Function at 0x1006ac00
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101cc114]
xor eax, esp
mov dword [esp + 0xbc], eax
push ebp
push esi
mov esi, dword [esp + 0xcc]
push edi
mov edi, edx
mov eax, dword [edi + 0x32d8]
xor ebp, ebp
cmp eax, ebp
jne 0x1006ac56
mov eax, dword [esp + 0xd4]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
mov dh, dh
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.10117937
add esp, 0xc0
ret
cmp eax, 4
jne 0x1006ada7
mov esi, esi
call fcn.10066340
test eax, eax
je 0x1006ad2a
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
push eax
pop eax
mov edx, dword [esi]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebp
mov esi, esi
mov eax, dword [esi]
cmp eax, 1
jne 0x1006ace8
mov ax, word [esi + 4]
mov word [esp + 0x18], ax
mov eax, eax
mov cx, word [esi + 6]
mov word [esp + 0x1a], cx
mov dl, dl
mov edx, dword [esi + 8]
mov dword [esp + 0x1c], edx
mov bh, bh
mov eax, dword [esi + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
mov al, al
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebp
push eax
pop eax
jmp 0x1006ad2a
cmp eax, ebp
jne 0x1006ad2a
mov edx, dword [esi + 4]
mov dword [esp + 0x18], edx
xchg ebx, eax
xchg ebx, eax
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov ebx, ebx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x20], ecx
mov bl, bl
mov edx, dword [esi + 0x10]
mov dword [esp + 0x24], edx
mov edx, edx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
mov al, al
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ebp
mov ebx, ebx
push edx
pop edx
mov dword [esp + 0xc], ebp
mov edx, edx
mov dword [esp + 0x38], 3
mov al, al
mov dword [esp + 0x3c], 1
mov ebx, ebx
call fcn.10066340
test eax, eax
je 0x1006ad5b
lea edx, [esp + 0x10]
mov dword [esp + 0x40], edx
mov ebx, ebx
jmp 0x1006ad61
mov dword [esp + 0x40], esi
mov dl, dl
mov ch, ch
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov dl, dl
mov dh, dh
push 1
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebp
lea edx, [esp + 0x48]
push 0xc
push edx
call fcn.100220c0
add esp, 0x18
mov ebx, ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.10117937
add esp, 0xc0
ret
cmp eax, 1
push ebx
mov ebx, 3
je 0x1006b09e
cmp eax, ebx
je 0x1006b09e
cmp eax, 0xa
je 0x1006b09e
cmp eax, 0xb
je 0x1006b09e
cmp eax, 2
jne 0x1006b463
mov dword [esp + 0x10], ebp
mov ch, ch
mov dword [esp + 0x3c], ebx
mov ecx, ecx
mov eax, dword [esi]
cmp eax, 1
jne 0x1006aec9
mov cl, cl
xchg ebx, eax
xchg ebx, eax
mov dword [esp + 0x40], 7
mov al, al
movzx edx, word [esi + 4]
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0xc0]
push ecx
push edx
call fcn.10062d70
add esp, 0xc
test eax, eax
je 0x1006b463
test byte [esi + 8], 2
je 0x1006ae7a
mov al, byte [esp + 0xc4]
test al, al
jbe 0x1006b463
movzx esi, al
push esi
lea eax, [esp + 0xc9]
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.10119710
add esp, 0xc
mov ecx, ecx
mov dword [esp + 0x44], esi
mov ah, ah
push 1
lea edx, [esp + 0x14]
push edx
push ebp
push ebp
add esi, 0xc
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.100220c0
add esp, 0x18
mov esi, esi
jmp 0x1006b463
movzx esi, byte [esp + 0xbc]
push esi
lea ecx, [esp + 0xc1]
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.10119710
add esp, 0xc
mov ah, ah
mov dword [esp + 0x44], esi
push eax
pop eax
movzx ecx, byte [esp + 0xc4]
push 1
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
add ecx, 0xc
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.100220c0
add esp, 0x18
push eax
pop eax
jmp 0x1006b463
cmp eax, ebp
jne 0x1006b463
mov edi, edi
xor ebp, ebp
mov dl, dl
mov dword [esp + 0x40], 8
push ebx
pop ebx
test byte [esi + 0x10], 1
je 0x1006af12
