Function at 0x1004fb40
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [edi + 0x32d4]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, edx
jne 0x1004fb8d
mov eax, dword [esp + 0xcc]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
push edx
pop edx
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
cmp eax, 4
jne 0x1004fce0
test ah, ah
call fcn.1004b250
test eax, eax
je 0x1004fc64
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push edx
pop edx
mov edx, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
test edx, edx
mov eax, dword [esi]
cmp eax, 1
jne 0x1004fc22
mov ax, word [esi + 4]
mov word [esp + 0x14], ax
mov ebx, ebx
mov cx, word [esi + 6]
mov word [esp + 0x16], cx
mov bl, bl
mov edx, dword [esi + 8]
mov dword [esp + 0x18], edx
test bl, bl
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
test eax, 0x1eec
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
mov dh, dh
jmp 0x1004fc64
cmp eax, ebx
jne 0x1004fc64
mov edx, dword [esi + 4]
mov dword [esp + 0x14], edx
test cl, cl
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
push ebx
pop ebx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
test ah, ah
mov edx, dword [esi + 0x10]
mov dword [esp + 0x20], edx
mov ecx, ecx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
test ebx, ebx
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
test ch, ch
test edx, edx
mov dword [esp + 8], ebx
test bh, bh
mov dword [esp + 0x34], 3
mov ch, ch
mov dword [esp + 0x38], 1
push ebx
pop ebx
call fcn.1004b250
test eax, eax
je 0x1004fc95
lea edx, [esp + 0xc]
mov dword [esp + 0x3c], edx
test eax, eax
jmp 0x1004fc9b
mov dword [esp + 0x3c], esi
test eax, eax
mov ch, ch
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov bl, bl
push ecx
pop ecx
push 1
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
lea edx, [esp + 0x44]
push 0xc
push edx
call fcn.10021e70
add esp, 0x18
test ecx, ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
cmp eax, 1
push ebp
mov ebp, 3
je 0x1005001c
cmp eax, ebp
je 0x1005001c
cmp eax, 0xa
je 0x1005001c
cmp eax, 0xb
je 0x1005001c
cmp eax, 2
jne 0x1005042e
mov dword [esp + 0xc], ebx
test esi, esi
mov dword [esp + 0x38], ebp
test ebx, ebx
mov eax, dword [esi]
cmp eax, 1
jne 0x1004fe28
mov cl, cl
test eax, eax
mov dword [esp + 0x3c], 7
mov ah, ah
movzx edx, word [esi + 4]
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0xbc]
push ecx
push edx
call fcn.100478f0
add esp, 0xc
test eax, eax
je 0x1005042e
test byte [esi + 8], 2
je 0x1004fdc6
mov al, byte [esp + 0xc0]
test al, al
jbe 0x1005042e
movzx esi, al
push esi
lea eax, [esp + 0xc5]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.100f61f0
add esp, 0xc
xchg ebx, eax
xchg ebx, eax
mov dword [esp + 0x40], esi
test ch, ch
push 1
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
add esi, 0xc
lea eax, [esp + 0x48]
push esi
push eax
call fcn.10021e70
add esp, 0x18
test ebx, ebx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
movzx esi, byte [esp + 0xb8]
push esi
lea ecx, [esp + 0xbd]
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.100f61f0
add esp, 0xc
mov ebp, ebp
mov dword [esp + 0x40], esi
test ch, ch
movzx ecx, byte [esp + 0xc0]
push 1
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
add ecx, 0xc
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.10021e70
add esp, 0x18
mov bl, bl
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
cmp eax, ebx
jne 0x1005042e
test ah, ah
xor ebp, ebp
mov ah, ah
mov dword [esp + 0x3c], 8
test ecx, ecx
test byte [esi + 0x10], 1
je 0x1004fe74
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.1004f860
add esp, 0x18
mov ebp, eax
test eax, 0x7e10
test byte [esi + 0x10], 2
je 0x1004fe9c
test ecx, ecx
test edx, edx
mov byte [esp + 0x44], 9
test bl, bl
mov byte [esp + 0x45], bl
mov ah, ah
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
test cl, cl
mov ebp, 4
test eax, eax
test byte [esi + 0x10], 8
je 0x1004fec4
test ecx, ecx
test edx, edx
mov byte [esp + 0x44], 0xa
push ebx
pop ebx
mov byte [esp + 0x45], bl
mov ah, ah
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
test cl, cl
mov ebp, 4
test al, al
test byte [esi + 0x10], 0x20
je 0x1004feec
test ecx, ecx
test edx, edx
mov byte [esp + 0x44], 0xc
mov ecx, ecx
mov byte [esp + 0x45], bl
mov ah, ah
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
test cl, cl
mov ebp, 4
test bl, bl
test dword [esi + 0x10], 0x800
je 0x1004ff56
mov ebx, dword [esi + 0xc]
test ecx, ecx
test edx, edx
test ebx, ebx
mov byte [esp + 0x44], 8
je 0x1004ff3b
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x1004ff1b
or byte [esp + 0x44], 1
mov ebp, ebp
push 2
call ebp
test ax, ax
je 0x1004ff2b
or byte [esp + 0x44], 2
test cl, cl
push 4
call ebp
test ax, ax
je 0x1004ff3b
or byte [esp + 0x44], 4
mov ah, ah
mov byte [esp + 0x45], 0
mov ah, ah
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], bl
test cl, cl
mov ebp, 4
test dl, dl
xor ebx, ebx
test byte [esi + 0x10], 1
jne 0x1004ff83
cmp ebp, ebx
jne 0x1004ff83
test ecx, ecx
test edx, edx
mov byte [esp + 0x44], 8
mov byte [esp + 0x45], 0
mov ah, ah
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
test cl, cl
mov ebp, 4
mov ebx, ebx
mov dword [esp + 0x40], ebp
test esi, esi
test byte [esi + 0x10], 1
je 0x1004ffe8
cmp dword [edi + 0x32f8], ebx
je 0x1004ffe8
mov eax, dword [edi + 0x37c8]
cmp eax, 0x398
jae 0x1004ffe8
push ebp
lea edx, [esp + 0x48]
push edx
lea eax, [edi + eax + 0x3378]
push eax
call fcn.100f61f0
add esp, 0xc
mov ch, ch
mov dword [edi + 0x37cc], 4
test al, al
add dword [edi + 0x37c8], ebp
mov esi, esi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
push 1
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
add ebp, 0xc
lea edx, [esp + 0x48]
push ebp
push edx
call fcn.10021e70
add esp, 0x18
push edx
pop edx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
push ebx
pop ebx
mov dword [esp + 0x38], ebp
mov esi, esi
mov eax, dword [esi]
cmp eax, 1
jne 0x10050267
mov eax, dword [edi + 0x32d4]
cmp eax, ebp
mov ebx, 2
jne 0x10050049
mov dword [esp + 0x3c], 0x14
nop
jmp 0x10050071
cmp eax, 0xa
jne 0x1005005a
mov dword [esp + 0x3c], 0
test esi, esi
jmp 0x10050071
cmp eax, 0xb
jne 0x1005006b
mov dword [esp + 0x3c], 0x10000
push ecx
pop ecx
jmp 0x10050071
mov dword [esp + 0x3c], ebx
mov dh, dh
mov ax, word [esi + 6]
mov word [esp + 0x40], ax
mov eax, dword [esi + 8]
test al, 1
je 0x10050092
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x42], cx
jmp 0x100500aa
test al, 2
je 0x100500a1
mov word [esp + 0x42], 1
mov ebx, ebx
jmp 0x100500aa
mov word [esp + 0x42], 0
test cl, cl
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x10050192
mov eax, dword [esi + 8]
test al, 1
je 0x10050192
test al, 2
je 0x1005012e
mov word [esp + 0x40], 0x37
mov ebp, ebp
mov word [esp + 0x42], bp
test eax, 0x5c69
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.10048800
add esp, 4
test cl, cl
mov word [esp + 0x40], 0x2a
mov edi, edi
mov word [esp + 0x42], bp
test bl, bl
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.10048800
add esp, 4
mov ebx, ebx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
mov word [esp + 0x40], 0x2a
test al, al
mov word [esp + 0x42], bx
push edx
