Function at 0x10068ce0
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0xbc], eax
push ebp
push esi
mov esi, dword [esp + 0xcc]
push edi
mov edi, edx
mov eax, dword [edi + 0x32dc]
xor ebp, ebp
cmp eax, ebp
jne 0x10068d36
mov eax, dword [esp + 0xd4]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
mov al, al
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.101179ba
add esp, 0xc0
ret
cmp eax, 4
jne 0x10068e87
mov bl, bl
call fcn.10064980
test eax, eax
je 0x10068e0a
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov bh, bh
mov edx, dword [esi]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebp
mov edx, edx
mov eax, dword [esi]
cmp eax, 1
jne 0x10068dc8
mov ax, word [esi + 4]
mov word [esp + 0x18], ax
mov dh, dh
mov cx, word [esi + 6]
mov word [esp + 0x1a], cx
xchg ebx, eax
xchg ebx, eax
mov edx, dword [esi + 8]
mov dword [esp + 0x1c], edx
mov cl, cl
mov eax, dword [esi + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
push eax
pop eax
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebp
mov ah, ah
jmp 0x10068e0a
cmp eax, ebp
jne 0x10068e0a
mov edx, dword [esi + 4]
mov dword [esp + 0x18], edx
mov edx, edx
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
push ecx
pop ecx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x20], ecx
mov ebp, ebp
mov edx, dword [esi + 0x10]
mov dword [esp + 0x24], edx
mov ebp, ebp
mov eax, dword [esi + 0x14]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
mov ch, ch
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ebp
mov bh, bh
mov ah, ah
mov dword [esp + 0xc], ebp
mov edi, edi
mov dword [esp + 0x38], 3
mov bl, bl
mov dword [esp + 0x3c], 1
push eax
pop eax
call fcn.10064980
test eax, eax
je 0x10068e3b
lea edx, [esp + 0x10]
mov dword [esp + 0x40], edx
mov esi, esi
jmp 0x10068e41
mov dword [esp + 0x40], esi
push ebx
pop ebx
xchg ebx, eax
xchg ebx, eax
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov edx, edx
mov ebx, ebx
push 1
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebp
lea edx, [esp + 0x48]
push 0xc
push edx
call fcn.10021120
add esp, 0x18
xchg ebx, eax
xchg ebx, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.101179ba
add esp, 0xc0
ret
cmp eax, 1
push ebx
mov ebx, 3
je 0x1006917d
cmp eax, ebx
je 0x1006917d
cmp eax, 0xa
je 0x1006917d
cmp eax, 0xb
je 0x1006917d
cmp eax, 2
jne 0x10069541
mov dword [esp + 0x10], ebp
mov bl, bl
mov dword [esp + 0x3c], ebx
xchg ebx, eax
xchg ebx, eax
mov eax, dword [esi]
cmp eax, 1
jne 0x10068fa8
xchg ebx, eax
xchg ebx, eax
mov cl, cl
mov dword [esp + 0x40], 7
xchg ebx, eax
xchg ebx, eax
movzx edx, word [esi + 4]
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0xc0]
push ecx
push edx
call fcn.100612d0
add esp, 0xc
test eax, eax
je 0x10069541
test byte [esi + 8], 2
je 0x10068f5a
mov al, byte [esp + 0xc4]
test al, al
jbe 0x10069541
movzx esi, al
push esi
lea eax, [esp + 0xc9]
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.10119900
add esp, 0xc
mov ecx, ecx
mov dword [esp + 0x44], esi
mov ah, ah
push 1
lea edx, [esp + 0x14]
push edx
push ebp
push ebp
add esi, 0xc
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.10021120
add esp, 0x18
xchg ebx, eax
xchg ebx, eax
jmp 0x10069541
movzx esi, byte [esp + 0xbc]
push esi
lea ecx, [esp + 0xc1]
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.10119900
add esp, 0xc
mov bh, bh
mov dword [esp + 0x44], esi
nop
movzx ecx, byte [esp + 0xc4]
push 1
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
add ecx, 0xc
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.10021120
add esp, 0x18
mov dh, dh
jmp 0x10069541
cmp eax, ebp
jne 0x10069541
xchg ebx, eax
xchg ebx, eax
xor ebp, ebp
push ebx
pop ebx
mov dword [esp + 0x40], 8
mov al, al
test byte [esi + 0x10], 1
je 0x10068ff1
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x5c]
push ecx
call fcn.100688f0
add esp, 0x18
mov ebp, eax
mov esi, esi
test byte [esi + 0x10], 2
je 0x1006901c
mov ah, ah
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x48], 9
mov edi, edi
mov byte [esp + 0x49], 0
mov bh, bh
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov bl, bl
mov ebp, 4
xchg ebx, eax
xchg ebx, eax
test byte [esi + 0x10], 8
je 0x10069047
mov ah, ah
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x48], 0xa
mov bh, bh
mov byte [esp + 0x49], 0
mov bh, bh
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov bl, bl
mov ebp, 4
push ebx
pop ebx
test byte [esi + 0x10], 0x20
je 0x10069072
mov ah, ah
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x48], 0xc
mov ebp, ebp
mov byte [esp + 0x49], 0
mov bh, bh
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov bl, bl
mov ebp, 4
mov dh, dh
test dword [esi + 0x10], 0x800
je 0x100690da
mov ebx, dword [esi + 0xc]
mov ah, ah
xchg ebx, eax
xchg ebx, eax
test ebx, ebx
mov byte [esp + 0x48], 8
je 0x100690c1
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x100690a1
or byte [esp + 0x48], 1
mov ecx, ecx
push 2
call ebp
test ax, ax
je 0x100690b1
or byte [esp + 0x48], 2
mov eax, eax
push 4
call ebp
test ax, ax
je 0x100690c1
or byte [esp + 0x48], 4
mov ebx, ebx
mov byte [esp + 0x49], 0
mov bh, bh
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], bl
mov bl, bl
mov ebp, 4
mov ebx, ebx
test byte [esi + 0x10], 1
jne 0x10069107
test ebp, ebp
jne 0x10069107
mov ah, ah
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x48], 8
mov byte [esp + 0x49], 0
mov bh, bh
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov bl, bl
mov ebp, 4
push edx
pop edx
mov dword [esp + 0x44], ebp
mov edx, edx
test byte [esi + 0x10], 1
je 0x1006915a
cmp dword [edi + 0x3300], 0
je 0x1006915a
mov eax, dword [edi + 0x37d0]
cmp eax, 0x398
jae 0x1006915a
push ebp
lea edx, [esp + 0x4c]
push edx
lea eax, [edi + eax + 0x3380]
push eax
call fcn.10119900
add esp, 0xc
mov cl, cl
mov dword [edi + 0x37d4], 4
mov ebx, ebx
add dword [edi + 0x37d0], ebp
mov ah, ah
jmp 0x10069541
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
add ebp, 0xc
lea edx, [esp + 0x4c]
push ebp
push edx
call fcn.10021120
add esp, 0x18
mov bh, bh
jmp 0x10069541
nop
mov dword [esp + 0x3c], ebx
mov ebx, ebx
mov eax, dword [esi]
cmp eax, 1
jne 0x100693ab
mov eax, dword [edi + 0x32dc]
cmp eax, ebx
mov ebp, 2
mov edx, 0x10000
jne 0x100691af
mov dword [esp + 0x40], 0x14
mov bl, bl
jmp 0x100691d3
cmp eax, 0xa
jne 0x100691c0
mov dword [esp + 0x40], 0
mov cl, cl
jmp 0x100691d3
cmp eax, 0xb
jne 0x100691cd
mov dword [esp + 0x40], edx
xchg ebx, eax
xchg ebx, eax
jmp 0x100691d3
mov dword [esp + 0x40], ebp
mov ecx, ecx
mov ax, word [esi + 6]
mov word [esp + 0x44], ax
mov eax, dword [esi + 8]
test al, 1
je 0x100691f4
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x46], cx
jmp 0x1006920c
test al, 2
je 0x10069203
mov word [esp + 0x46], 1
mov bl, bl
jmp 0x1006920c
mov word [esp + 0x46], 0
mov bh, bh
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x100692b7
mov eax, dword [esi + 8]
test al, 1
je 0x100692b7
test al, 2
je 0x10069270
mov word [esp + 0x44], 0x37
mov ecx, ecx
mov word [esp + 0x46], bx
mov bl, bl
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.10068bc0
xchg ebx, eax
xchg ebx, eax
mov word [esp + 0x44], 0x2a
mov al, al
mov word [esp + 0x46], bx
push ecx
pop ecx
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.10068bc0
push edx
pop edx
jmp 0x10069541
mov word [esp + 0x44], 0x2a
mov ch, ch
mov word [esp + 0x46], bp
push eax
pop eax
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.10068bc0
mov ebp, ebp
mov word [esp + 0x44], 0x37
push ecx
pop ecx
mov word [esp + 0x46], bp
mov edi, edi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.10068bc0
mov ebx, ebx
jmp 0x10069541
cmp cx, 0x13
jne 0x10069338
mov eax, dword [esi + 8]
test al, 1
je 0x10069338
test al, 2
jne 0x10069541
mov ebp, 0x1d
mov word [esp + 0x44], bp
mov bl, bl
mov word [esp + 0x46], 4
push eax
pop eax
xor esi, esi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.10068bc0
mov ecx, ecx
mov word [esp + 0x44], 0x45
push edx
pop edx
mov word [esp + 0x46], si
mov edi, edi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.10068bc0
mov ebp, ebp
mov word [esp + 0x44], bp
mov edi, edi
mov word [esp + 0x46], 5
mov cl, cl
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.10068bc0
xchg ebx, eax
xchg ebx, eax
jmp 0x10069541
nop
mov edi, dword [edi + 0x32dc]
cmp edi, 1
je 0x10069388
cmp edi, ebx
je 0x10069388
cmp edi, 0xa
jne 0x1006936a
mov dword [esp + 0x40], 0
mov edx, edx
lea edx, [esp + 0x3c]
push 0xc
push edx
call fcn.10066ce0
add esp, 8
push ecx
pop ecx
jmp 0x100693a4
cmp edi, 0xb
jne 0x100693a4
mov dword [esp + 0x40], edx
mov bl, bl
lea eax, [esp + 0x3c]
push 0xc
push eax
call fcn.10066ce0
add esp, 8
mov dl, dl
jmp 0x100693a4
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x4c]
push 0xc
push edx
call fcn.10021120
add esp, 0x18
mov dh, dh
mov ebp, ebp
jmp 0x10069541
cmp eax, ebp
jne 0x10069541
xchg ebx, eax
xchg ebx, eax
xor ecx, ecx
mov dh, dh
xor edx, edx
mov ecx, ecx
xor ebp, ebp
mov esi, esi
xor ebx, ebx
xchg ebx, eax
xchg ebx, eax
mov ah, ah
mov eax, dword [edi + 0x32dc]
cmp eax, 3
jne 0x100693de
mov dword [esp + 0x40], 0x1e
mov ah, ah
jmp 0x10069406
cmp eax, 0xa
jne 0x100693eb
mov dword [esp + 0x40], ecx
mov cl, cl
jmp 0x10069406
cmp eax, 0xb
jne 0x100693fc
mov dword [esp + 0x40], 0x10000
push eax
pop eax
jmp 0x10069406
mov dword [esp + 0x40], 3
push edx
pop edx
test dword [esi + 0x10], 0x8000
je 0x10069418
mov eax, 3
mov al, al
jmp 0x1006941c
xor eax, eax
mov dh, dh
test byte [esi + 0x10], 1
je 0x1006942c
mov ebp, dword [esi + 4]
mov dh, dh
mov ebx, dword [esi + 8]
push edx
pop edx
test byte [esi + 0x10], 2
je 0x1006943b
mov ecx, 1
mov bh, bh
mov cl, cl
test byte [esi + 0x10], 4
je 0x10069446
or ecx, 2
mov ebx, ebx
test byte [esi + 0x10], 8
je 0x10069452
or ecx, 4
mov esi, esi
nop
test byte [esi + 0x10], 0x10
je 0x1006945d
or ecx, 8
mov edx, edx
test byte [esi + 0x10], 0x20
je 0x1006946a
or ecx, 0x10
mov ah, ah
mov ch, ch
test byte [esi + 0x10], 0x40
je 0x10069474
or ecx, 0x20
nop
test dword [esi + 0x10], 0x800
je 0x1006948b
or ecx, 0x400
mov bl, bl
movzx edx, word [esi + 0xc]
mov eax, eax
mov word [esp + 0x44], ax
mov ecx, ecx
mov word [esp + 0x46], cx
mov bh, bh
mov word [esp + 0x48], dx
mov bh, bh
mov cl, cl
mov dword [esp + 0x4a], ebp
nop
mov dword [esp + 0x4e], ebx
mov edi, edi
cmp dword [edi + 0x3300], 0
je 0x1006952b
mov eax, dword [edi + 0x3360]
cmp eax, 6
jae 0x1006952b
mov cx, word [esp + 0x44]
mov word [edi + eax*2 + 0x330c], cx
mov bh, bh
mov edx, dword [edi + 0x3360]
mov ax, word [esp + 0x46]
mov word [edi + edx*2 + 0x3318], ax
mov edi, edi
mov ecx, dword [edi + 0x3360]
mov dx, word [esp + 0x48]
mov word [edi + ecx*2 + 0x3324], dx
mov edi, edi
mov eax, dword [edi + 0x3360]
mov ecx, dword [esp + 0x4a]
mov dword [edi + eax*4 + 0x3330], ecx
mov edx, edx
mov edx, dword [edi + 0x3360]
mov eax, dword [esp + 0x4e]
mov dword [edi + edx*4 + 0x3348], eax
push edx
pop edx
add dword [edi + 0x3360], 1
mov ebp, ebp
jmp 0x10069541
mov ah, ah
mov dh, dh
xor esi, esi
lea edx, [esi + 0x16]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.10068c50
mov bh, bh
mov ecx, dword [esp + 0xcc]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.101179ba
add esp, 0xc0
ret