Function at 0x1012eb1
Capabilities:
Check for peb beingdebugged flag
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
xor ecx, ecx
test byte [0x10382d4], 2
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 1
je 0x101356e
cmp word [0x10382d8], cx
push ebx
mov ebx, dword [0x1038258]
jge 0x1012eea
xor eax, eax
mov word [0x10382d8], ax
cmp word [0x10382da], cx
jge 0x1012efb
xor eax, eax
mov word [0x10382da], ax
movzx eax, word [ebx + 8]
cmp word [0x10382dc], ax
jl 0x1012f0f
dec eax
mov word [0x10382dc], ax
movzx eax, word [ebx + 0xa]
cmp word [0x10382de], ax
jl 0x1012f23
dec eax
mov word [0x10382de], ax
mov eax, dword [0x10382de]
sub eax, dword [0x10382da]
push esi
mov esi, dword [0x10382dc]
sub esi, dword [0x10382d8]
push edi
inc esi
inc eax
test byte [ebx], 1
mov word [ebp - 0x38], si
mov word [ebp - 0x36], ax
je 0x1013450
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 4
pop edx
cmp byte [0x1038415], cl
je 0x1012fa2
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movsx esi, si
add esi, edx
mov dword [ebp - 0x1c], edx
movsx edx, word [ebp - 0x36]
imul esi, edx
lea edx, [esi + esi + 2]
push edx
add ecx, 0x300000
push ecx
push dword [eax + 0x18]
mov dword [ebp - 0x18], 2
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x1012fa5
jmp 0x101356b
mov dword [ebp - 4], ecx
movsx esi, word [ebp - 0x38]
movsx eax, word [ebp - 0x36]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], esi
add esi, ecx
imul esi, eax
imul esi, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
shl esi, 2
push esi
push dword [0x1038030]
push dword [eax + 0x18]
call edi
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1012fef
cmp dword [ebp - 4], eax
je 0x101356b
push dword [ebp - 4]
jmp 0x10130c8
cmp byte [0x1038415], 0
mov eax, dword [ebp - 0x38]
jne 0x10130ee
test byte [0x10382f8], 1
je 0x1013065
test dword [0x10382cc], 0x200
je 0x1013065
mov edi, dword [ebp - 0xc]
push esi
push edi
push 0x10382d8
push ebx
call fcn.01020954
xor eax, eax
cmp ax, word [ebp - 0x36]
mov esi, edi
jge 0x10130a6
movzx eax, word [ebp - 0x36]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp ax, word [ebp - 0x38]
jge 0x101305e
movzx eax, word [ebp - 0x38]
mov dword [ebp - 0x1c], eax
movzx eax, byte [esi]
push eax
push dword [0x1038334]
call fcn.0101c2e3
mov word [esi], ax
add esi, 4
dec dword [ebp - 0x1c]
jne 0x1013044
dec dword [ebp - 0x18]
je 0x10130a6
jmp 0x1013035
mov cx, word [0x10382d8]
mov edi, dword [ebp - 0xc]
mov word [ebp - 8], cx
mov cx, word [0x10382da]
mov word [ebp - 6], cx
xor ecx, ecx
mov word [ebp - 0x3e], cx
mov word [ebp - 0x40], cx
lea ecx, [eax - 1]
mov word [ebp - 0x3c], cx
mov ecx, dword [ebp - 0x36]
dec ecx
mov word [ebp - 0x3a], cx
lea ecx, [ebp - 0x40]
push ecx
push eax
push edi
push dword [ebp - 8]
push ebx
call fcn.0101cc5f
mov eax, dword [ebp - 0x10]
add eax, 2
imul eax, dword [ebp - 0x30]
lea eax, [eax + eax + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x10130e1
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x101356b
cmp byte [0x1038415], 0
je 0x1013233
test byte [ebx], 4
je 0x1013106
test byte [0x10382f8], 1
jne 0x1013106
and dword [ebp - 0x18], 0
and dword [ebp - 0x28], 0
jmp 0x1013114
mov dword [ebp - 0x18], 0xd
mov dword [ebp - 0x28], 0xa
mov esi, dword [ebp - 4]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
and dword [ebp - 0x14], 0
movzx edi, ax
shr edi, 0xf
not edi
and edi, 1
xor eax, eax
cmp ax, word [ebp - 0x36]
mov dword [ebp - 0x2c], edi
jge 0x10132f0
inc eax
mov word [ebp - 0x1e], ax
mov eax, dword [0x10382da]
mov edx, dword [ebp - 0x14]
mov cx, word [0x10382d8]
add eax, edx
mov edx, dword [ebp - 0x38]
mov word [ebp - 6], ax
mov word [ebp - 0x46], ax
mov word [ebp - 0x42], ax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 8], cx
mov word [ebp - 0x48], cx
mov ecx, dword [ebp - 8]
push ebx
push ecx
lea edi, [edx + ecx - 1]
push edx
mov dword [ebp - 0x24], esi
mov word [ebp - 0x44], di
call fcn.0103673b
mov ax, word [ebp - 0x48]
mov edi, dword [ebp - 0x44]
sub edi, dword [ebp - 0x48]
mov word [ebp - 8], ax
mov ax, word [ebp - 0x46]
mov word [ebp - 6], ax
xor eax, eax
inc edi
mov word [ebp - 0x3a], ax
mov word [ebp - 0x3e], ax
mov word [ebp - 0x40], ax
mov word [ebp - 0x20], di
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 1]
mov word [ebp - 0x3c], cx
lea ecx, [ebp - 0x40]
push ecx
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push ebx
call fcn.0101cc5f
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp cx, di
jge 0x10131ee
movzx ecx, di
mov edx, 0x200
test word [eax + 2], dx
jne 0x10131e8
mov dx, word [eax]
mov word [esi], dx
inc esi
inc esi
add eax, 4
dec ecx
jne 0x10131d5
cmp dword [ebp - 0x2c], 0
je 0x101321a
push 2
pop eax
jmp 0x10131ff