pop edx
lea ecx, [esp + 0x38]
push ecx
mov edx, 0xc
mov eax, edi
call fcn.10048800
add esp, 4
mov esi, esi
mov word [esp + 0x40], 0x37
mov bl, bl
mov word [esp + 0x42], bx
test al, al
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.10048800
add esp, 4
xchg ebx, eax
xchg ebx, eax
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
cmp cx, 0x13
jne 0x10050239
mov eax, dword [esi + 8]
test al, 1
je 0x10050239
test al, 2
jne 0x1005042e
mov esi, 0x1d
mov word [esp + 0x40], si
mov cl, cl
mov word [esp + 0x42], 4
mov cl, cl
lea eax, [esp + 0x38]
push eax
lea edx, [esi - 0x11]
mov eax, edi
call fcn.10048800
add esp, 4
mov bh, bh
mov word [esp + 0x40], 0x45
mov ch, ch
mov word [esp + 0x42], 0
mov eax, eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.10048800
add esp, 4
push edx
pop edx
mov word [esp + 0x40], si
mov ebp, ebp
mov word [esp + 0x42], 5
nop
lea edx, [esp + 0x38]
push edx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.10048800
add esp, 4
mov al, al
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.10048800
add esp, 4
mov dh, dh
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
cmp eax, ebx
jne 0x1005042e
test ecx, ecx
xor ecx, ecx
test eax, 0x76f0
xor edx, edx
test eax, eax
xor ebp, ebp
test eax, eax
xor ebx, ebx
mov al, al
mov ebp, ebp
mov eax, dword [edi + 0x32d4]
cmp eax, 3
jne 0x1005029d
mov dword [esp + 0x3c], 0x1e
mov bl, bl
jmp 0x100502c8
cmp eax, 0xa
jne 0x100502aa
mov dword [esp + 0x3c], ecx
test bl, bl
jmp 0x100502c8
cmp eax, 0xb
jne 0x100502bb
mov dword [esp + 0x3c], 0x10000
push ecx
pop ecx
jmp 0x100502c8
mov dword [esp + 0x3c], 3
test eax, 0x23c1
test dword [esi + 0x10], 0x8000
je 0x100502da
mov eax, 3
test al, al
jmp 0x100502de
xor eax, eax
mov ebx, ebx
test byte [esi + 0x10], 1
je 0x100502ee
mov ebp, dword [esi + 4]
xchg ebx, eax
xchg ebx, eax
mov ebx, dword [esi + 8]
test bl, bl
test byte [esi + 0x10], 2
je 0x100502fd
mov ecx, 1
test ah, ah
test edx, edx
test byte [esi + 0x10], 4
je 0x10050308
or ecx, 2
mov bl, bl
test byte [esi + 0x10], 8
je 0x10050315
or ecx, 4
mov bl, bl
mov esi, esi
test byte [esi + 0x10], 0x10
je 0x10050320
or ecx, 8
mov ah, ah
test byte [esi + 0x10], 0x20
je 0x1005032d
or ecx, 0x10
test cl, cl
mov al, al
test byte [esi + 0x10], 0x40
je 0x10050338
or ecx, 0x20
mov eax, eax
test dword [esi + 0x10], 0x800
je 0x1005034f
or ecx, 0x400
test ebx, ebx
movzx edx, word [esi + 0xc]
mov edi, edi
mov word [esp + 0x40], ax
push edx
pop edx
mov word [esp + 0x42], cx
xchg ebx, eax
xchg ebx, eax
mov word [esp + 0x44], dx
mov al, al
test eax, 0x3fd9
mov dword [esp + 0x46], ebp
mov ch, ch
mov dword [esp + 0x4a], ebx
push ecx
pop ecx
cmp dword [edi + 0x32f8], 0
je 0x10050414
mov eax, dword [edi + 0x3358]
cmp eax, 6
jae 0x10050414
mov cx, word [esp + 0x40]
mov word [edi + eax*2 + 0x3304], cx
mov esi, esi
mov edx, dword [edi + 0x3358]
mov ax, word [esp + 0x42]
mov word [edi + edx*2 + 0x3310], ax
push edx
pop edx
mov ecx, dword [edi + 0x3358]
mov dx, word [esp + 0x44]
mov word [edi + ecx*2 + 0x331c], dx
mov al, al
mov eax, dword [edi + 0x3358]
mov ecx, dword [esp + 0x46]
mov dword [edi + eax*4 + 0x3328], ecx
mov ebx, ebx
mov edx, dword [edi + 0x3358]
mov eax, dword [esp + 0x4a]
mov dword [edi + edx*4 + 0x3340], eax
mov al, al
add dword [edi + 0x3358], 1
test eax, 0x7feb
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret
mov esi, esi
mov al, al
lea ecx, [esp + 0x38]
push ecx
mov edx, 0x16
mov eax, edi
call fcn.10048830
add esp, 4
push ebx
pop ebx
mov ecx, dword [esp + 0xc8]
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.100f43d6
add esp, 0xc0
ret