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x5c]
push ecx
call fcn.1006a810
add esp, 0x18
mov ebp, eax
mov edx, edx
test byte [esi + 0x10], 2
je 0x1006af3d
mov bl, bl
mov ebx, ebx
mov byte [esp + 0x48], 9
mov ch, ch
mov byte [esp + 0x49], 0
mov edi, edi
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov cl, cl
mov ebp, 4
mov ch, ch
test byte [esi + 0x10], 8
je 0x1006af68
mov bl, bl
mov ebx, ebx
mov byte [esp + 0x48], 0xa
mov ebp, ebp
mov byte [esp + 0x49], 0
mov edi, edi
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov cl, cl
mov ebp, 4
mov dh, dh
test byte [esi + 0x10], 0x20
je 0x1006af93
mov bl, bl
mov ebx, ebx
mov byte [esp + 0x48], 0xc
push ecx
pop ecx
mov byte [esp + 0x49], 0
mov edi, edi
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov cl, cl
mov ebp, 4
push ecx
pop ecx
test dword [esi + 0x10], 0x800
je 0x1006affb
mov ebx, dword [esi + 0xc]
mov bl, bl
mov ebx, ebx
test ebx, ebx
mov byte [esp + 0x48], 8
je 0x1006afe2
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x1006afc2
or byte [esp + 0x48], 1
mov edi, edi
push 2
call ebp
test ax, ax
je 0x1006afd2
or byte [esp + 0x48], 2
mov dl, dl
push 4
call ebp
test ax, ax
je 0x1006afe2
or byte [esp + 0x48], 4
mov ah, ah
mov byte [esp + 0x49], 0
mov edi, edi
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], bl
mov cl, cl
mov ebp, 4
mov ebp, ebp
test byte [esi + 0x10], 1
jne 0x1006b028
test ebp, ebp
jne 0x1006b028
mov bl, bl
mov ebx, ebx
mov byte [esp + 0x48], 8
mov byte [esp + 0x49], 0
mov edi, edi
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov cl, cl
mov ebp, 4
push ebx
pop ebx
mov dword [esp + 0x44], ebp
push edx
pop edx
test byte [esi + 0x10], 1
je 0x1006b07b
cmp dword [edi + 0x32fc], 0
je 0x1006b07b
mov eax, dword [edi + 0x37cc]
cmp eax, 0x398
jae 0x1006b07b
push ebp
lea edx, [esp + 0x4c]
push edx
lea eax, [edi + eax + 0x337c]
push eax
call fcn.10119710
add esp, 0xc
mov dh, dh
mov dword [edi + 0x37d0], 4
push edx
pop edx
add dword [edi + 0x37cc], ebp
mov ch, ch
jmp 0x1006b463
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
add ebp, 0xc
lea edx, [esp + 0x4c]
push ebp
push edx
call fcn.100220c0
add esp, 0x18
xchg ebx, eax
xchg ebx, eax
jmp 0x1006b463
push edx
pop edx
mov dword [esp + 0x3c], ebx
mov cl, cl
mov eax, dword [esi]
cmp eax, 1
jne 0x1006b2cc
mov eax, dword [edi + 0x32d8]
cmp eax, ebx
mov ebp, 2
mov edx, 0x10000
jne 0x1006b0d1
mov dword [esp + 0x40], 0x14
push ecx
pop ecx
jmp 0x1006b0f5
cmp eax, 0xa
jne 0x1006b0e2
mov dword [esp + 0x40], 0
mov dl, dl
jmp 0x1006b0f5
cmp eax, 0xb
jne 0x1006b0ef
mov dword [esp + 0x40], edx
mov ebp, ebp
jmp 0x1006b0f5
mov dword [esp + 0x40], ebp
mov bh, bh
mov ax, word [esi + 6]
mov word [esp + 0x44], ax
mov eax, dword [esi + 8]
test al, 1
je 0x1006b116
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x46], cx
jmp 0x1006b12e
test al, 2
je 0x1006b125
mov word [esp + 0x46], 1
push ecx
pop ecx
jmp 0x1006b12e
mov word [esp + 0x46], 0
mov dh, dh
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x1006b1d9
mov eax, dword [esi + 8]
test al, 1
je 0x1006b1d9
test al, 2
je 0x1006b192
mov word [esp + 0x44], 0x37
mov ch, ch
mov word [esp + 0x46], bx
mov eax, eax
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006aae0
mov ecx, ecx
mov word [esp + 0x44], 0x2a
push eax
pop eax
mov word [esp + 0x46], bx
mov al, al
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006aae0
mov dh, dh
jmp 0x1006b463
mov word [esp + 0x44], 0x2a
mov ch, ch
mov word [esp + 0x46], bp
mov dl, dl
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006aae0
mov eax, eax
mov word [esp + 0x44], 0x37
mov ebp, ebp
mov word [esp + 0x46], bp
mov ebp, ebp
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006aae0
