Function at 0x10006f10
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
div dword [ebx + 0x6e0]
mov dword [ebp - 0x18], eax
test edx, edx
jne 0x100071c4
mov dword [ebp - 4], edx
test eax, eax
jle 0x100071c4
push esi
push edi
lea ebx, [ebx]
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov eax, dword [ebx + 0x6e0]
imul eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x6f0]
push 0x76
push ecx
mov dword [ebx + 0x6dc], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec eax
mov dword [ebp + 8], eax
mov edx, dword [ebx + 0x6dc]
fild dword [ebp + 8]
push 0x75
fnstcw word [ebp + 0xa]
movzx eax, word [ebp + 0xa]
fdivr qword [0x1001a490]
or eax, 0xc00
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x6f0]
mov edi, edx
push eax
fimul dword [edx + 0x10]
fldcw word [ebp - 8]
fistp qword [ebp - 0x14]
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x14]
fldcw word [ebp + 0xa]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec eax
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x10]
fild dword [ebp + 8]
fnstcw word [ebp + 0xa]
fdivr qword [0x1001a490]
movzx eax, word [ebp + 0xa]
or eax, 0xc00
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
fimul dword [edi + 0x14]
fldcw word [ebp - 8]
fistp qword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
fldcw word [ebp + 0xa]
cmp eax, 0x200
ja 0x100070d4
je 0x100070c4
sub eax, 0x100
cmp eax, 5
ja case.default.0x100070e2
jmp dword [eax*4 + 0x100071cc]
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x10007041
cmp eax, 0x27
je 0x10007041
cmp eax, 0x26
je 0x10007041
cmp eax, 0x28
je 0x10007041
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebx + 0x6dc]
movzx edx, byte [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x100070e2
push 0
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
mov eax, dword [ebx + 0x6dc]
movzx ecx, byte [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x100070e2
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x100070a0
cmp eax, 0x27
je 0x100070a0
cmp eax, 0x26
je 0x100070a0
cmp eax, 0x28
je 0x100070a0
push 0
push 2
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [ebx + 0x6dc]
push eax
movzx eax, byte [edx + 8]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x100070e2
push 0
push 3
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebx + 0x6dc]
movzx edx, byte [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x100070e2
push 0
push 0
push edi
push esi
push 0x8001
jmp 0x100071ac
sub eax, 0x201
cmp eax, 9
ja case.default.0x100070e2
jmp dword [eax*4 + 0x100071e4]
push 0
push 0
push edi
push esi
push 0x8002
jmp 0x100071ac
push 0
push 0
push edi
push esi
push 0x8004
jmp 0x100071ac
push 0
push 0
push edi
push esi
push 0x8008
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8010
jmp 0x100071ac
push 0
push 0
push edi
push esi
push 0x8006
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8006
jmp 0x100071ac
push 0
push 0
push edi
push esi
push 0x8018
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8018
jmp 0x100071ac
push 0
push 0
push edi
push esi
push 0x8020
jmp 0x100071ac
push 0
push 0
push edi
push esi
push 0x8040
jmp 0x100071ac
push 0
push 0
push edi
push esi
push 0x8060
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8060
jmp 0x100071ac
movsx eax, word [ecx + 0xa]
push 0
push eax
push edi
push esi
push 0x8800
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x18]
jl 0x10006f40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8