Function at 0x10053920
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [edi + 0x32dc]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, edx
jne 0x1005396d
mov eax, dword [esp + 0xcc]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
mov cl, cl
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
cmp eax, 4
jne 0x10053aba
push eax
pop eax
call fcn.1004fc80
test eax, eax
je 0x10053a40
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push ebx
pop ebx
mov edx, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov bh, bh
mov eax, dword [esi]
cmp eax, 1
jne 0x100539fe
mov ax, word [esi + 4]
mov word [esp + 0x14], ax
push edx
pop edx
mov cx, word [esi + 6]
mov word [esp + 0x16], cx
push edx
pop edx
mov edx, dword [esi + 8]
mov dword [esp + 0x18], edx
mov cl, cl
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
xchg ebx, eax
xchg ebx, eax
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
nop
jmp 0x10053a40
cmp eax, ebx
jne 0x10053a40
mov edx, dword [esi + 4]
mov dword [esp + 0x14], edx
mov cl, cl
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov bl, bl
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
mov eax, eax
mov edx, dword [esi + 0x10]
mov dword [esp + 0x20], edx
mov bl, bl
mov eax, dword [esi + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
xchg ebx, eax
xchg ebx, eax
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
mov ebx, ebx
push ebx
pop ebx
mov dword [esp + 8], ebx
mov bh, bh
mov dword [esp + 0x34], 3
push ecx
pop ecx
mov dword [esp + 0x38], 1
nop
call fcn.1004fc80
test eax, eax
je 0x10053a70
lea edx, [esp + 0xc]
mov dword [esp + 0x3c], edx
mov ah, ah
jmp 0x10053a76
mov dword [esp + 0x3c], esi
mov dh, dh
nop
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov dh, dh
mov bh, bh
push 1
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
lea edx, [esp + 0x44]
push 0xc
push edx
call fcn.1001eb00
add esp, 0x18
mov edx, edx
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
cmp eax, 1
push ebp
mov ebp, 3
je 0x10053df0
cmp eax, ebp
je 0x10053df0
cmp eax, 0xa
je 0x10053df0
cmp eax, 0xb
je 0x10053df0
cmp eax, 2
jne 0x100541ef
mov dword [esp + 0xc], ebx
nop
mov dword [esp + 0x38], ebp
mov ecx, ecx
mov eax, dword [esi]
cmp eax, 1
jne 0x10053c00
mov bh, bh
mov al, al
mov dword [esp + 0x3c], 7
push ebx
pop ebx
movzx edx, word [esi + 4]
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0xbc]
push ecx
push edx
call fcn.1004bee0
add esp, 0xc
test eax, eax
je 0x100541ef
test byte [esi + 8], 2
je 0x10053b9e
mov al, byte [esp + 0xc0]
test al, al
jbe 0x100541ef
movzx esi, al
push esi
lea eax, [esp + 0xc5]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.100fd070
add esp, 0xc
push eax
pop eax
mov dword [esp + 0x40], esi
mov cl, cl
push 1
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
add esi, 0xc
lea eax, [esp + 0x48]
push esi
push eax
call fcn.1001eb00
add esp, 0x18
nop
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
movzx esi, byte [esp + 0xb8]
push esi
lea ecx, [esp + 0xbd]
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.100fd070
add esp, 0xc
mov bl, bl
mov dword [esp + 0x40], esi
mov edx, edx
movzx ecx, byte [esp + 0xc0]
push 1
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
add ecx, 0xc
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.1001eb00
add esp, 0x18
mov bl, bl
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
cmp eax, ebx
jne 0x100541ef
mov dl, dl
xor ebp, ebp
xchg ebx, eax
xchg ebx, eax
mov dword [esp + 0x3c], 8
mov ebx, ebx
test byte [esi + 0x10], 1
je 0x10053c49
