Function at 0x10059380
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2050
call fcn.100ac6d0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2038], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x202c], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov dword [ebp - 0x2050], eax
mov eax, dword [ebp + 0x20]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2040], eax
mov byte [eax], 0
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, dword [ebp + 0xc]
xor bl, bl
mov dword [ebp - 0x2034], eax
mov dword [ebp - 0x2024], ebx
mov byte [ebp - 0x2030], bl
mov byte [ebp - 0x201d], bl
mov byte [ebp - 0x2025], bl
cmp esi, 0x100
je 0x10059419
cmp esi, 0x104
je 0x10059419
cmp esi, 0x101
je 0x10059419
cmp esi, 0x105
jne 0x100594b2
mov ecx, dword [ebp + 0x10]
lea eax, [ecx - 1]
cmp eax, 0xfe
ja 0x100594b2
cmp ecx, 0xe5
je 0x10059436
mov bl, cl
jmp 0x1005944f
mov eax, dword [ebp - 0x203c]
sar eax, 0x10
push 1
and eax, 0xff
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov bl, al
mov byte [ebp - 0x2030], bl
mov dword [ebp - 0x2024], ebx
cmp esi, 0x100
je 0x10059472
mov byte [ebp - 0x201d], 0
cmp esi, 0x104
jne 0x10059479
mov byte [ebp - 0x201d], 1
cmp byte [edi + 0x6ec], 0
je 0x100594b2
push dword [ebp - 0x2030]
mov ecx, edi
push 0
call fcn.10059160
test al, al
jne 0x100594a9
cmp bl, 0x11
jne 0x100594b2
mov ecx, dword [edi + 0x6f0]
call fcn.10054750
test al, al
je 0x100594b2
mov eax, dword [ebp - 0x202c]
mov byte [eax], 1
cmp esi, 0x201
je 0x10059583
cmp esi, 0x202
je 0x10059583
cmp esi, 0x204
je 0x10059579
cmp esi, 0x205
je 0x10059579
cmp esi, 0x207
je 0x1005956f
cmp esi, 0x208
je 0x1005956f
cmp esi, 0x20b
jne 0x10059529
mov eax, dword [ebp + 0x10]
test al, 0x20
je 0x10059513
mov ebx, 5
mov byte [ebp - 0x201d], 1
jmp 0x10059559
test al, 0x40
movzx ebx, bl
mov eax, 6
mov byte [ebp - 0x201d], 1
cmovne ebx, eax
jmp 0x10059559
cmp esi, 0x20c
jne 0x10059565
cmp byte [edi + 0xc9], 1
jne 0x1005953e
mov bl, 5
jmp 0x10059552
cmp byte [edi + 0xca], 1
mov ecx, 6
movzx eax, bl
cmove eax, ecx
mov bl, al
mov byte [ebp - 0x201d], 0
mov dword [ebp - 0x2024], ebx
mov byte [ebp - 0x2030], bl
test bl, bl
je 0x100596f5
jmp 0x1005959e
mov bl, 4
cmp esi, 0x207
jmp 0x1005958b
mov bl, 2
cmp esi, 0x204
jmp 0x1005958b
mov bl, 1
cmp esi, 0x201
mov dword [ebp - 0x2024], ebx
sete byte [ebp - 0x201d]
mov byte [ebp - 0x2030], bl
mov eax, dword [ebp - 0x203c]
shr eax, 0x1e
and eax, 0xffffff01
mov byte [ebp - 0x2044], 0
cmp byte [ebp - 0x201d], 0
mov dword [ebp - 0x2048], eax
je 0x100596d8
cmp bl, 9
jne 0x100595ec
mov ecx, dword [edi + 0x6f0]
call fcn.1001d870
test al, al
je 0x1005961e
cmp byte [ebp - 0x2048], 0
je 0x1005961e
mov byte [ebp - 0x2044], 1
jmp 0x1005961e
cmp bl, 0x11
jne 0x1005961e
push 0x11
push 0
mov ecx, edi
call fcn.10059160
test al, al
je 0x1005961e
mov ecx, dword [ebp - 0x2044]
mov eax, 1
cmp byte [ebp - 0x2048], 0
