Function at 0x1006b360
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101ce2f4]
xor eax, esp
mov dword [esp + 0xbc], eax
push ebp
push esi
mov esi, dword [esp + 0xcc]
push edi
mov edi, edx
mov eax, dword [edi + 0x32d4]
xor ebp, ebp
cmp eax, ebp
jne 0x1006b3b6
mov eax, dword [esp + 0xd4]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
push eax
pop eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1011717a
add esp, 0xc0
ret
cmp eax, 4
jne 0x1006b50b
test eax, 0xcfe
call fcn.10067000
test eax, eax
je 0x1006b48f
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
test cl, cl
mov edx, dword [esi]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebp
mov bl, bl
mov eax, dword [esi]
cmp eax, 1
jne 0x1006b44d
mov ax, word [esi + 4]
mov word [esp + 0x18], ax
mov ah, ah
mov cx, word [esi + 6]
mov word [esp + 0x1a], cx
mov cl, cl
mov edx, dword [esi + 8]
mov dword [esp + 0x1c], edx
mov ah, ah
mov eax, dword [esi + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
nop
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebp
test eax, 0x65bf
jmp 0x1006b48f
cmp eax, ebp
jne 0x1006b48f
mov edx, dword [esi + 4]
mov dword [esp + 0x18], edx
mov edi, edi
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov dh, dh
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x20], ecx
push ebx
pop ebx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x24], edx
test al, al
mov eax, dword [esi + 0x14]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
test eax, eax
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ebp
test bh, bh
push edx
pop edx
mov dword [esp + 0xc], ebp
mov ecx, ecx
mov dword [esp + 0x38], 3
mov eax, eax
mov dword [esp + 0x3c], 1
mov edx, edx
call fcn.10067000
test eax, eax
je 0x1006b4c0
lea edx, [esp + 0x10]
mov dword [esp + 0x40], edx
test ebx, ebx
jmp 0x1006b4c6
mov dword [esp + 0x40], esi
push ebx
pop ebx
nop
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov al, al
test bl, bl
push 1
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebp
lea edx, [esp + 0x48]
push 0xc
push edx
call fcn.10023ba0
add esp, 0x18
mov ebp, ebp
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1011717a
add esp, 0xc0
ret
cmp eax, 1
push ebx
mov ebx, 3
je 0x1006b80d
cmp eax, ebx
je 0x1006b80d
cmp eax, 0xa
je 0x1006b80d
cmp eax, 0xb
je 0x1006b80d
cmp eax, 2
jne 0x1006bbd7
mov dword [esp + 0x10], ebp
test edi, edi
mov dword [esp + 0x3c], ebx
mov dh, dh
mov eax, dword [esi]
cmp eax, 1
jne 0x1006b630
test esi, esi
push ecx
pop ecx
mov dword [esp + 0x40], 7
mov ecx, ecx
movzx edx, word [esi + 4]
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0xc0]
push ecx
push edx
call fcn.100639e0
add esp, 0xc
test eax, eax
je 0x1006bbd7
test byte [esi + 8], 2
je 0x1006b5de
mov al, byte [esp + 0xc4]
test al, al
jbe 0x1006bbd7
movzx esi, al
push esi
lea eax, [esp + 0xc9]
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.10117f40
add esp, 0xc
test esi, esi
mov dword [esp + 0x44], esi
mov cl, cl
push 1
lea edx, [esp + 0x14]
push edx
push ebp
push ebp
add esi, 0xc
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.10023ba0
add esp, 0x18
test eax, eax
jmp 0x1006bbd7
movzx esi, byte [esp + 0xbc]
push esi
lea ecx, [esp + 0xc1]
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.10117f40
add esp, 0xc
test ebx, ebx
mov dword [esp + 0x44], esi
test cl, cl
movzx ecx, byte [esp + 0xc4]
push 1
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
add ecx, 0xc
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.10023ba0
add esp, 0x18
test eax, 0x75da
jmp 0x1006bbd7
cmp eax, ebp
jne 0x1006bbd7
mov ecx, ecx
xor ebp, ebp
nop
mov dword [esp + 0x40], 8
mov ebx, ebx
test byte [esi + 0x10], 1
je 0x1006b678
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x5c]
push ecx
call fcn.1006af60
add esp, 0x18
mov ebp, eax
test cl, cl
test byte [esi + 0x10], 2
je 0x1006b6a5
test bl, bl
nop
mov byte [esp + 0x48], 9
push eax
pop eax
mov byte [esp + 0x49], 0
test eax, 0x2260
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
test edi, edi
mov ebp, 4
test edi, edi
test byte [esi + 0x10], 8
je 0x1006b6d2
test bl, bl
nop
mov byte [esp + 0x48], 0xa
test edx, edx
mov byte [esp + 0x49], 0
test eax, 0x2260
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
test edi, edi
mov ebp, 4
test esi, esi
test byte [esi + 0x10], 0x20
je 0x1006b6ff
test bl, bl
nop
mov byte [esp + 0x48], 0xc
test ah, ah
mov byte [esp + 0x49], 0
test eax, 0x2260
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
test edi, edi
mov ebp, 4
test al, al
test dword [esi + 0x10], 0x800
je 0x1006b769
mov ebx, dword [esi + 0xc]
test bl, bl
nop
test ebx, ebx
mov byte [esp + 0x48], 8
je 0x1006b74d
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x1006b72d
or byte [esp + 0x48], 1
mov dl, dl
push 2
call ebp
test ax, ax
je 0x1006b73d
or byte [esp + 0x48], 2
test ebx, ebx
push 4
call ebp
test ax, ax
je 0x1006b74d
or byte [esp + 0x48], 4
mov ebp, ebp
mov byte [esp + 0x49], 0
test eax, 0x2260
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], bl
test edi, edi
mov ebp, 4
mov ah, ah
test byte [esi + 0x10], 1
jne 0x1006b797
test ebp, ebp
jne 0x1006b797
test bl, bl
nop
mov byte [esp + 0x48], 8
mov byte [esp + 0x49], 0
test eax, 0x2260
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
test edi, edi
mov ebp, 4
nop
mov dword [esp + 0x44], ebp
push edx
pop edx
test byte [esi + 0x10], 1
je 0x1006b7ea
cmp dword [edi + 0x32f8], 0
je 0x1006b7ea
mov eax, dword [edi + 0x37c8]
cmp eax, 0x398
jae 0x1006b7ea
push ebp
lea edx, [esp + 0x4c]
push edx
lea eax, [edi + eax + 0x3378]
push eax
call fcn.10117f40
add esp, 0xc
mov ebp, ebp
mov dword [edi + 0x37cc], 4
mov edi, edi
add dword [edi + 0x37c8], ebp
mov esi, esi
jmp 0x1006bbd7
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
add ebp, 0xc
lea edx, [esp + 0x4c]
push ebp
push edx
call fcn.10023ba0
add esp, 0x18
mov eax, eax
jmp 0x1006bbd7
mov ebp, ebp
mov dword [esp + 0x3c], ebx
test ch, ch
mov eax, dword [esi]
cmp eax, 1
jne 0x1006ba3b
mov eax, dword [edi + 0x32d4]
cmp eax, ebx
mov ebp, 2
mov edx, 0x10000
jne 0x1006b840
mov dword [esp + 0x40], 0x14
mov ebx, ebx
jmp 0x1006b863
cmp eax, 0xa
jne 0x1006b850
mov dword [esp + 0x40], 0
nop
jmp 0x1006b863
cmp eax, 0xb
jne 0x1006b85d
mov dword [esp + 0x40], edx
mov bh, bh
jmp 0x1006b863
mov dword [esp + 0x40], ebp
test ebx, ebx
mov ax, word [esi + 6]
mov word [esp + 0x44], ax
mov eax, dword [esi + 8]
test al, 1
je 0x1006b884
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x46], cx
jmp 0x1006b89c
test al, 2
je 0x1006b893
mov word [esp + 0x46], 1
mov ebp, ebp
jmp 0x1006b89c
mov word [esp + 0x46], 0
test ch, ch
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x1006b947
mov eax, dword [esi + 8]
test al, 1
je 0x1006b947
test al, 2
je 0x1006b900
mov word [esp + 0x44], 0x37
mov dl, dl
mov word [esp + 0x46], bx
test esi, esi
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b240
test esi, esi
mov word [esp + 0x44], 0x2a
mov dl, dl
mov word [esp + 0x46], bx
test bh, bh
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b240
mov ch, ch
jmp 0x1006bbd7
mov word [esp + 0x44], 0x2a
mov bh, bh
mov word [esp + 0x46], bp
test bl, bl
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b240
mov ebp, ebp
mov word [esp + 0x44], 0x37
mov ebx, ebx
mov word [esp + 0x46], bp