cmp word [esi], 0x20
jne 0x1013206
sub esi, eax
cmp esi, dword [ebp - 0x24]
jae 0x10131f9
mov cx, word [ebp - 0x18]
add esi, eax
mov word [esi], cx
mov cx, word [ebp - 0x28]
add esi, eax
mov word [esi], cx
add esi, eax
inc dword [ebp - 0x14]
mov ax, word [ebp - 0x14]
cmp ax, word [ebp - 0x36]
jl 0x1013142
mov edi, dword [ebp - 0x2c]
jmp 0x10132f0
push eax
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test byte [ebx], 4
mov esi, eax
je 0x1013256
test byte [0x10382f8], 1
jne 0x1013256
mov dword [ebp - 0x2c], 1
jmp 0x101325a
and dword [ebp - 0x2c], 0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
shr edi, 0xf
not edi
xor eax, eax
and edi, 1
cmp ax, word [ebp - 0x36]
jge 0x10132f0
movzx eax, word [ebp - 0x36]
push 2
mov dword [ebp - 0x28], eax
pop ebx
xor eax, eax
cmp ax, word [ebp - 0x38]
mov edx, esi
jge 0x10132aa
movzx ecx, word [ebp - 0x38]
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov word [esi], ax
test ax, ax
jne 0x10132a1
push 0x20
pop eax
mov word [esi], ax
add dword [ebp - 0x14], 4
add esi, ebx
dec ecx
jne 0x101328d
test edi, edi
jne 0x10132b6
jmp 0x10132be
cmp word [esi], 0x20
jne 0x10132bc
sub esi, ebx
cmp esi, edx
jae 0x10132b0
add esi, ebx
cmp dword [ebp - 0x2c], 0
je 0x10132d7
push dword [0x1038334]
mov eax, esi
sub eax, edx
sar eax, 1
push eax
push edx
call fcn.0101c421
test edi, edi
je 0x10132eb
push 0xd
pop eax
mov word [esi], ax
push 0xa
add esi, ebx
pop eax
mov word [esi], ax
add esi, ebx
dec dword [ebp - 0x28]
jne 0x101327f
test edi, edi
je 0x10132fe
cmp word [ebp - 0x36], 0
je 0x10132fe
sub esi, 4
xor eax, eax
mov word [esi], ax
cmp byte [0x1038415], al
je 0x10133d9
mov eax, dword [ebp - 0x10]
add eax, 8
imul eax, dword [ebp - 0x30]
lea eax, [eax + eax + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x1013360
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
jmp 0x101356b
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 4]
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
xor edi, edi
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlSizeHeap]
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.msvcrt.dll_memmove]
sub esi, dword [ebp - 4]
add esp, 0xc
sar esi, 1
lea esi, [ebx + esi*2]
cmp word [ebp - 0x18], di
jne 0x10133d9
push dword [0x1038334]
mov eax, esi
sub eax, ebx
sar eax, 1
push eax
push ebx
call fcn.0101c421
mov eax, ebx
cmp ebx, esi
jae 0x10133d9
cmp word [eax], di
jne 0x10133d3
lea ecx, [eax + 2]
cmp word [ecx], di
jne 0x10133d3
push 0xd
pop edx
mov word [eax], dx
mov eax, ecx
push 0xa
pop ecx
mov word [eax], cx
inc eax
inc eax
cmp eax, esi
jb 0x10133b8
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x1013402
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [ebp - 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [0x1038260]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1013427
push edi
jmp 0x1013432
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
test eax, eax
jne 0x101343d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x101356b
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x101356b
xor edi, edi
push edi
push edi
push dword [ebx + 0x50]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [0x1038268]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
movsx eax, word [ebp - 0x36]
movsx ecx, si
push eax
push ecx
push dword [0x1038268]
mov dword [ebp - 0x10], ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x30], eax
cmp eax, edi
je 0x1013558
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp - 0xc]
call esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x2c]
cmp eax, edi
je 0x10134b3
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [ebp - 0x2c], eax
call fcn.010129c1
mov ecx, dword [ebx + 0x40]
cmp dword [ecx + 8], edi
jge 0x10134d7
movsx edx, word [ebx + 0xe]
or eax, 0xffffffff
sub eax, edx
movsx edx, word [0x10382de]
sub eax, edx
sub eax, dword [ecx + 8]
jmp 0x10134e4
movsx eax, word [ebx + 0xe]
movsx edx, word [0x10382de]
add eax, edx
movsx edx, word [0x10382d8]
push 0xcc0020
push dword [ebx + 0x58]
push ecx
push dword [ebx + 0x44]
movsx ecx, word [ebp - 0x36]
push ecx
push dword [ebp - 0x10]
push eax
movsx eax, word [ebx + 0xc]
add eax, edx
push eax
push ecx
push dword [ebp - 0x10]
push edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_StretchDIBits]
call fcn.010129c1
cmp dword [ebx + 0x2c], edi
je 0x101352d
push edi
push dword [ebp - 0x2c]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp - 0x28]
push dword [ebp - 0xc]
call esi
push dword [0x1038260]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp - 0x30]
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
push dword [ebx + 0x50]
call dword [sym.imp.ntdll.dll_NtReleaseMutant]
pop edi
pop esi
pop ebx
leave
ret