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.10053650
add esp, 0x18
mov ebp, eax
mov bl, bl
test byte [esi + 0x10], 2
je 0x10053c70
mov esi, esi
push edx
pop edx
mov byte [esp + 0x44], 9
nop
mov byte [esp + 0x45], bl
mov al, al
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov edi, edi
mov ebp, 4
mov ebp, ebp
test byte [esi + 0x10], 8
je 0x10053c98
mov esi, esi
push edx
pop edx
mov byte [esp + 0x44], 0xa
mov ebx, ebx
mov byte [esp + 0x45], bl
mov al, al
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov edi, edi
mov ebp, 4
mov dh, dh
test byte [esi + 0x10], 0x20
je 0x10053cc0
mov esi, esi
push edx
pop edx
mov byte [esp + 0x44], 0xc
mov cl, cl
mov byte [esp + 0x45], bl
mov al, al
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov edi, edi
mov ebp, 4
push ecx
pop ecx
test dword [esi + 0x10], 0x800
je 0x10053d2a
mov ebx, dword [esi + 0xc]
mov esi, esi
push edx
pop edx
test ebx, ebx
mov byte [esp + 0x44], 8
je 0x10053d0f
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x10053cef
or byte [esp + 0x44], 1
mov ah, ah
push 2
call ebp
test ax, ax
je 0x10053cff
or byte [esp + 0x44], 2
xchg ebx, eax
xchg ebx, eax
push 4
call ebp
test ax, ax
je 0x10053d0f
or byte [esp + 0x44], 4
mov cl, cl
mov byte [esp + 0x45], 0
mov al, al
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], bl
mov edi, edi
mov ebp, 4
mov edx, edx
xor ebx, ebx
test byte [esi + 0x10], 1
jne 0x10053d57
cmp ebp, ebx
jne 0x10053d57
mov esi, esi
push edx
pop edx
mov byte [esp + 0x44], 8
mov byte [esp + 0x45], 0
mov al, al
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
mov edi, edi
mov ebp, 4
mov edx, edx
mov dword [esp + 0x40], ebp
mov bl, bl
test byte [esi + 0x10], 1
je 0x10053dbc
cmp dword [edi + 0x3300], ebx
je 0x10053dbc
mov eax, dword [edi + 0x37d0]
cmp eax, 0x398
jae 0x10053dbc
push ebp
lea edx, [esp + 0x48]
push edx
lea eax, [edi + eax + 0x3380]
push eax
call fcn.100fd070
add esp, 0xc
mov edi, edi
mov dword [edi + 0x37d4], 4
mov al, al
add dword [edi + 0x37d0], ebp
mov dl, dl
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
push 1
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
add ebp, 0xc
lea edx, [esp + 0x48]
push ebp
push edx
call fcn.1001eb00
add esp, 0x18
mov al, al
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
mov ah, ah
mov dword [esp + 0x38], ebp
mov cl, cl
mov eax, dword [esi]
cmp eax, 1
jne 0x10054038
mov eax, dword [edi + 0x32dc]
cmp eax, ebp
mov ebx, 2
jne 0x10053e1e
mov dword [esp + 0x3c], 0x14
xchg ebx, eax
xchg ebx, eax
jmp 0x10053e45
cmp eax, 0xa
jne 0x10053e2e
mov dword [esp + 0x3c], 0
nop
jmp 0x10053e45
cmp eax, 0xb
jne 0x10053e3f
mov dword [esp + 0x3c], 0x10000
mov ah, ah
jmp 0x10053e45
mov dword [esp + 0x3c], ebx
push ebx
pop ebx
mov ax, word [esi + 6]
mov word [esp + 0x40], ax
mov eax, dword [esi + 8]
test al, 1
je 0x10053e66
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x42], cx
jmp 0x10053e7e
test al, 2
je 0x10053e75
mov word [esp + 0x42], 1
mov ebp, ebp
jmp 0x10053e7e
mov word [esp + 0x42], 0
mov bl, bl
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x10053f62
mov eax, dword [esi + 8]
test al, 1
je 0x10053f62
test al, 2
je 0x10053eff
mov word [esp + 0x40], 0x37
mov ecx, ecx
mov word [esp + 0x42], bp
mov ah, ah
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.1004cdd0
add esp, 4
mov ebx, ebx
mov word [esp + 0x40], 0x2a
push eax
pop eax
mov word [esp + 0x42], bp
mov dh, dh
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.1004cdd0
add esp, 4
push ebx
pop ebx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
mov word [esp + 0x40], 0x2a
mov dh, dh