mov esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b240
mov ebx, ebx
jmp 0x1006bbd7
cmp cx, 0x13
jne 0x1006b9c7
mov eax, dword [esi + 8]
test al, 1
je 0x1006b9c7
test al, 2
jne 0x1006bbd7
mov ebp, 0x1d
mov word [esp + 0x44], bp
mov bl, bl
mov word [esp + 0x46], 4
mov ah, ah
xor esi, esi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b240
mov dh, dh
mov word [esp + 0x44], 0x45
mov cl, cl
mov word [esp + 0x46], si
test edi, edi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b240
test cl, cl
mov word [esp + 0x44], bp
test ecx, ecx
mov word [esp + 0x46], 5
mov edi, edi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b240
nop
jmp 0x1006bbd7
mov ah, ah
mov edi, dword [edi + 0x32d4]
cmp edi, 1
je 0x1006ba18
cmp edi, ebx
je 0x1006ba18
cmp edi, 0xa
jne 0x1006b9fa
mov dword [esp + 0x40], 0
mov esi, esi
lea edx, [esp + 0x3c]
push 0xc
push edx
call fcn.100693c0
add esp, 8
test bl, bl
jmp 0x1006ba34
cmp edi, 0xb
jne 0x1006ba34
mov dword [esp + 0x40], edx
mov dl, dl
lea eax, [esp + 0x3c]
push 0xc
push eax
call fcn.100693c0
add esp, 8
mov dh, dh
jmp 0x1006ba34
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x4c]
push 0xc
push edx
call fcn.10023ba0
add esp, 0x18
mov eax, eax
mov ebx, ebx
jmp 0x1006bbd7
cmp eax, ebp
jne 0x1006bbd7
test dh, dh
xor ecx, ecx
test eax, eax
xor edx, edx
test eax, 0x2831
xor ebp, ebp
test eax, eax
xor ebx, ebx
test ah, ah
mov al, al
mov eax, dword [edi + 0x32d4]
cmp eax, 3
jne 0x1006ba71
mov dword [esp + 0x40], 0x1e
test cl, cl
jmp 0x1006ba99
cmp eax, 0xa
jne 0x1006ba7e
mov dword [esp + 0x40], ecx
test dh, dh
jmp 0x1006ba99
cmp eax, 0xb
jne 0x1006ba8f
mov dword [esp + 0x40], 0x10000
test ebx, ebx
jmp 0x1006ba99
mov dword [esp + 0x40], 3
test ah, ah
test dword [esi + 0x10], 0x8000
je 0x1006baab
mov eax, 3
mov bh, bh
jmp 0x1006baaf
xor eax, eax
mov ebx, ebx
test byte [esi + 0x10], 1
je 0x1006babf
mov ebp, dword [esi + 4]
mov dl, dl
mov ebx, dword [esi + 8]
push ecx
pop ecx
test byte [esi + 0x10], 2
je 0x1006bace
mov ecx, 1
test bh, bh
test bh, bh
test byte [esi + 0x10], 4
je 0x1006bad9
or ecx, 2
mov esi, esi
test byte [esi + 0x10], 8
je 0x1006bae6
or ecx, 4
mov ch, ch
test esi, esi
test byte [esi + 0x10], 0x10
je 0x1006baf1
or ecx, 8
mov bh, bh
test byte [esi + 0x10], 0x20
je 0x1006bafe
or ecx, 0x10
mov cl, cl
mov cl, cl
test byte [esi + 0x10], 0x40
je 0x1006bb09
or ecx, 0x20
push edx
pop edx
test dword [esi + 0x10], 0x800
je 0x1006bb20
or ecx, 0x400
test dh, dh
movzx edx, word [esi + 0xc]
push edx
pop edx
mov word [esp + 0x44], ax
mov ecx, ecx
mov word [esp + 0x46], cx
test ah, ah
mov word [esp + 0x48], dx
mov dh, dh
push ecx
pop ecx
mov dword [esp + 0x4a], ebp
test cl, cl
mov dword [esp + 0x4e], ebx
mov ebp, ebp
cmp dword [edi + 0x32f8], 0
je 0x1006bbc1
mov eax, dword [edi + 0x3358]
cmp eax, 6
jae 0x1006bbc1
mov cx, word [esp + 0x44]
mov word [edi + eax*2 + 0x3304], cx
xchg ebx, eax
xchg ebx, eax
mov edx, dword [edi + 0x3358]
mov ax, word [esp + 0x46]
mov word [edi + edx*2 + 0x3310], ax
push ebx
pop ebx
mov ecx, dword [edi + 0x3358]
mov dx, word [esp + 0x48]
mov word [edi + ecx*2 + 0x331c], dx
mov edi, edi
mov eax, dword [edi + 0x3358]
mov ecx, dword [esp + 0x4a]
mov dword [edi + eax*4 + 0x3328], ecx
test ebx, ebx
mov edx, dword [edi + 0x3358]
mov eax, dword [esp + 0x4e]
mov dword [edi + edx*4 + 0x3340], eax
mov dl, dl
add dword [edi + 0x3358], 1
test al, al
jmp 0x1006bbd7
test esi, esi
test bh, bh
xor esi, esi
lea edx, [esi + 0x16]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b2d0
push ecx
pop ecx
mov ecx, dword [esp + 0xcc]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1011717a
add esp, 0xc0
ret