100546a8
mov dword [esp + 0x3c], 3
push ebx
pop ebx
test dword [esi + 0x10], 0x8000
je 0x100546ba
mov eax, 3
mov dh, dh
jmp 0x100546be
xor eax, eax
mov ch, ch
test byte [esi + 0x10], 1
je 0x100546ce
mov ebp, dword [esi + 4]
mov ah, ah
mov ebx, dword [esi + 8]
push edx
pop edx
test byte [esi + 0x10], 2
je 0x100546dc
mov ecx, 1
nop
push eax
pop eax
test byte [esi + 0x10], 4
je 0x100546e7
or ecx, 2
mov al, al
test byte [esi + 0x10], 8
je 0x100546f4
or ecx, 4
mov edx, edx
mov edi, edi
test byte [esi + 0x10], 0x10
je 0x100546ff
or ecx, 8
mov ah, ah
test byte [esi + 0x10], 0x20
je 0x1005470c
or ecx, 0x10
mov ecx, ecx
push ecx
pop ecx
test byte [esi + 0x10], 0x40
je 0x10054717
or ecx, 0x20
mov ch, ch
test dword [esi + 0x10], 0x800
je 0x1005472e
or ecx, 0x400
push ebx
pop ebx
movzx edx, word [esi + 0xc]
mov ah, ah
mov word [esp + 0x40], ax
mov dl, dl
mov word [esp + 0x42], cx
nop
mov word [esp + 0x44], dx
push ecx
pop ecx
mov dh, dh
mov dword [esp + 0x46], ebp
mov cl, cl
mov dword [esp + 0x4a], ebx
mov ebx, ebx
cmp dword [edi + 0x3300], 0
je 0x100547ec
mov eax, dword [edi + 0x3360]
cmp eax, 6
jae 0x100547ec
mov cx, word [esp + 0x40]
mov word [edi + eax*2 + 0x330c], cx
mov ebp, ebp
mov edx, dword [edi + 0x3360]
mov ax, word [esp + 0x42]
mov word [edi + edx*2 + 0x3318], ax
mov ebp, ebp
mov ecx, dword [edi + 0x3360]
mov dx, word [esp + 0x44]
mov word [edi + ecx*2 + 0x3324], dx
push eax
pop eax
mov eax, dword [edi + 0x3360]
mov ecx, dword [esp + 0x46]
mov dword [edi + eax*4 + 0x3330], ecx
mov dh, dh
mov edx, dword [edi + 0x3360]
mov eax, dword [esp + 0x4a]
mov dword [edi + edx*4 + 0x3348], eax
push eax
pop eax
add dword [edi + 0x3360], 1
mov ebx, ebx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret
mov al, al
mov esi, esi
lea ecx, [esp + 0x38]
push ecx
mov edx, 0x16
mov eax, edi
call fcn.1004d840
add esp, 4
mov cl, cl
mov ecx, dword [esp + 0xc8]
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.100fc49a
add esp, 0xc0
ret