Function at 0x10002ac0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0x24924925
mul esi
push edi
mov edi, esi
sub edi, edx
shr edi, 1
add edi, edx
shr edi, 4
mov dword [ebp - 4], ecx
lea eax, [edi*8]
sub eax, edi
shl eax, 2
sub esi, eax
jne 0x10002d33
call fcn.10002280
test edi, edi
jle 0x10002d33
mov esi, dword [ebp + 8]
add esi, 8
push ebx
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp + 8], esi
mov eax, dword [ebp - 4]
push 0x76
push dword [eax + 0x28]
call ebx
fnstcw word [ebp + 0xe]
movss xmm1, dword [0x1009a42c]
dec eax
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movzx eax, word [ebp + 0xe]
divss xmm1, xmm0
movd xmm0, dword [esi + 0xc]
cvtdq2ps xmm0, xmm0
or eax, 0xc00
mulss xmm1, xmm0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movss dword [ebp - 8], xmm1
push 0x75
push dword [eax + 0x28]
fld dword [ebp - 8]
fldcw word [ebp - 0xc]
fistp qword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
fldcw word [ebp + 0xe]
call ebx
movss xmm1, dword [0x1009a42c]
dec eax
movd xmm0, eax
mov ecx, dword [ebp + 8]
cvtdq2ps xmm0, xmm0
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
divss xmm1, xmm0
movd xmm0, dword [ecx + 0x10]
cvtdq2ps xmm0, xmm0
or eax, 0xc00
mulss xmm1, xmm0
mov dword [ebp - 0xc], eax
mov eax, dword [ecx - 4]
movss dword [ebp - 0x14], xmm1
fld dword [ebp - 0x14]
fldcw word [ebp - 0xc]
fistp qword [ebp - 0x10]
mov ebx, dword [ebp - 0x10]
fldcw word [ebp + 0xe]
cmp eax, 0x200
ja 0x10002c41
je 0x10002c31
sub eax, 0x100
cmp eax, 5
ja case.default.0x10002c4f
jmp dword [eax*4 + 0x10002d3c]
mov eax, dword [ecx]
cmp eax, 0x25
je 0x10002bef
cmp eax, 0x27
je 0x10002bef
cmp eax, 0x26
je 0x10002bef
cmp eax, 0x28
je 0x10002bef
push 0
push 0
jmp 0x10002bf3
push 0
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov esi, dword [ebp + 8]
push eax
movzx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x10002c4f
mov eax, dword [ecx]
cmp eax, 0x25
je 0x10002c2b
cmp eax, 0x27
je 0x10002c2b
cmp eax, 0x26
je 0x10002c2b
cmp eax, 0x28
je 0x10002c2b
push 0
push 2
jmp 0x10002bf3
push 0
push 3
jmp 0x10002bf3
push 0
push 0
push ebx
push esi
push 0x8001
jmp 0x10002d18
sub eax, 0x201
cmp eax, 9
ja case.default.0x10002c4f
jmp dword [eax*4 + 0x10002d54]
push 0
push 0
push ebx
push esi
push 0x8002
jmp 0x10002d18
push 0
push 0
push ebx
push esi
push 0x8004
jmp 0x10002d18
push 0
push 0
push ebx
push esi
push 0x8008
jmp 0x10002d18
push 0
push 0
push ebx
push esi
push 0x8010
jmp 0x10002d18
push 0
push 0
push ebx
push esi
push 0x8006
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push ebx
push esi
push 0x8006
jmp 0x10002d18
push 0
push 0
push ebx
push esi
push 0x8018
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push ebx
push esi
push 0x8018
jmp 0x10002d18
push 0
push 0
push ebx
push esi
push 0x8020
jmp 0x10002d18
push 0
push 0
push ebx
push esi
push 0x8040
jmp 0x10002d18
push 0
push 0
push ebx
push esi
push 0x8060
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push ebx
push esi
push 0x8060
jmp 0x10002d18
movsx eax, word [ecx + 2]
push 0
push eax
push ebx
push esi
push 0x8800
call dword [sym.imp.USER32.dll_mouse_event]
add dword [ebp + 8], 0x1c
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec edi
jne 0x10002b11
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8