Function at 0x1000e50b
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x1005f9c8
call fcn.1005ecf4
sub esp, 0x80
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], cl
je 0x1000e57c
cmp byte [ebp + 0x18], 0
je 0x1000e54c
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1000ea29
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1000ea29
cmp byte [edx], 0
je 0x1000ea29
push 1
push 0x6a98
push 0x697c
push 0x7de7
push 0
mov edx, 0x4390
xor cl, cl
call fcn.1000e50b
add esp, 0x14
jmp 0x1000ea29
test cl, cl
je 0x1000ea17
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov dword [ebp + 8], ebx
mov byte [ebp + 0xb], bl
mov dword [ebp - 0x34], esi
cmp byte [ebp + 0xb], bl
je 0x1000e5a9
push ebx
push 0x147d
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1000e5f9
push 0x88
push ebx
push 0x7577
push 0x7618
push ebx
push 0x7a84
push 0x77a1
push 0x6afd
push 0x4b70
push 0x13fd
push 0x5f51
push 0x247a
push 1
mov edx, 0x3600
mov ecx, 0x6f7d
call fcn.1000f855
add esp, 0x34
xor eax, eax
mov dword [ebp - 0x78], 7
mov dword [ebp - 0x7c], ebx
mov word [ebp - 0x8c], ax
push 0x5312
push 1
push 0x4f22
push 0x7129
push ebx
push 0x3b4e
push 0x4782
push 0x720c
lea eax, [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
push 0x5871
push 0x3aee
push 0x563a
push 1
mov edx, 0x78eb
lea ecx, [ebp - 0x8c]
call fcn.1000f855
mov eax, dword [0x1013e420]
add esp, 0x34
test al, 1
jne 0x1000e686
or eax, 1
mov dword [0x1013e420], eax
push 0x18fe
mov byte [ebp - 4], 1
call fcn.1003c9ff
mov word [0x1013e414], ax
mov byte [ebp - 4], bl
mov eax, dword [0x1013e420]
pop ecx
test al, 2
jne 0x1000e6aa
or eax, 2
mov dword [0x1013e420], eax
push 0x559f
mov byte [ebp - 4], 2
call fcn.1003c9ff
pop ecx
mov word [0x1013e404], ax
mov byte [ebp - 4], bl
push 0x79fd
push 0x1c48
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
call fcn.1000e37a
add esp, 0xc
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov eax, dword [ebp - 0x30]
cmp edi, dword [eax]
jae 0x1000e9b4
mov dword [ebp + 8], 0xffffffff
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x24], 0x7bce
cmp dword [ebp - 0x24], 0x7ee0
jle 0x1000e724
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10079358
cdq
push edx
push eax
call fcn.100033d6
inc edi
cmp edi, 0x7f68
jl 0x1000e6fc
inc esi
cmp esi, 0x1e18
jl 0x1000e6fa
mov edi, dword [ebp - 0x28]
mov dword [ebp + 8], ebx
jmp 0x1000e733
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x1c], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jl 0x1000e729
mov byte [ebp - 4], 3
cmp dword [ebp - 0x24], 0x7a7e
jge 0x1000e77c
mov edx, str.mlwpjvff_eqhievimw_lyypge_rnwayem_lfhnvk_ybn_vsjbchsfd_hjbrp
mov ecx, 0x10079358
call fcn.1000562f
jmp 0x1000e77c
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], bl
xor cl, cl
call fcn.1000ea3a
mov dword [ebp + 8], ebx
jmp 0x1000e930
push 2
lea ecx, [ebp - 0x58]
call fcn.1000354d
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 5
push eax
push ecx
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x28], ebx
call fcn.1000ebed
mov eax, dword [ebp - 0x58]
add esp, 0xc
mov dword [eax], ebx
mov dword [ebp - 0x24], 0x67f8b4df
lea ecx, [ebp - 0x64]
push 4
call fcn.1000354d
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x4c]
mov ecx, 0x3aff
push eax
push 1
call fcn.1000e37a
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp eax, ecx
mov ecx, dword [ebp - 0x24]
setle dl
cmp edx, 4
sbb eax, eax
neg eax
add ecx, eax
mov eax, dword [ebp + 8]
neg ecx
sbb ecx, ecx
mov esi, dword [ebp + eax*4 - 0x1c]
neg ecx
mov eax, 0x9689
sub eax, ecx
xor ecx, ecx
cmp eax, 0x997
mov eax, dword [ebp - 0x58]
setle cl
xor edx, edx
cmp esi, ecx
sete dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp + 8]
setle bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1c]
cmp ebx, eax
setg cl
xor edx, edx
add ecx, 0x4ed3
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + eax*4 - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp + 8]
setge bl
xor ecx, ecx
neg ebx
cmp ebx, eax
setle cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0x981c
mov eax, dword [ebp - 0x64]
setl cl
mov byte [ebp - 4], 5
imul ecx, ecx, 0xe327
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x64]
call fcn.100035d0
mov eax, dword [ebp - 0x58]
inc dword [eax]
mov eax, dword [eax]
test eax, eax
jle 0x1000e7bb
xor ebx, ebx
cmp eax, 0x36511f0b
jle 0x1000e8b6
cmp dword [ebp + 8], ebx
jne 0x1000e8b6
mov eax, ebx
jmp 0x1000e8b9
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov eax, dword [ebp + eax*4 - 0x1c]
mov ecx, dword [ebp + 8]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x34f12ce3
setg al
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp + 8]
setge dl
cmp dword [ebp + eax*4 - 0x1c], edx
jg 0x1000e8f3
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + eax*4 - 0x1c]
imul eax, edx, 0x72fd
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.100035d0
inc dword [ebp + 8]
cmp dword [ebp + 8], ebx
jle 0x1000e794
call fcn.1000dd7e
push 0x34
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], 0x5d6c05ba
mov dword [ebp + 8], ebx
jmp 0x1000e962
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x74], 0xb4074dd
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jl 0x1000e954
push ebx
push 0x4df5
lea eax, [ebp - 0x38]
mov dl, 1
push 0x46a2
push eax
mov ecx, 0x9e
call fcn.1000f9b3
add esp, 0xc
lea eax, [ebp - 0x8c]
mov edx, 0x6c95
push eax
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x1013e414
push ecx
mov ecx, 0x1013e404
call fcn.1000ddd0
add esp, 0x18
inc edi
mov dword [ebp - 0x28], edi
jmp 0x1000e6c8
xor eax, eax
lea edx, [ebp - 0x12]
inc eax
mov dword [ebp - 0x44], eax
push eax
mov dword [ebp - 0x40], 0x95d7c154
mov dword [ebp + 8], 0x8ebcce3f
push ecx
mov byte [ebp - 0x12], bl
call fcn.1000ea7f
lea eax, [ebp - 0x40]
mov ecx, 0x4d37
push eax
lea eax, [ebp - 0x44]
push eax
push 0x7bb0
call fcn.1000eca9
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x8c]
add esp, 0x14
cmp esi, eax
je 0x1000ea07
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.1000391e
push ebx
push 1
lea ecx, [ebp - 0x8c]
call fcn.10003de5
jmp 0x1000ea29
push 0x1328
push 0x111b
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret