Function at 0x100af280
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x100dfb34]
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx esi, bl
add esi, esi
mov al, byte [esi + esi + 0x100c4728]
add esi, esi
push edi
mov edi, 1
test ecx, ecx
jne 0x100af3de
cmp word [ebp + 0xc], cx
jne 0x100af32d
cmp al, 1
je 0x100af326
cmp al, 2
je 0x100af326
cmp al, 4
je 0x100af326
cmp al, 0xe0
jne 0x100af2f7
movzx ecx, byte [esi + 0x100c4729]
mov ebx, dword [ebp + 0x10]
push 2
push ecx
call ebx
mov edi, eax
mov al, byte [esi + 0x100c472a]
add esp, 8
test al, al
je 0x100af51b
movzx eax, al
push 2
push eax
call ebx
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp al, 0xe1
jne 0x100af51b
movzx edx, byte [esi + 0x100c4729]
mov edi, dword [ebp + 0x10]
push 4
push edx
call edi
movzx ecx, byte [esi + 0x100c472a]
push 0
push ecx
call edi
add esp, 0x10
mov edi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
jmp 0x100af3c7
cmp al, 1
je 0x100af3c5
cmp al, 2
je 0x100af3c5
cmp al, 4
je 0x100af3c5
cmp al, 0xe0
jne 0x100af379
mov al, byte [esi + 0x100c472a]
mov edi, dword [ebp + 0x10]
test al, al
je 0x100af361
movzx edx, al
push 3
push edx
call edi
add esp, 8
movzx ecx, byte [esi + 0x100c4729]
push 3
push ecx
call edi
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp al, 0xe1
jne 0x100af3a4
movzx eax, byte [esi + 0x100c4729]
mov edi, dword [ebp + 0x10]
push 5
push eax
call edi
movzx edx, byte [esi + 0x100c472a]
push 1
push edx
call edi
add esp, 0x10
mov edi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp al, 3
jne 0x100af51b
movzx ecx, byte [esi + 0x100c4729]
push 1
push ecx
call dword [ebp + 0x10]
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
movzx eax, byte [esi + 0x100c4729]
push eax
call dword [ebp + 0x10]
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 1
jne 0x100af451
mov al, byte [esi + 0x100c472b]
mov byte [ebp + 8], al
test al, al
je 0x100af51b
mov edi, dword [ebp + 0xc]
xor ecx, ecx
cmp di, 1
setne cl
push ebx
lea esi, [ecx - 1]
and esi, 2
call fcn.100af220
mov edx, 0x100
add esp, 4
test dx, ax
je 0x100af41c
or esi, 1
cmp bl, 0xe1
jne 0x100af424
or esi, 1
movzx eax, byte [ebp + 8]
push 0
push esi
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
push edi
push 0
call dword [ebp + 0x10]
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jne 0x100af4c0
mov al, byte [esi + 0x100c472b]
mov byte [ebp + 8], al
test al, al
je 0x100af51b
mov esi, dword [ebp + 0xc]
xor edx, edx
cmp si, 1
sete dl
push ebx
lea edi, [edx + 0x100]
call fcn.100af220
movzx eax, ax
shl eax, 0x10
add esp, 4
or eax, 1
cmp si, 1
jne 0x100af496
or eax, 0xc0000000
mov bl, byte [ebp + 8]
mov ecx, dword [0x100dfb38]
push eax
movzx eax, bl
push eax
push edi
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
movzx eax, bl
push esi
push eax
call dword [ebp + 0x10]
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 3
jne 0x100af51b
mov al, byte [esi + 0x100c472b]
mov byte [ebp + 8], al
test al, al
je 0x100af51b
mov esi, dword [ebp + 0xc]
xor ecx, ecx
cmp si, 1
sete cl
push ebx
add ecx, 0x100
mov dword [ebp - 4], ecx
call fcn.100af220
movzx eax, ax
shl eax, 0x10
add esp, 4
or eax, 1
cmp si, 1
jne 0x100af504
or eax, 0xc0000000
movzx edx, byte [ebp + 8]
mov ecx, dword [0x100dfb38]
push eax
mov eax, dword [ebp - 4]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret