Function at 0x500a1a56
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xd1c
push ebx
xor ebx, ebx
push esi
mov eax, 0x104
push edi
lea ecx, [ebp - 0x680]
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x6c], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x4c], ebx
call fcn.500a785c
lea ecx, [ebp - 0xaa0]
call fcn.500a785c
lea eax, [ebp + 0x68]
push eax
mov eax, 0x5002a174
push eax
push eax
call fcn.501a5bb0
mov esi, eax
cmp esi, ebx
jl 0x500a2019
cmp dword [ebp + 0x68], ebx
je 0x500a1f35
lea eax, [ebp + 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp + 0x64]
push eax
mov eax, 0x5002a5b4
push eax
push eax
mov dword [ebp - 0x24], ebx
call fcn.501a5bb0
test eax, eax
jl 0x500a1b00
mov eax, dword [ebp + 0x64]
cmp eax, ebx
je 0x500a1b00
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0x64]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x10]
lea eax, [ebp + 0x70]
push eax
call dword [0x5029af38]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x70]
cmp eax, ebx
je 0x500a1f35
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x14]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov edi, dword [ebp + 0x7c]
mov edx, dword [edi + 0x1c]
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
and edx, 1
push edx
push eax
call dword [ecx + 0x118]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x204]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x3c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x34]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x70]
push dword [edi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
lea eax, [ebp + 0x4c]
push eax
call fcn.5019e0ec
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x70]
push dword [ebp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
push dword [edi + 0x14]
lea ecx, [ebp - 0xaa0]
call fcn.500a6ec8
lea eax, [ebp - 0xaa0]
push eax
call fcn.50272bbe
mov eax, dword [ebp + 0x70]
mov esi, dword [eax]
lea ecx, [ebp - 0xaa0]
call fcn.500a70fc
push eax
push dword [ebp + 0x70]
call dword [esi + 0xb8]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
lea edx, [ebp + 0x6c]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
je 0x500a1f35
mov ecx, dword [eax]
push ebx
push 0xa
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xa
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xc
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xc
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xd
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xd
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xf
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0xf
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0x11
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x6c]
mov ecx, dword [eax]
push ebx
push 0x11
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
lea edx, [ebp + 0x58]
push edx
push eax
call dword [ecx + 0xcc]
cmp dword [ebp + 0x58], ebx
je 0x500a1f35
lea eax, [ebp + 0x5c]
push eax
call dword [0x5029af34]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
je 0x500a1f35
mov ecx, dword [eax]
push 7
push eax
call dword [ecx + 0x14]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov esi, 0x3400
push esi
call fcn.5005698e
shr eax, 0x10
test ax, ax
push esi
je 0x500a1dbb
call fcn.5005698e
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.50260700
mov edi, esp
push esi
call fcn.5005698e
push eax
push edi
call fcn.5024c7db
mov edi, dword [ebp + 0x7c]
jmp 0x500a1dc0
call fcn.5005698e
mov ecx, dword [ebp + 0x5c]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x58]
push dword [ebp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x110]
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
push ebx
push 0x500a0baf
push eax
call dword [ecx + 0x90]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
push dword [edi + 0x18]
push 0x5009b7f9
call dword [0x5029af28]
mov eax, dword [edi + 4]
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
push dword [0x5029a6cc]
push 0x500a0d02
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x58]
mov dword [0x5028e8c4], eax
mov eax, dword [ebp + 0x70]
mov dword [0x5028e8c0], eax
push dword [edi + 4]
call fcn.50272bbe
mov eax, dword [ebp + 0x68]
push ebx
mov dword [0x5028e8c0], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
push dword [edi + 4]
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
lea edx, [ebp + 0x44]
push edx
push eax
call dword [ecx + 0x88]
mov edi, eax
mov eax, dword [ebp + 0x68]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
cmp edi, ebx
mov esi, edi
jl 0x500a2019
mov eax, dword [ebp + 0x44]
and eax, 0xff
cmp eax, 2
je 0x500a1ed5
cmp eax, 4
je 0x500a1ed5
mov esi, 0x8004000c
jmp 0x500a2019
mov eax, dword [ebp + 0x70]
mov ecx, dword [eax]
lea edx, [ebp + 0x54]
push edx
push eax
call dword [ecx + 0xc4]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
je 0x500a1f35
mov ecx, dword [eax]
lea edx, [ebp + 0x60]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x60]
cmp eax, ebx
je 0x500a1f35
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
cmp eax, 1
jne 0x500a2001
mov eax, dword [ebp + 0x60]
mov ecx, dword [eax]
push ebx
lea edx, [ebp + 0x50]
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
mov eax, dword [ebp + 0x50]
cmp eax, ebx
jne 0x500a1f3f
mov esi, 0x8007000e
jmp 0x500a2019
mov ecx, dword [eax]
push 3
lea edx, [ebp + 0x48]
push edx
lea edx, [ebp - 0x260]
push edx
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, ebx
jl 0x500a2019
lea eax, [ebp - 0x260]
push 0x50007e60
push eax
call dword [sym.imp.MSVCR70.dll_wcsstr]
test eax, eax
mov edi, dword [sym.imp.MSVCR70.dll_wcscpy]
pop ecx
pop ecx
je 0x500a1fad
push 0x30000000
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0xca8]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
je 0x500a1fad
lea eax, [ebp - 0xca8]
push eax
lea eax, [ebp - 0x260]
push eax
call edi
pop ecx
pop ecx
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x680]
call fcn.500a6ec8
lea ecx, [ebp - 0x680]
call fcn.50272bbe
push eax
lea eax, [ebp - 0x260]
push eax
call edi
pop ecx
pop ecx
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x680]
call fcn.500a6ec8
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.MSVCR70.dll_wcslen]
inc eax
cmp eax, 0x104
pop ecx
mov dword [ebp + 0x48], eax
jbe 0x500a2008
mov esi, 0x8000ffff
jmp 0x500a2019
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp + 0x7c]
push dword [eax + 0xc]
call edi
pop ecx
pop ecx
cmp dword [ebp - 0x24], ebx
je 0x500a2027
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea eax, [ebp + 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 0x68]
cmp eax, ebx
je 0x500a2041
mov dword [ebp + 0x68], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x64]
cmp eax, ebx
je 0x500a2051
mov dword [ebp + 0x64], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x70]
cmp eax, ebx
je 0x500a2061
mov dword [ebp + 0x70], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
je 0x500a2071
mov dword [ebp + 0x6c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x58]
cmp eax, ebx
je 0x500a2081
mov dword [ebp + 0x58], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
je 0x500a2091
mov dword [ebp + 0x54], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x60]
cmp eax, ebx
je 0x500a20a1
mov dword [ebp + 0x60], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x50]
cmp eax, ebx
je 0x500a20b1
mov dword [ebp + 0x50], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp + 0x4c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0x2c], ebx
jne 0x500a20c5
push ebx
call fcn.50272bbe
push 1
call fcn.50272bbe
lea ecx, [ebp - 0xaa0]
mov dword [0x5028e8c4], ebx
call fcn.501b7afc
lea ecx, [ebp - 0x680]
call fcn.501b7afc
mov eax, esi
lea esp, [ebp - 0xcb4]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4