Function at 0x1013325
Capabilities:
Check for peb beingdebugged flag
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
xor ecx, ecx
test byte [0x10382d4], 2
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 1
je 0x10139e2
cmp word [0x10382d8], cx
push ebx
mov ebx, dword [0x1038258]
jge 0x101335e
xor eax, eax
mov word [0x10382d8], ax
cmp word [0x10382da], cx
jge 0x101336f
xor eax, eax
mov word [0x10382da], ax
movzx eax, word [ebx + 8]
cmp word [0x10382dc], ax
jl 0x1013383
dec eax
mov word [0x10382dc], ax
movzx eax, word [ebx + 0xa]
cmp word [0x10382de], ax
jl 0x1013397
dec eax
mov word [0x10382de], ax
mov eax, dword [0x10382de]
sub eax, dword [0x10382da]
push esi
mov esi, dword [0x10382dc]
sub esi, dword [0x10382d8]
push edi
inc esi
inc eax
test byte [ebx], 1
mov word [ebp - 0x38], si
mov word [ebp - 0x36], ax
je 0x10138c4
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 4
pop edx
cmp byte [0x1038415], cl
je 0x1013416
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movsx esi, si
add esi, edx
mov dword [ebp - 0x1c], edx
movsx edx, word [ebp - 0x36]
imul esi, edx
lea edx, [esi + esi + 2]
push edx
add ecx, 0x300000
push ecx
push dword [eax + 0x18]
mov dword [ebp - 0x18], 2
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x1013419
jmp 0x10139df
mov dword [ebp - 4], ecx
movsx esi, word [ebp - 0x38]
movsx eax, word [ebp - 0x36]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], esi
add esi, ecx
imul esi, eax
imul esi, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
shl esi, 2
push esi
push dword [0x1038030]
push dword [eax + 0x18]
call edi
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1013463
cmp dword [ebp - 4], eax
je 0x10139df
push dword [ebp - 4]
jmp 0x101353c
cmp byte [0x1038415], 0
mov eax, dword [ebp - 0x38]
jne 0x1013562
test byte [0x10382f8], 1
je 0x10134d9
test dword [0x10382cc], 0x200
je 0x10134d9
mov edi, dword [ebp - 0xc]
push esi
push edi
push 0x10382d8
push ebx
call fcn.0102097c
xor eax, eax
cmp ax, word [ebp - 0x36]
mov esi, edi
jge 0x101351a
movzx eax, word [ebp - 0x36]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp ax, word [ebp - 0x38]
jge 0x10134d2
movzx eax, word [ebp - 0x38]
mov dword [ebp - 0x1c], eax
movzx eax, byte [esi]
push eax
push dword [0x1038334]
call fcn.0101c413
mov word [esi], ax
add esi, 4
dec dword [ebp - 0x1c]
jne 0x10134b8
dec dword [ebp - 0x18]
je 0x101351a
jmp 0x10134a9
mov cx, word [0x10382d8]
mov edi, dword [ebp - 0xc]
mov word [ebp - 8], cx
mov cx, word [0x10382da]
mov word [ebp - 6], cx
xor ecx, ecx
mov word [ebp - 0x3e], cx
mov word [ebp - 0x40], cx
lea ecx, [eax - 1]
mov word [ebp - 0x3c], cx
mov ecx, dword [ebp - 0x36]
dec ecx
mov word [ebp - 0x3a], cx
lea ecx, [ebp - 0x40]
push ecx
push eax
push edi
push dword [ebp - 8]
push ebx
call fcn.0101cd8f
mov eax, dword [ebp - 0x10]
add eax, 2
imul eax, dword [ebp - 0x30]
lea eax, [eax + eax + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x1013555
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x10139df
cmp byte [0x1038415], 0
je 0x10136a7
test byte [ebx], 4
je 0x101357a
test byte [0x10382f8], 1
jne 0x101357a
and dword [ebp - 0x18], 0
and dword [ebp - 0x28], 0
jmp 0x1013588
mov dword [ebp - 0x18], 0xd
mov dword [ebp - 0x28], 0xa
mov esi, dword [ebp - 4]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
and dword [ebp - 0x14], 0
movzx edi, ax
shr edi, 0xf
not edi
and edi, 1
xor eax, eax
cmp ax, word [ebp - 0x36]
mov dword [ebp - 0x2c], edi
jge 0x1013764
inc eax
mov word [ebp - 0x1e], ax
mov eax, dword [0x10382da]
mov edx, dword [ebp - 0x14]
mov cx, word [0x10382d8]
add eax, edx
mov edx, dword [ebp - 0x38]
mov word [ebp - 6], ax
mov word [ebp - 0x46], ax
mov word [ebp - 0x42], ax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 8], cx
mov word [ebp - 0x48], cx
mov ecx, dword [ebp - 8]
push ebx
push ecx
lea edi, [edx + ecx - 1]
push edx
mov dword [ebp - 0x24], esi
mov word [ebp - 0x44], di
call fcn.0103673b
mov ax, word [ebp - 0x48]
mov edi, dword [ebp - 0x44]
sub edi, dword [ebp - 0x48]
mov word [ebp - 8], ax
mov ax, word [ebp - 0x46]
mov word [ebp - 6], ax
xor eax, eax
inc edi
mov word [ebp - 0x3a], ax
mov word [ebp - 0x3e], ax
mov word [ebp - 0x40], ax
mov word [ebp - 0x20], di
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 1]
mov word [ebp - 0x3c], cx
lea ecx, [ebp - 0x40]
push ecx
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push ebx
call fcn.0101cd8f
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp cx, di
jge 0x1013662
movzx ecx, di
mov edx, 0x200
test word [eax + 2], dx
jne 0x101365c
mov dx, word [eax]
mov word [esi], dx
inc esi
inc esi
add eax, 4
dec ecx
jne 0x1013649
cmp dword [ebp - 0x2c], 0
je 0x101368e
push 2
pop eax
jmp 0x1013673
