Function at 0x1000653f
Capabilities:
Accept command line arguments
Log keystrokes

Disassembly:
mov eax, 0x1005b668
call fcn.1005b080
sub esp, 0x34
push ebx
push esi
mov dword [ebp - 0x20], 0x7642
xor esi, esi
cmp dword [ebp - 0x20], 0x7832
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
jle 0x1000659b
push 1
push esi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x10077178
and eax, edi
cdq
push edx
push eax
call fcn.1000b0cd
inc ebx
cmp ebx, 0x53ca
jl 0x10006578
inc edi
cmp edi, 0x36cf
jl 0x10006576
mov dword [ebp - 0x1c], 0x417c
cmp dword [ebp - 0x1c], 0x419a
jle 0x100065f1
mov edi, esi
mov ebx, esi
lea eax, [ebx + edi]
cdq
lea ecx, [ebp - 0x40]
push edx
push eax
call fcn.10002a51
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100065c7
mov eax, dword [eax]
push eax
call fcn.1004498a
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.10001643
inc ebx
cmp ebx, 0x101f
jl 0x100065af
inc edi
cmp edi, 0x6e84
jl 0x100065ad
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
cmp byte [ebp + 0x14], 0
je 0x10006610
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100066e2
push esi
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x100066e2
mov edi, dword [ebp + 0x1c]
mov dword [edi], esi
cmp dword [edi], 3
jg 0x100066e2
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x24], 0x3bdf
mov dword [ebp - 0x28], esi
cmp dword [edi], esi
je 0x10006680
mov eax, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x18]
mov eax, dword [ecx + eax*4]
imul eax, dword [ecx + 8]
xor ecx, ecx
mov dword [ebx], eax
mov eax, dword [edx]
cmp eax, 0xffffffff
setne cl
mov dword [edx], ecx
mov ecx, dword [ebx]
mov eax, dword [edx]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [edi]
setle cl
imul eax, ecx
xor ecx, ecx
dec eax
cmp eax, 0xffffffff
setne cl
add ecx, 0xfff6
je 0x10006680
xor ebx, ebx
inc ebx
jmp 0x10006682
mov ebx, esi
mov ecx, dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
imul edx, ebx
mov ebx, dword [ebp - 0x14]
mov eax, dword [eax]
sub edx, dword [eax + ecx*4]
mov eax, dword [ebp + 0xc]
neg edx
sbb edx, edx
inc edx
mov dword [eax], edx
mov edx, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax]
mov ecx, dword [ecx + edx*4]
sub ecx, eax
mov eax, dword [ebx]
mov dword [eax], ecx
mov eax, dword [ebp + 0x28]
cmp dword [eax], esi
je 0x100066c1
mov eax, dword [ebp + 0x20]
cmp dword [eax], esi
je 0x100066c1
xor ecx, ecx
inc ecx
jmp 0x100066c3
mov ecx, esi
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
add eax, ecx
xor ecx, ecx
cmp eax, 0x3c3f
setne cl
mov dword [ebp - 0x28], ecx
inc dword [edi]
cmp dword [edi], 3
jle 0x10006621
cmp dword [ebp - 0x1c], 0x412b
jge 0x100066f6
push str.xhvjq_iyglwkce_cmantaysj_qxqyeto_mtvwzvxg_eshj_nuypw_dhlow_oezps_jwjhxt_yjznhizrw_iwufkfji
call fcn.1004498a
pop ecx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x74f9
jge 0x10006715
mov edx, str.guwbcunb_xujdnehh_bkdb_nezf_myq_xydslsocg_gdxzuzdzb_jtf_ago_unlmkv_payc_xjph
mov ecx, 0x10077178
call fcn.1000ca72
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret