Function at 0x10005e10
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, eax
div dword [ebx + 0xc8]
test edx, edx
jne 0x100060d3
call fcn.10006ff0
xor edx, edx
mov eax, esi
div dword [ebx + 0xc8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
test eax, eax
jle 0x100060d3
push edi
nop
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov eax, dword [ebx + 0xc8]
imul eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc0]
push 0x76
push ecx
mov dword [ebx + 0xc4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec eax
mov dword [ebp + 8], eax
mov edx, dword [ebx + 0xc4]
fild dword [ebp + 8]
push 0x75
fnstcw word [ebp + 0xa]
movzx eax, word [ebp + 0xa]
fdivr qword [0x1005aa08]
or eax, 0xc00
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0xc0]
mov edi, edx
push eax
fimul dword [edx + 0x10]
fldcw word [ebp - 8]
fistp qword [ebp - 0x14]
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x14]
fldcw word [ebp + 0xa]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec eax
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x10]
fild dword [ebp + 8]
fnstcw word [ebp + 0xa]
fdivr qword [0x1005aa08]
movzx eax, word [ebp + 0xa]
or eax, 0xc00
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
fimul dword [edi + 0x14]
fldcw word [ebp - 8]
fistp qword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
fldcw word [ebp + 0xa]
cmp eax, 0x200
ja 0x10005fe4
je 0x10005fd4
sub eax, 0x100
cmp eax, 5
ja case.default.0x10005ff2
jmp dword [eax*4 + 0x100060dc]
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x10005f51
cmp eax, 0x27
je 0x10005f51
cmp eax, 0x26
je 0x10005f51
cmp eax, 0x28
je 0x10005f51
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebx + 0xc4]
movzx edx, byte [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10005ff2
push 0
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
mov eax, dword [ebx + 0xc4]
movzx ecx, byte [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10005ff2
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x10005fb0
cmp eax, 0x27
je 0x10005fb0
cmp eax, 0x26
je 0x10005fb0
cmp eax, 0x28
je 0x10005fb0
push 0
push 2
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [ebx + 0xc4]
push eax
movzx eax, byte [edx + 8]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10005ff2
push 0
push 3
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebx + 0xc4]
movzx edx, byte [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10005ff2
push 0
push 0
push edi
push esi
push 0x8001
jmp 0x100060bc
sub eax, 0x201
cmp eax, 9
ja case.default.0x10005ff2
jmp dword [eax*4 + 0x100060f4]
push 0
push 0
push edi
push esi
push 0x8002
jmp 0x100060bc
push 0
push 0
push edi
push esi
push 0x8004
jmp 0x100060bc
push 0
push 0
push edi
push esi
push 0x8008
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8010
jmp 0x100060bc
push 0
push 0
push edi
push esi
push 0x8006
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8006
jmp 0x100060bc
push 0
push 0
push edi
push esi
push 0x8018
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8018
jmp 0x100060bc
push 0
push 0
push edi
push esi
push 0x8020
jmp 0x100060bc
push 0
push 0
push edi
push esi
push 0x8040
jmp 0x100060bc
push 0
push 0
push edi
push esi
push 0x8060
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8060
jmp 0x100060bc
movsx eax, word [ecx + 0xa]
push 0
push eax
push edi
push esi
push 0x8800
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x18]
jl 0x10005e50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8