movzx ecx, cl
cmovne ecx, eax
mov dword [ebp - 0x2044], ecx
mov eax, dword [edi + 0x8c]
test eax, eax
je 0x100596a2
cmp bl, byte [eax + 0x13]
je 0x1005963c
cmp bl, byte [eax + 0x14]
je 0x1005963c
cmp bl, byte [eax + 0x15]
je 0x1005963c
cmp bl, byte [eax + 0x16]
jne 0x100596a2
mov edx, dword [edi + 8]
xor cl, cl
mov dword [ebp - 0x204c], ecx
mov eax, dword [edx]
mov dword [ebp - 0x202c], eax
cmp eax, edx
je 0x10059695
mov ebx, ecx
mov esi, 1
lea ebx, [ebx]
cmp byte [eax + 0x5b], 0
lea ecx, [ebp - 0x202c]
movzx ebx, bl
cmovne ebx, esi
call fcn.10009e10
mov eax, dword [ebp - 0x202c]
cmp eax, dword [edi + 8]
jne 0x10059660
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x204c], ebx
mov ebx, dword [ebp - 0x2024]
mov ecx, dword [ebp - 0x204c]
cmp byte [ebp - 0x2048], 0
je 0x100596a2
test cl, cl
jne 0x100596f5
cmp byte [ebp - 0x2044], 0
jne 0x100596f5
cmp byte [edi + 0x6ec], 0
je 0x100596ee
movzx eax, bl
cmp byte [edi + eax + 0xc4], 0
jne 0x100596ce
mov ecx, dword [ebp - 0x2034]
mov dword [edi + eax*4 + 0x1c4], ecx
mov byte [edi + eax + 0xc4], 1
jmp 0x100596ee
movzx eax, bl
mov dword [edi + eax*4 + 0x1c4], 0
mov byte [edi + eax + 0xc4], 0
mov byte [ebp - 0x2025], 1
cmp byte [edi + 0x6ec], 0
je 0x10059d15
mov al, byte [edi + 0xad]
test al, al
je 0x100597d1
cmp bl, al
jne 0x100597d1
cmp byte [ebp - 0x201d], 0
jne 0x100597d1
mov ecx, dword [edi + 0x6f0]
movzx eax, al
push eax
mov dword [ebp - 0x202c], eax
call fcn.10054920
test al, al
jne 0x100597d1
push dword [ebp - 0x202c]
mov ecx, dword [edi + 0x6f0]
call fcn.10054980
test al, al
jne 0x100597d1
cmp byte [edi + 0xae], al
je 0x10059786
mov eax, dword [sym.imp.USER32.dll_ClipCursor]
push 0
call eax
mov eax, dword [edi + 0x6f0]
mov word [edi + 0xae], 0
mov ecx, dword [eax + 0xc]
movzx eax, byte [edi + 0xad]
push eax
push 0
jmp 0x100597c7
lea eax, [ebp - 0x201c]
push eax
push dword [ebp - 0x2038]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x100597d1
lea eax, [ebp - 0x201c]
push eax
mov eax, dword [sym.imp.USER32.dll_ClipCursor]
call eax
mov eax, dword [edi + 0x6f0]
mov word [edi + 0xae], 0x101
mov ecx, dword [eax + 0xc]
movzx eax, byte [edi + 0xad]
push eax
push 1
mov edx, dword [ecx]
push 1
call dword [edx + 0xa0]
cmp esi, 0x113
jne 0x10059879
cmp dword [ebp + 0x10], 0x80
jne 0x10059879
cmp byte [edi + 0xaf], 0
je 0x10059879
mov ecx, dword [0x100ec5c4]
mov eax, 0xcccccccd
inc ecx
mul ecx
mov dword [0x100ec5c4], ecx
shr edx, 2
lea eax, [edx + edx*4]
sub ecx, eax
jne 0x10059879
xorps xmm0, xmm0
push 1
movdqu xmmword [ebp - 0x201c], xmm0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x202c], eax
lea eax, [ebp - 0x201c]
push eax
call dword [sym.imp.USER32.dll_GetClipCursor]
test eax, eax
je 0x10059855
mov ecx, dword [ebp - 0x2010]
sub ecx, dword [ebp - 0x2018]
je 0x10059855
cmp ecx, dword [ebp - 0x202c]
jb 0x10059879
mov eax, dword [edi + 0x6f0]
mov byte [edi + 0xaf], 0
mov ecx, dword [eax + 0xc]
movzx eax, byte [edi + 0xad]
push eax
push 0
mov edx, dword [ecx]
push 1
call dword [edx + 0xa0]
cmp byte [edi + 0xad], 0
je 0x10059929
cmp esi, 8
jne 0x1005989d
mov eax, dword [sym.imp.WINMM.dll_timeGetTime]
call eax
mov dword [edi + 0xb0], eax
jmp 0x10059a2b
cmp esi, 7
jne 0x10059929
cmp byte [edi + 0xae], 0
je 0x100599ed
cmp byte [edi + 0xaf], 0
jne 0x100599ed
mov eax, dword [sym.imp.WINMM.dll_timeGetTime]
call eax
sub eax, dword [edi + 0xb0]
cmp eax, 0x7d0
ja 0x100599ed
lea eax, [ebp - 0x201c]
push eax
push dword [ebp - 0x2038]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x100599ed
lea eax, [ebp - 0x201c]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
mov eax, dword [edi + 0x6f0]
mov byte [edi + 0xaf], 1
mov ecx, dword [eax + 0xc]
movzx eax, byte [edi + 0xad]
push eax
push 1
mov edx, dword [ecx]
push 1
call dword [edx + 0xa0]
jmp 0x100599ed
cmp esi, 0x20a
jne 0x100599e8
cmp byte [edi + 0xd5], 0
je 0x10059954
push 0x11
push 0
mov ecx, edi
call fcn.10059160
test al, al
je 0x10059954
mov byte [edi + 0xd5], 0
mov ecx, dword [ebp + 0x10]
movzx eax, cx
test al, 0x18
jne 0x10059a5d
mov eax, ecx
shr eax, 0x10
movsx ecx, ax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
jns 0x10059983
mov cl, 0x9a
jmp 0x1005998d
test eax, eax
jle 0x10059a5a
mov cl, 0x9b
cmp dword [edi + 0x6c8], 0
je 0x100599b8
mov eax, dword [edi + 0x6c4]
mov edx, dword [eax + 4]
cmp byte [edx + 8], cl
jne 0x100599b8
mov eax, dword [ebp - 0x2034]
sub eax, dword [edx + 0xc]
cmp eax, 0xc8
jbe 0x10059a5a
mov eax, dword [ebp - 0x2034]
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2018]
mov byte [ebp - 0x2018], cl
lea ecx, [edi + 0x6c4]
push eax
mov dword [ebp - 0x2010], 6
call fcn.100307b0
jmp 0x10059a5a
cmp esi, 7
jne 0x10059a26
xor esi, esi
mov ebx, 0x8000
cmp byte [edi + esi + 0xc4], 0
je 0x10059a12
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
jne 0x10059a12
mov byte [edi + esi + 0xc4], 0
inc esi
cmp esi, 0x100
jl 0x100599f4
mov ebx, dword [ebp - 0x2024]
mov esi, dword [ebp + 0xc]
jmp 0x10059a5a
cmp esi, 8
jne 0x10059a40
cmp byte [edi + 0xd6], 0
mov ecx, dword [ebp + 0x10]
je 0x10059a5d
mov byte [edi + 0xd6], 0
jmp 0x10059a5d
cmp esi, 0x20
jne 0x10059a5a
mov ecx, edi
call fcn.10065540
mov ecx, dword [ebp - 0x2040]
mov al, byte [edi + 0x6d4]
mov byte [ecx], al
mov ecx, dword [ebp + 0x10]
cmp byte [edi + 0x6d4], 0
je 0x10059ad6
cmp esi, 0x204
je 0x10059a8f
cmp esi, 0x205
je 0x10059a8f
cmp esi, 0x113
jne 0x10059a98
cmp ecx, 0x80
jne 0x10059a98
cmp dword [edi + 0x6e0], 0
je 0x10059ad6
mov ecx, edi
call fcn.10065540
jmp 0x10059ad6
test bl, bl
je 0x10059ad6
cmp byte [ebp - 0x201d], 0
je 0x10059ad6
lea eax, [ebp - 0x2030]
push eax
lea eax, [ebp - 0x2040]
push eax
lea ecx, [edi + 0x30]
call fcn.10065870
mov eax, dword [ebp - 0x2040]
cmp eax, dword [edi + 0x30]
je 0x10059ad3