cmp word [esi], 0x20
jne 0x101367a
sub esi, eax
cmp esi, dword [ebp - 0x24]
jae 0x101366d
mov cx, word [ebp - 0x18]
add esi, eax
mov word [esi], cx
mov cx, word [ebp - 0x28]
add esi, eax
mov word [esi], cx
add esi, eax
inc dword [ebp - 0x14]
mov ax, word [ebp - 0x14]
cmp ax, word [ebp - 0x36]
jl 0x10135b6
mov edi, dword [ebp - 0x2c]
jmp 0x1013764
push eax
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test byte [ebx], 4
mov esi, eax
je 0x10136ca
test byte [0x10382f8], 1
jne 0x10136ca
mov dword [ebp - 0x2c], 1
jmp 0x10136ce
and dword [ebp - 0x2c], 0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
shr edi, 0xf
not edi
xor eax, eax
and edi, 1
cmp ax, word [ebp - 0x36]
jge 0x1013764
movzx eax, word [ebp - 0x36]
push 2
mov dword [ebp - 0x28], eax
pop ebx
xor eax, eax
cmp ax, word [ebp - 0x38]
mov edx, esi
jge 0x101371e
movzx ecx, word [ebp - 0x38]
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov word [esi], ax
test ax, ax
jne 0x1013715
push 0x20
pop eax
mov word [esi], ax
add dword [ebp - 0x14], 4
add esi, ebx
dec ecx
jne 0x1013701
test edi, edi
jne 0x101372a
jmp 0x1013732
cmp word [esi], 0x20
jne 0x1013730
sub esi, ebx
cmp esi, edx
jae 0x1013724
add esi, ebx
cmp dword [ebp - 0x2c], 0
je 0x101374b
push dword [0x1038334]
mov eax, esi
sub eax, edx
sar eax, 1
push eax
push edx
call fcn.0101c551
test edi, edi
je 0x101375f
push 0xd
pop eax
mov word [esi], ax
push 0xa
add esi, ebx
pop eax
mov word [esi], ax
add esi, ebx
dec dword [ebp - 0x28]
jne 0x10136f3
test edi, edi
je 0x1013772
cmp word [ebp - 0x36], 0
je 0x1013772
sub esi, 4
xor eax, eax
mov word [esi], ax
cmp byte [0x1038415], al
je 0x101384d
mov eax, dword [ebp - 0x10]
add eax, 8
imul eax, dword [ebp - 0x30]
lea eax, [eax + eax + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x10137d4
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
jmp 0x10139df
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 4]
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
xor edi, edi
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlSizeHeap]
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.msvcrt.dll_memmove]
sub esi, dword [ebp - 4]
add esp, 0xc
sar esi, 1
lea esi, [ebx + esi*2]
cmp word [ebp - 0x18], di
jne 0x101384d
push dword [0x1038334]
mov eax, esi
sub eax, ebx
sar eax, 1
push eax
push ebx
call fcn.0101c551
mov eax, ebx
cmp ebx, esi
jae 0x101384d
cmp word [eax], di
jne 0x1013847
lea ecx, [eax + 2]
cmp word [ecx], di
jne 0x1013847
push 0xd
pop edx
mov word [eax], dx
mov eax, ecx
push 0xa
pop ecx
mov word [eax], cx
inc eax
inc eax
cmp eax, esi
jb 0x101382c
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x1013876
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [ebp - 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [0x1038260]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x101389b
push edi
jmp 0x10138a6
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
test eax, eax
jne 0x10138b1
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10139df
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x10139df
xor edi, edi
push edi
push edi
push dword [ebx + 0x50]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [0x1038268]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
movsx eax, word [ebp - 0x36]
movsx ecx, si
push eax
push ecx
push dword [0x1038268]
mov dword [ebp - 0x10], ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x30], eax
cmp eax, edi
je 0x10139cc
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp - 0xc]
call esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x2c]
cmp eax, edi
je 0x1013927
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [ebp - 0x2c], eax
call fcn.01012e39
mov ecx, dword [ebx + 0x40]
cmp dword [ecx + 8], edi
jge 0x101394b
movsx edx, word [ebx + 0xe]
or eax, 0xffffffff
sub eax, edx
movsx edx, word [0x10382de]
sub eax, edx
sub eax, dword [ecx + 8]
jmp 0x1013958
movsx eax, word [ebx + 0xe]
movsx edx, word [0x10382de]
add eax, edx
movsx edx, word [0x10382d8]
push 0xcc0020
push dword [ebx + 0x58]
push ecx
push dword [ebx + 0x44]
movsx ecx, word [ebp - 0x36]
push ecx
push dword [ebp - 0x10]
push eax
movsx eax, word [ebx + 0xc]
add eax, edx
push eax
push ecx
push dword [ebp - 0x10]
push edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_StretchDIBits]
call fcn.01012e39
cmp dword [ebx + 0x2c], edi
je 0x10139a1
push edi
push dword [ebp - 0x2c]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp - 0x28]
push dword [ebp - 0xc]
call esi
push dword [0x1038260]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp - 0x30]
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
push dword [ebx + 0x50]
call dword [sym.imp.ntdll.dll_NtReleaseMutant]
pop edi
pop esi
pop ebx
leave
ret