push edx
pop edx
jmp 0x1006b463
cmp cx, 0x13
jne 0x1006b258
mov eax, dword [esi + 8]
test al, 1
je 0x1006b258
test al, 2
jne 0x1006b463
mov ebp, 0x1d
mov word [esp + 0x44], bp
mov al, al
mov word [esp + 0x46], 4
mov esi, esi
xor esi, esi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006aae0
nop
mov word [esp + 0x44], 0x45
mov ebp, ebp
mov word [esp + 0x46], si
xchg ebx, eax
xchg ebx, eax
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006aae0
push ebx
pop ebx
mov word [esp + 0x44], bp
nop
mov word [esp + 0x46], 5
mov esi, esi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006aae0
push edx
pop edx
jmp 0x1006b463
mov al, al
mov edi, dword [edi + 0x32d8]
cmp edi, 1
je 0x1006b2a9
cmp edi, ebx
je 0x1006b2a9
cmp edi, 0xa
jne 0x1006b28b
mov dword [esp + 0x40], 0
mov ah, ah
lea edx, [esp + 0x3c]
push 0xc
push edx
call fcn.10068040
add esp, 8
mov ah, ah
jmp 0x1006b2c5
cmp edi, 0xb
jne 0x1006b2c5
mov dword [esp + 0x40], edx
mov al, al
lea eax, [esp + 0x3c]
push 0xc
push eax
call fcn.10068040
add esp, 8
mov al, al
jmp 0x1006b2c5
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x4c]
push 0xc
push edx
call fcn.100220c0
add esp, 0x18
push edx
pop edx
mov edi, edi
jmp 0x1006b463
cmp eax, ebp
jne 0x1006b463
xchg ebx, eax
xchg ebx, eax
xor ecx, ecx
mov ecx, ecx
xor edx, edx
mov dl, dl
xor ebp, ebp
xchg ebx, eax
xchg ebx, eax
xor ebx, ebx
mov edi, edi
mov dl, dl
mov eax, dword [edi + 0x32d8]
cmp eax, 3
jne 0x1006b2ff
mov dword [esp + 0x40], 0x1e
mov al, al
jmp 0x1006b327
cmp eax, 0xa
jne 0x1006b30c
mov dword [esp + 0x40], ecx
mov eax, eax
jmp 0x1006b327
cmp eax, 0xb
jne 0x1006b31d
mov dword [esp + 0x40], 0x10000
push ecx
pop ecx
jmp 0x1006b327
mov dword [esp + 0x40], 3
xchg ebx, eax
xchg ebx, eax
test dword [esi + 0x10], 0x8000
je 0x1006b339
mov eax, 3
mov ch, ch
jmp 0x1006b33d
xor eax, eax
mov al, al
test byte [esi + 0x10], 1
je 0x1006b34d
mov ebp, dword [esi + 4]
mov ecx, ecx
mov ebx, dword [esi + 8]
push ebx
pop ebx
test byte [esi + 0x10], 2
je 0x1006b35c
mov ecx, 1
xchg ebx, eax
xchg ebx, eax
push ebx
pop ebx
test byte [esi + 0x10], 4
je 0x1006b367
or ecx, 2
mov dl, dl
test byte [esi + 0x10], 8
je 0x1006b374
or ecx, 4
mov bh, bh
push ecx
pop ecx
test byte [esi + 0x10], 0x10
je 0x1006b37f
or ecx, 8
mov al, al
test byte [esi + 0x10], 0x20
je 0x1006b38b
or ecx, 0x10
nop
mov bh, bh
test byte [esi + 0x10], 0x40
je 0x1006b396
or ecx, 0x20
push edx
pop edx
test dword [esi + 0x10], 0x800
je 0x1006b3ad
or ecx, 0x400
push eax
pop eax
movzx edx, word [esi + 0xc]
mov edx, edx
mov word [esp + 0x44], ax
mov eax, eax
mov word [esp + 0x46], cx
mov eax, eax
mov word [esp + 0x48], dx
mov bl, bl
mov ch, ch
mov dword [esp + 0x4a], ebp
mov dl, dl
mov dword [esp + 0x4e], ebx
push ecx
pop ecx
cmp dword [edi + 0x32fc], 0
je 0x1006b44e
mov eax, dword [edi + 0x335c]
cmp eax, 6
jae 0x1006b44e
mov cx, word [esp + 0x44]
mov word [edi + eax*2 + 0x3308], cx
mov ebp, ebp
mov edx, dword [edi + 0x335c]
mov ax, word [esp + 0x46]
mov word [edi + edx*2 + 0x3314], ax
mov bl, bl
mov ecx, dword [edi + 0x335c]
mov dx, word [esp + 0x48]
mov word [edi + ecx*2 + 0x3320], dx
mov dl, dl
mov eax, dword [edi + 0x335c]
mov ecx, dword [esp + 0x4a]
mov dword [edi + eax*4 + 0x332c], ecx
xchg ebx, eax
xchg ebx, eax
mov edx, dword [edi + 0x335c]
mov eax, dword [esp + 0x4e]
mov dword [edi + edx*4 + 0x3344], eax
push ecx
pop ecx
add dword [edi + 0x335c], 1
push eax
pop eax
jmp 0x1006b463
mov edx, edx
mov bh, bh
xor esi, esi
lea edx, [esi + 0x16]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006ab70
nop
mov ecx, dword [esp + 0xcc]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10117937
add esp, 0xc0
ret