mov word [esp + 0x42], bx
push ecx
pop ecx
lea ecx, [esp + 0x38]
push ecx
mov edx, 0xc
mov eax, edi
call fcn.1004cdd0
add esp, 4
push eax
pop eax
mov word [esp + 0x40], 0x37
mov ah, ah
mov word [esp + 0x42], bx
mov al, al
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.1004cdd0
add esp, 4
nop
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
cmp cx, 0x13
jne 0x1005400a
mov eax, dword [esi + 8]
test al, 1
je 0x1005400a
test al, 2
jne 0x100541ef
mov esi, 0x1d
mov word [esp + 0x40], si
push ebx
pop ebx
mov word [esp + 0x42], 4
mov bh, bh
lea eax, [esp + 0x38]
push eax
lea edx, [esi - 0x11]
mov eax, edi
call fcn.1004cdd0
add esp, 4
mov bl, bl
mov word [esp + 0x40], 0x45
mov al, al
mov word [esp + 0x42], 0
mov ecx, ecx
lea ecx, [esp + 0x38]
push ecx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.1004cdd0
add esp, 4
push edx
pop edx
mov word [esp + 0x40], si
push ebx
pop ebx
mov word [esp + 0x42], 5
mov ecx, ecx
lea edx, [esp + 0x38]
push edx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.1004cdd0
add esp, 4
push ebx
pop ebx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.1004cdd0
add esp, 4
mov edi, edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
cmp eax, ebx
jne 0x100541ef
nop
xor ecx, ecx
mov ch, ch
xor edx, edx
mov cl, cl
xor ebp, ebp
mov bl, bl
xor ebx, ebx
mov dh, dh
mov ah, ah
mov eax, dword [edi + 0x32dc]
cmp eax, 3
jne 0x1005406a
mov dword [esp + 0x3c], 0x1e
mov bh, bh
jmp 0x10054092
cmp eax, 0xa
jne 0x10054077
mov dword [esp + 0x3c], ecx
mov dl, dl
jmp 0x10054092
cmp eax, 0xb
jne 0x10054088
mov dword [esp + 0x3c], 0x10000
mov ecx, ecx
jmp 0x10054092
mov dword [esp + 0x3c], 3
mov bh, bh
test dword [esi + 0x10], 0x8000
je 0x100540a4
mov eax, 3
mov ebx, ebx
jmp 0x100540a8
xor eax, eax
mov ebx, ebx
test byte [esi + 0x10], 1
je 0x100540b8
mov ebp, dword [esi + 4]
mov edx, edx
mov ebx, dword [esi + 8]
mov esi, esi
test byte [esi + 0x10], 2
je 0x100540c7
mov ecx, 1
mov ecx, ecx
push edx
pop edx
test byte [esi + 0x10], 4
je 0x100540d1
or ecx, 2
nop
test byte [esi + 0x10], 8
je 0x100540de
or ecx, 4
push ecx
pop ecx
push ebx
pop ebx
test byte [esi + 0x10], 0x10
je 0x100540e9
or ecx, 8
mov eax, eax
test byte [esi + 0x10], 0x20
je 0x100540f6
or ecx, 0x10
mov edi, edi
mov esi, esi
test byte [esi + 0x10], 0x40
je 0x10054100
or ecx, 0x20
nop
test dword [esi + 0x10], 0x800
je 0x10054116
or ecx, 0x400
nop
movzx edx, word [esi + 0xc]
mov ah, ah
mov word [esp + 0x40], ax
mov edx, edx
mov word [esp + 0x42], cx
push edx
pop edx
mov word [esp + 0x44], dx
mov bl, bl
mov ch, ch
mov dword [esp + 0x46], ebp
mov ebx, ebx
mov dword [esp + 0x4a], ebx
mov ah, ah
cmp dword [edi + 0x3300], 0
je 0x100541d5
mov eax, dword [edi + 0x3360]
cmp eax, 6
jae 0x100541d5
mov cx, word [esp + 0x40]
mov word [edi + eax*2 + 0x330c], cx
mov dl, dl
mov edx, dword [edi + 0x3360]
mov ax, word [esp + 0x42]
mov word [edi + edx*2 + 0x3318], ax
mov ah, ah
mov ecx, dword [edi + 0x3360]
mov dx, word [esp + 0x44]
mov word [edi + ecx*2 + 0x3324], dx
mov ecx, ecx
mov eax, dword [edi + 0x3360]
mov ecx, dword [esp + 0x46]
mov dword [edi + eax*4 + 0x3330], ecx
mov eax, eax
mov edx, dword [edi + 0x3360]
mov eax, dword [esp + 0x4a]
mov dword [edi + edx*4 + 0x3348], eax
xchg ebx, eax
xchg ebx, eax
add dword [edi + 0x3360], 1
mov cl, cl
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret
mov ebx, ebx
mov bh, bh
lea ecx, [esp + 0x38]
push ecx
mov edx, 0x16
mov eax, edi
call fcn.1004ce00
add esp, 4
mov eax, eax
mov ecx, dword [esp + 0xc8]
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.100fb12a
add esp, 0xc0
ret