Function at 0x100071bc
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], eax
mov esi, dword [ebp + 0x14]
lea edi, [ebp - 0x101]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
xor eax, eax
push ebp
push 0x100078b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.10003770
movzx eax, word [ebp + 0xc]
add eax, 0xfffffff8
cmp eax, 0xf3
ja case.0x10006ed5.8
mov al, byte [eax + 0x10006edc]
jmp dword [eax*4 + 0x10006fd0]
mov eax, ebx
mov edx, 0x100078cc
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x100078e8
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007904
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007920
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x1000793c
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x1000794c
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007964
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007980
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007988
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007990
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007998
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x100079a0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x100079a8
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x100079b0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x100079b8
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x100079c0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x100079c8
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x100079d0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x100079ec
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007a00
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007a18
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007a2c
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007a40
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007a58
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007a64
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007a7c
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007a98
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007aa0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007abc
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007acc
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007ae0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007af8
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007b1c
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007b38
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007b50
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007b70
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007b80
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007b90
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007ba0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007bb0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007bc0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007bd0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007be0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007bf0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007c00
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007c10
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007c20
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007c30
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007c40
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007c50
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007c60
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007c70
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007c80
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007c90
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007ca0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007cb0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007cc0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007cd0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007ce0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007cf0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007d00
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007d14
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007d28
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007d40
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007d54
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007d68
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007d84
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007da4
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007dc0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007de0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007e04
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007e2c
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007e40
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007e60
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007e7c
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007e98
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007eac
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007ec0
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007ed8
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007ef8
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007f18
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007f34
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007f54
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007f68
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007f8c
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007fa8
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007fc8
call fcn.100037ac
jmp case.0x10006ed5.8
mov eax, ebx
mov edx, 0x10007fe8
call fcn.100037ac
mov eax, dword [ebx]
xor edx, edx
call fcn.10003a34
je 0x1000772c
cmp byte [0x1000f6c2], 1
jne 0x1000772c
mov edx, dword [ebx]
mov eax, 0x10008004
call fcn.10003b94
test eax, eax
jle 0x1000772c
mov edx, dword [ebx]
mov eax, 0x1000800c
call fcn.10003b94
test eax, eax
jg 0x1000772c
mov eax, ebx
mov edx, 0x10008020
call fcn.100037ac
call fcn.10006d04
mov byte [ebp - 1], al
push edi
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x101]
push eax
movzx eax, word [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
call sub.user32.dll_ToUnicodeEx
mov esi, eax
test esi, esi
jle 0x1000780e
push edi
mov esi, 0x1000f6d8
lea edi, [ebp - 0x20c]
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebx]
xor edx, edx
call fcn.10003a34
jne 0x100077d0
mov eax, ebx
lea edx, [ebp - 0x30c]
mov ecx, 0x80
call fcn.100038e0
cmp byte [ebp - 1], 0
je 0x100077b6
lea edx, [ebp - 0x410]
mov eax, dword [ebx]
call fcn.10006dfc
mov edx, dword [ebp - 0x410]
mov eax, ebx
call fcn.100037ac
jmp 0x100077d0
lea edx, [ebp - 0x414]
mov eax, dword [ebx]
call fcn.10006d80
mov edx, dword [ebp - 0x414]
mov eax, ebx
call fcn.100037ac
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x100077fd
push edi
push 0
push pe_nt_image_headers32
lea edx, [ebp - 0x30c]
push edx
lea edx, [ebp - 0x204]
push edx
mov edx, dword [ebp - 0x208]
push edx
push eax
call sub.user32.dll_ToUnicodeEx
mov eax, 0x1000f6d8
mov edx, 0x108
call fcn.100050d8
jmp 0x10007884
test esi, esi
jge 0x10007884
movzx eax, word [ebp + 0xc]
mov dword [0x1000f6d8], eax
movzx eax, word [ebp + 0x10]
mov dword [0x1000f6dc], eax
push esi
push edi
lea esi, [ebp - 0x101]
mov edi, 0x1000f6e0
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x40c]
mov edx, pe_nt_image_headers32
call fcn.100050d8
push 1
push 0x6e
call sub.user32.dll_MapVirtualKeyW
test esi, esi
jge 0x10007884
push edi
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x40c]
push eax
push 1
push 0x6e
call sub.user32.dll_MapVirtualKeyW
push eax
push 0x6e
call sub.user32.dll_ToUnicodeEx
mov esi, eax
test esi, esi
jl 0x10007857
mov eax, dword [ebx]
mov edx, 0x10008020
call fcn.10003a34
jne 0x10007899
mov eax, ebx
call fcn.10003770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100078be
lea eax, [ebp - 0x414]
mov edx, 2
call fcn.10003788
ret