Function at 0x1006b390
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101ce2ac]
xor eax, esp
mov dword [esp + 0xbc], eax
push ebp
push esi
mov esi, dword [esp + 0xcc]
push edi
mov edi, edx
mov eax, dword [edi + 0x32d4]
xor ebp, ebp
cmp eax, ebp
jne 0x1006b3e6
mov eax, dword [esp + 0xd4]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
test eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.10116cb9
add esp, 0xc0
ret
cmp eax, 4
jne 0x1006b536
test al, al
call fcn.100670d0
test eax, eax
je 0x1006b4b9
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov edi, edi
mov edx, dword [esi]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebp
push ebx
pop ebx
mov eax, dword [esi]
cmp eax, 1
jne 0x1006b477
mov ax, word [esi + 4]
mov word [esp + 0x18], ax
test ecx, ecx
mov cx, word [esi + 6]
mov word [esp + 0x1a], cx
push ebx
pop ebx
mov edx, dword [esi + 8]
mov dword [esp + 0x1c], edx
nop
mov eax, dword [esi + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
push ecx
pop ecx
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebp
mov eax, eax
jmp 0x1006b4b9
cmp eax, ebp
jne 0x1006b4b9
mov edx, dword [esi + 4]
mov dword [esp + 0x18], edx
mov eax, eax
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
test ch, ch
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x20], ecx
test bl, bl
mov edx, dword [esi + 0x10]
mov dword [esp + 0x24], edx
push eax
pop eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
test ecx, ecx
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ebp
mov al, al
test ah, ah
mov dword [esp + 0xc], ebp
push edx
pop edx
mov dword [esp + 0x38], 3
mov dl, dl
mov dword [esp + 0x3c], 1
push ecx
pop ecx
call fcn.100670d0
test eax, eax
je 0x1006b4ea
lea edx, [esp + 0x10]
mov dword [esp + 0x40], edx
test cl, cl
jmp 0x1006b4f0
mov dword [esp + 0x40], esi
mov al, al
test ebx, ebx
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov ch, ch
mov eax, eax
push 1
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebp
lea edx, [esp + 0x48]
push 0xc
push edx
call fcn.10023c30
add esp, 0x18
test edx, edx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.10116cb9
add esp, 0xc0
ret
cmp eax, 1
push ebx
mov ebx, 3
je 0x1006b833
cmp eax, ebx
je 0x1006b833
cmp eax, 0xa
je 0x1006b833
cmp eax, 0xb
je 0x1006b833
cmp eax, 2
jne 0x1006bc02
mov dword [esp + 0x10], ebp
test bh, bh
mov dword [esp + 0x3c], ebx
push eax
pop eax
mov eax, dword [esi]
cmp eax, 1
jne 0x1006b658
test al, al
test edi, edi
mov dword [esp + 0x40], 7
mov ecx, ecx
movzx edx, word [esi + 4]
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0xc0]
push ecx
push edx
call fcn.10063750
add esp, 0xc
test eax, eax
je 0x1006bc02
test byte [esi + 8], 2
je 0x1006b609
mov al, byte [esp + 0xc4]
test al, al
jbe 0x1006bc02
movzx esi, al
push esi
lea eax, [esp + 0xc9]
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.10117a80
add esp, 0xc
push edx
pop edx
mov dword [esp + 0x44], esi
test bl, bl
push 1
lea edx, [esp + 0x14]
push edx
push ebp
push ebp
add esi, 0xc
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.10023c30
add esp, 0x18
mov edi, edi
jmp 0x1006bc02
movzx esi, byte [esp + 0xbc]
push esi
lea ecx, [esp + 0xc1]
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.10117a80
add esp, 0xc
test ebx, ebx
mov dword [esp + 0x44], esi
mov ecx, ecx
movzx ecx, byte [esp + 0xc4]
push 1
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
add ecx, 0xc
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.10023c30
add esp, 0x18
mov eax, eax
jmp 0x1006bc02
cmp eax, ebp
jne 0x1006bc02
push ebx
pop ebx
xor ebp, ebp
mov bl, bl
mov dword [esp + 0x40], 8
mov dl, dl
test byte [esi + 0x10], 1
je 0x1006b6a1
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x5c]
push ecx
call fcn.1006af90
add esp, 0x18
mov ebp, eax
test bh, bh
test byte [esi + 0x10], 2
je 0x1006b6cf
push edx
pop edx
mov ah, ah
mov byte [esp + 0x48], 9
test eax, 0x51b9
mov byte [esp + 0x49], 0
mov dl, dl
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
test esi, esi
mov ebp, 4
test edx, edx
test byte [esi + 0x10], 8
je 0x1006b6fa
push edx
pop edx
mov ah, ah
mov byte [esp + 0x48], 0xa
push eax
pop eax
mov byte [esp + 0x49], 0
mov dl, dl
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
test esi, esi
mov ebp, 4
test bh, bh
test byte [esi + 0x10], 0x20
je 0x1006b725
push edx
pop edx
mov ah, ah
mov byte [esp + 0x48], 0xc
test cl, cl
mov byte [esp + 0x49], 0
mov dl, dl
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
test esi, esi
mov ebp, 4
push eax
pop eax
test dword [esi + 0x10], 0x800
je 0x1006b790
mov ebx, dword [esi + 0xc]
push edx
pop edx
mov ah, ah
test ebx, ebx
mov byte [esp + 0x48], 8
je 0x1006b777
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x1006b754
or byte [esp + 0x48], 1
mov ch, ch
push 2
call ebp
test ax, ax
je 0x1006b764
or byte [esp + 0x48], 2
mov ebp, ebp
push 4
call ebp
test ax, ax
je 0x1006b777
or byte [esp + 0x48], 4
test eax, 0x6f57
mov byte [esp + 0x49], 0
mov dl, dl
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], bl
test esi, esi
mov ebp, 4
mov cl, cl
test byte [esi + 0x10], 1
jne 0x1006b7bd
test ebp, ebp
jne 0x1006b7bd
push edx
pop edx
mov ah, ah
mov byte [esp + 0x48], 8
mov byte [esp + 0x49], 0
mov dl, dl
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
test esi, esi
mov ebp, 4
mov cl, cl
mov dword [esp + 0x44], ebp
test bh, bh
test byte [esi + 0x10], 1
je 0x1006b810
cmp dword [edi + 0x32f8], 0
je 0x1006b810
mov eax, dword [edi + 0x37c8]
cmp eax, 0x398
jae 0x1006b810
push ebp
lea edx, [esp + 0x4c]
push edx
lea eax, [edi + eax + 0x3378]
push eax
call fcn.10117a80
add esp, 0xc
test bl, bl
mov dword [edi + 0x37cc], 4
mov edi, edi
add dword [edi + 0x37c8], ebp
mov al, al
jmp 0x1006bc02
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
add ebp, 0xc
lea edx, [esp + 0x4c]
push ebp
push edx
call fcn.10023c30
add esp, 0x18
mov ebx, ebx
jmp 0x1006bc02
xchg ebx, eax
xchg ebx, eax
mov dword [esp + 0x3c], ebx
test esi, esi
mov eax, dword [esi]
cmp eax, 1
jne 0x1006ba63
mov eax, dword [edi + 0x32d4]
cmp eax, ebx
mov ebp, 2
mov edx, 0x10000
jne 0x1006b866
mov dword [esp + 0x40], 0x14
test ecx, ecx
jmp 0x1006b88a
cmp eax, 0xa
jne 0x1006b877
mov dword [esp + 0x40], 0
push ebx
pop ebx
jmp 0x1006b88a
cmp eax, 0xb
jne 0x1006b884
mov dword [esp + 0x40], edx
mov cl, cl
jmp 0x1006b88a
mov dword [esp + 0x40], ebp
mov ah, ah
mov ax, word [esi + 6]
mov word [esp + 0x44], ax
mov eax, dword [esi + 8]
test al, 1
je 0x1006b8ab
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x46], cx
jmp 0x1006b8c3
test al, 2
je 0x1006b8ba
mov word [esp + 0x46], 1
test ch, ch
jmp 0x1006b8c3
mov word [esp + 0x46], 0
test ch, ch
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x1006b96d
mov eax, dword [esi + 8]
test al, 1
je 0x1006b96d
test al, 2
je 0x1006b927
mov word [esp + 0x44], 0x37
test dl, dl
mov word [esp + 0x46], bx
test esi, esi
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b270
xchg ebx, eax
xchg ebx, eax
mov word [esp + 0x44], 0x2a
test ecx, ecx
mov word [esp + 0x46], bx
test ecx, ecx
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b270
mov ah, ah
jmp 0x1006bc02
mov word [esp + 0x44], 0x2a
test esi, esi
mov word [esp + 0x46], bp
test edx, edx
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b270
mov cl, cl
mov word [esp + 0x44], 0x37
nop
mov word [esp + 0x46], bp