cmp byte [eax + 0x2c], 0
jne 0x10059ad3
mov ecx, edi
call fcn.10065540
mov esi, dword [ebp + 0xc]
mov ecx, dword [edi + 0xbc]
test ecx, ecx
jne 0x10059aec
cmp dword [edi + 0xc0], ecx
je 0x10059b39
test ecx, ecx
je 0x10059b14
mov al, byte [ecx + 0x50]
test al, al
je 0x10059b00
movzx eax, al
cmp byte [eax + edi + 0xc4], 0
jne 0x10059b2c
mov al, byte [ecx + 0x51]
test al, al
je 0x10059b14
movzx eax, al
cmp byte [eax + edi + 0xc4], 0
jne 0x10059b2c
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x10059b39
movzx eax, byte [eax + 0x24]
cmp byte [eax + edi + 0xc4], 0
je 0x10059b39
mov eax, dword [edi + 0x6f0]
mov byte [eax + 0xf2c], 1
lea ebx, [edi + 0xc4]
mov ecx, edi
push ebx
call fcn.100620d0
push ebx
mov ecx, edi
call fcn.100622f0
cmp esi, 0xff
jne 0x10059c15
mov eax, dword [edi + 0x6f0]
cmp byte [eax + 0xf2d], 0
je 0x10059cf0
mov esi, dword [sym.imp.USER32.dll_GetRawInputData]
lea eax, [ebp - 0x2034]
push 0x10
push eax
push 0
push 0x10000003
push dword [ebp - 0x203c]
mov dword [ebp - 0x2034], 0
call esi
push 0x1fff
lea eax, [ebp - 0x200b]
mov byte [ebp - 0x200c], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp dword [ebp - 0x2034], 0x2000
ja 0x10059cf0
push 0x10
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x200c]
push eax
push 0x10000003
push dword [ebp - 0x203c]
call esi
test eax, eax
je 0x10059cf0
cmp dword [ebp - 0x200c], 0
jne 0x10059cf0
test byte [ebp - 0x1ffc], 1
jne 0x10059cf0
lea eax, [ebp - 0x200c]
mov ecx, edi
push eax
call fcn.10061d20
jmp 0x10059cf0
cmp esi, 0x201
jne 0x10059cf0
cmp dword [edi + 0xc0], 0
je 0x10059cf0
mov eax, dword [edi + 0x6f0]
mov ecx, dword [eax + 0xeb0]
cmp ecx, 0x5a
je 0x10059c5b
cmp ecx, 0x10e
je 0x10059c5b
mov ecx, dword [eax + 0xf24]
mov dword [ebp - 0x2038], ecx
mov ecx, dword [eax + 0xf28]
jmp 0x10059c6d
mov ecx, dword [eax + 0xf28]
mov dword [ebp - 0x2038], ecx
mov ecx, dword [eax + 0xf24]
mov dword [ebp - 0x202c], ecx
lea ecx, [ebp - 0x201c]
push ecx
push dword [eax + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x203c]
mov ecx, dword [ebp - 0x2014]
sub ecx, dword [ebp - 0x201c]
movsx edx, ax
shr eax, 0x10
movsx esi, ax
mov eax, dword [ebp - 0x2038]
imul eax, edx
cdq
idiv ecx
mov ecx, dword [ebp - 0x2010]
sub ecx, dword [ebp - 0x2018]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp - 0x202c]
imul eax, esi
cdq
idiv ecx
mov edx, dword [ebp - 0x2040]
test edx, edx
js 0x10059cf0
test eax, eax
js 0x10059cf0
mov ecx, dword [edi + 0xc0]
cmp edx, dword [ecx + 0x1c]
jg 0x10059cf0
cmp eax, dword [ecx + 0x20]
jg 0x10059cf0
cmp byte [ecx + 0x18], 0
jne 0x10059cf0
mov byte [ecx + 0x18], 1
cmp byte [ebp - 0x2025], 0
je 0x10059d15
mov esi, dword [ebp - 0x2050]
mov ecx, edi
push esi
push 0
push ebx
call fcn.1005e040
push esi
push 0
push ebx
mov ecx, edi
call fcn.10060610
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ab974
mov esp, ebp
pop ebp
ret 0x1c