Function at 0xc84ab4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x414], ebx
mov esi, ecx
lea edi, [ebp - 0x105]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 4], dx
mov word [ebp - 2], ax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0xc8550b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00c8190c
xor ebx, ebx
lea eax, [ebp - 0x310]
mov edx, pe_nt_image_headers32
call fcn.00c82650
movzx eax, word [ebp - 2]
add eax, 0xfffffff8
cmp eax, 0xf3
ja case.0xc84b27.8
mov al, byte [eax + 0xc84b2e]
jmp dword [eax*4 + 0xc84c22]
mov eax, edi
mov edx, 0xc85520
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc8553c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85558
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85574
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85590
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc855a0
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc855b8
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc855d4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc855dc
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc855e4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc855ec
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc855f4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc855fc
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85604
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc8560c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85614
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc8561c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85624
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85640
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85654
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc8566c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85680
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85694
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc856ac
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc856b8
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc856d0
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc856ec
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc856f4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85710
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85720
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85734
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc8574c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85770
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc8578c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc857a4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc857c4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc857d4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc857e4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc857f4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85804
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85814
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85824
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85834
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85844
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85854
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85864
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85874
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85884
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85894
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc858a4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc858b4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc858c4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc858d4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc858e4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc858f4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85904
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85914
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85924
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85934
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85944
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85954
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85968
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc8597c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85994
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc859a8
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc859bc
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc859d8
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc859f8
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85a14
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85a34
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85a58
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85a80
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85a94
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85ab4
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85ad0
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85aec
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85b00
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85b14
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85b2c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85b4c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85b6c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85b88
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85ba8
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85bbc
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85be0
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85bfc
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85c1c
call fcn.00c81948
jmp case.0xc84b27.8
mov eax, edi
mov edx, 0xc85c3c
call fcn.00c81948
mov eax, dword [edi]
call fcn.00c81a98
test eax, eax
jle 0xc85380
cmp byte [0xc8a9fb], 1
jne 0xc85380
mov edx, dword [edi]
mov eax, 0xc85c58
call fcn.00c81cb0
test eax, eax
jle 0xc85380
mov edx, dword [edi]
mov eax, 0xc85c60
call fcn.00c81cb0
test eax, eax
jg 0xc85380
mov bl, 1
mov eax, edi
mov edx, 0xc85c74
call fcn.00c81948
call fcn.00c84a38
mov byte [ebp - 5], al
mov eax, dword [ebp + 0xc]
push eax
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x105]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 2]
push eax
call sub.user32.dll_ToUnicodeEx
mov esi, eax
test esi, esi
jle 0xc85468
push edi
mov esi, 0xc8ac90
lea edi, [ebp - 0x210]
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [edi]
call fcn.00c81a98
test eax, eax
jne 0xc85427
mov eax, edi
lea edx, [ebp - 0x310]
mov ecx, 0x80
call fcn.00c81a6c
cmp byte [ebp - 5], 0
jne 0xc8540d
lea edx, [ebp - 0x414]
mov eax, dword [edi]
call fcn.00c84618
mov edx, dword [ebp - 0x414]
mov eax, edi
call fcn.00c81948
jmp 0xc85427
lea edx, [ebp - 0x418]
mov eax, dword [edi]
call fcn.00c84694
mov edx, dword [ebp - 0x418]
mov eax, edi
call fcn.00c81948
mov eax, dword [ebp - 0x210]
test eax, eax
je 0xc85457
mov edx, dword [ebp + 0xc]
push edx
push 0
push pe_nt_image_headers32
lea edx, [ebp - 0x310]
push edx
lea edx, [ebp - 0x208]
push edx
mov edx, dword [ebp - 0x20c]
push edx
push eax
call sub.user32.dll_ToUnicodeEx
mov eax, 0xc8ac90
mov edx, 0x108
call fcn.00c82650
jmp 0xc854e1
test esi, esi
jge 0xc854e1
movzx eax, word [ebp - 2]
mov dword [0xc8ac90], eax
movzx eax, word [ebp - 4]
mov dword [0xc8ac94], eax
push esi
push edi
lea esi, [ebp - 0x105]
mov edi, 0xc8ac98
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x410]
mov edx, pe_nt_image_headers32
call fcn.00c82650
push 1
push 0x6e
call sub.user32.dll_MapVirtualKeyW
test esi, esi
jge 0xc854e1
mov eax, dword [ebp + 0xc]
push eax
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x410]
push eax
push 1
push 0x6e
call sub.user32.dll_MapVirtualKeyW
push eax
push 0x6e
call sub.user32.dll_ToUnicodeEx
mov esi, eax
test esi, esi
jl 0xc854b1
cmp bl, 1
jne 0xc854ed
mov eax, edi
call fcn.00c8190c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc85512
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.00c81924
ret