test bh, bh
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b270
test ecx, ecx
jmp 0x1006bc02
cmp cx, 0x13
jne 0x1006b9f0
mov eax, dword [esi + 8]
test al, 1
je 0x1006b9f0
test al, 2
jne 0x1006bc02
mov ebp, 0x1d
mov word [esp + 0x44], bp
mov dl, dl
mov word [esp + 0x46], 4
mov ecx, ecx
xor esi, esi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b270
mov al, al
mov word [esp + 0x44], 0x45
test ch, ch
mov word [esp + 0x46], si
test eax, 0x2bbc
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b270
mov eax, eax
mov word [esp + 0x44], bp
nop
mov word [esp + 0x46], 5
mov ch, ch
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b270
mov bl, bl
jmp 0x1006bc02
nop
mov edi, dword [edi + 0x32d4]
cmp edi, 1
je 0x1006ba40
cmp edi, ebx
je 0x1006ba40
cmp edi, 0xa
jne 0x1006ba22
mov dword [esp + 0x40], 0
mov edi, edi
lea edx, [esp + 0x3c]
push 0xc
push edx
call fcn.10069480
add esp, 8
push ebx
pop ebx
jmp 0x1006ba5c
cmp edi, 0xb
jne 0x1006ba5c
mov dword [esp + 0x40], edx
xchg ebx, eax
xchg ebx, eax
lea eax, [esp + 0x3c]
push 0xc
push eax
call fcn.10069480
add esp, 8
push edx
pop edx
jmp 0x1006ba5c
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x4c]
push 0xc
push edx
call fcn.10023c30
add esp, 0x18
mov al, al
test bh, bh
jmp 0x1006bc02
cmp eax, ebp
jne 0x1006bc02
test eax, 0x63de
xor ecx, ecx
test dh, dh
xor edx, edx
mov cl, cl
xor ebp, ebp
mov ecx, ecx
xor ebx, ebx
mov ch, ch
test ah, ah
mov eax, dword [edi + 0x32d4]
cmp eax, 3
jne 0x1006ba99
mov dword [esp + 0x40], 0x1e
test esi, esi
jmp 0x1006bac1
cmp eax, 0xa
jne 0x1006baa6
mov dword [esp + 0x40], ecx
xchg ebx, eax
xchg ebx, eax
jmp 0x1006bac1
cmp eax, 0xb
jne 0x1006bab7
mov dword [esp + 0x40], 0x10000
mov bl, bl
jmp 0x1006bac1
mov dword [esp + 0x40], 3
test bh, bh
test dword [esi + 0x10], 0x8000
je 0x1006bad3
mov eax, 3
push ebx
pop ebx
jmp 0x1006bad7
xor eax, eax
mov dh, dh
test byte [esi + 0x10], 1
je 0x1006bae7
mov ebp, dword [esi + 4]
mov ebx, ebx
mov ebx, dword [esi + 8]
mov dh, dh
test byte [esi + 0x10], 2
je 0x1006baf6
mov ecx, 1
mov ebp, ebp
test bl, bl
test byte [esi + 0x10], 4
je 0x1006bb01
or ecx, 2
test ch, ch
test byte [esi + 0x10], 8
je 0x1006bb0e
or ecx, 4
mov ah, ah
test cl, cl
test byte [esi + 0x10], 0x10
je 0x1006bb19
or ecx, 8
mov bl, bl
test byte [esi + 0x10], 0x20
je 0x1006bb26
or ecx, 0x10
push ecx
pop ecx
push ecx
pop ecx
test byte [esi + 0x10], 0x40
je 0x1006bb31
or ecx, 0x20
mov ebx, ebx
test dword [esi + 0x10], 0x800
je 0x1006bb48
or ecx, 0x400
mov bh, bh
movzx edx, word [esi + 0xc]
mov dh, dh
mov word [esp + 0x44], ax
test eax, 0x1a6a
mov word [esp + 0x46], cx
test bl, bl
mov word [esp + 0x48], dx
test al, al
push ecx
pop ecx
mov dword [esp + 0x4a], ebp
test bl, bl
mov dword [esp + 0x4e], ebx
mov bl, bl
cmp dword [edi + 0x32f8], 0
je 0x1006bbec
mov eax, dword [edi + 0x3358]
cmp eax, 6
jae 0x1006bbec
mov cx, word [esp + 0x44]
mov word [edi + eax*2 + 0x3304], cx
test al, al
mov edx, dword [edi + 0x3358]
mov ax, word [esp + 0x46]
mov word [edi + edx*2 + 0x3310], ax
test eax, eax
mov ecx, dword [edi + 0x3358]
mov dx, word [esp + 0x48]
mov word [edi + ecx*2 + 0x331c], dx
test ecx, ecx
mov eax, dword [edi + 0x3358]
mov ecx, dword [esp + 0x4a]
mov dword [edi + eax*4 + 0x3328], ecx
test ah, ah
mov edx, dword [edi + 0x3358]
mov eax, dword [esp + 0x4e]
mov dword [edi + edx*4 + 0x3340], eax
test ch, ch
add dword [edi + 0x3358], 1
test cl, cl
jmp 0x1006bc02
mov esi, esi
mov ecx, ecx
xor esi, esi
lea edx, [esi + 0x16]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006b300
push ebx
pop ebx
mov ecx, dword [esp + 0xcc]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10116cb9
add esp, 0xc0
ret