Function at 0x10006ed0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor edx, edx
div dword [ebx + 0x6e0]
mov dword [ebp - 0x1c], eax
test edx, edx
jne 0x1000717a
mov dword [ebp - 8], edx
test eax, eax
jle 0x1000717a
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov eax, dword [ebx + 0x6e0]
imul eax, dword [ebp - 8]
add eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x6f0]
push 0x76
push ecx
mov dword [ebx + 0x6dc], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec eax
mov dword [ebp - 4], eax
mov edx, dword [ebx + 0x6dc]
fild dword [ebp - 4]
push 0x75
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
fdivr qword [0x1001a490]
or eax, 0xc00
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x6f0]
mov edi, edx
push eax
fimul dword [edx + 0x10]
fldcw word [ebp - 0xc]
fistp qword [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov esi, dword [ebp - 0x18]
fldcw word [ebp - 2]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
fild dword [ebp - 0xc]
fnstcw word [ebp - 2]
fdivr qword [0x1001a490]
movzx eax, word [ebp - 2]
or eax, 0xc00
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 4]
fimul dword [edi + 0x14]
fldcw word [ebp - 0xc]
fistp qword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
fldcw word [ebp - 2]
cmp eax, 0x200
ja 0x1000708a
je 0x1000707a
sub eax, 0x100
cmp eax, 5
ja case.default.0x10007098
jmp dword [eax*4 + 0x10007180]
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x10006ff7
cmp eax, 0x27
je 0x10006ff7
cmp eax, 0x26
je 0x10006ff7
cmp eax, 0x28
je 0x10006ff7
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebx + 0x6dc]
movzx edx, byte [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10007098
push 0
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
mov eax, dword [ebx + 0x6dc]
movzx ecx, byte [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10007098
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x10007056
cmp eax, 0x27
je 0x10007056
cmp eax, 0x26
je 0x10007056
cmp eax, 0x28
je 0x10007056
push 0
push 2
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [ebx + 0x6dc]
push eax
movzx eax, byte [edx + 8]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10007098
push 0
push 3
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebx + 0x6dc]
movzx edx, byte [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10007098
push 0
push 0
push edi
push esi
push 0x8001
jmp 0x10007162
sub eax, 0x201
cmp eax, 9
ja case.default.0x10007098
jmp dword [eax*4 + 0x10007198]
push 0
push 0
push edi
push esi
push 0x8002
jmp 0x10007162
push 0
push 0
push edi
push esi
push 0x8004
jmp 0x10007162
push 0
push 0
push edi
push esi
push 0x8008
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8010
jmp 0x10007162
push 0
push 0
push edi
push esi
push 0x8006
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8006
jmp 0x10007162
push 0
push 0
push edi
push esi
push 0x8018
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8018
jmp 0x10007162
push 0
push 0
push edi
push esi
push 0x8020
jmp 0x10007162
push 0
push 0
push edi
push esi
push 0x8040
jmp 0x10007162
push 0
push 0
push edi
push esi
push 0x8060
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8060
jmp 0x10007162
movsx eax, word [ecx + 0xa]
push 0
push eax
push edi
push esi
push 0x8800
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x1c]
jl 0x10006ef6
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4