Function at 0x1013385
Capabilities:
Check for peb beingdebugged flag
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
xor esi, esi
xor ecx, ecx
test byte [0x10382d4], 2
mov dword [ebp - 0x18], 1
je 0x1013a24
cmp word [0x10382d8], si
push edi
mov edi, dword [0x1038258]
jge 0x10133be
xor eax, eax
mov word [0x10382d8], ax
cmp word [0x10382da], si
jge 0x10133cf
xor eax, eax
mov word [0x10382da], ax
movzx eax, word [edi + 8]
cmp word [0x10382dc], ax
jl 0x10133e3
dec eax
mov word [0x10382dc], ax
movzx eax, word [edi + 0xa]
cmp word [0x10382de], ax
jl 0x10133f7
dec eax
mov word [0x10382de], ax
mov eax, dword [0x10382dc]
sub eax, dword [0x10382d8]
push ebx
inc eax
mov word [ebp - 0x34], ax
mov eax, dword [0x10382de]
sub eax, dword [0x10382da]
inc eax
test byte [edi], 1
mov word [ebp - 0x32], ax
je 0x1013912
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 4
pop edx
cmp byte [0x1038415], cl
je 0x1013479
movsx esi, word [ebp - 0x34]
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add esi, edx
mov dword [ebp - 0x2c], edx
movsx edx, word [ebp - 0x32]
imul esi, edx
lea edx, [esi + esi + 2]
push edx
add ecx, 0x300000
push ecx
push dword [eax + 0x18]
mov dword [ebp - 0x18], 2
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x1013a22
mov ecx, dword [ebp - 0x2c]
jmp 0x101347c
mov dword [ebp - 4], esi
movsx esi, word [ebp - 0x34]
movsx eax, word [ebp - 0x32]
mov dword [ebp - 0x24], esi
add esi, ecx
imul esi, eax
imul esi, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
shl esi, 2
push esi
push dword [0x1038030]
push dword [eax + 0x18]
call ebx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x10134c3
cmp dword [ebp - 4], eax
je 0x1013a22
push dword [ebp - 4]
jmp 0x1013596
cmp byte [0x1038415], 0
mov eax, dword [ebp - 0x34]
jne 0x10135bc
test byte [0x10382f8], 1
je 0x1013532
test dword [0x10382cc], 0x200
je 0x1013532
push esi
mov esi, dword [ebp - 0xc]
push esi
push 0x10382d8
push edi
call fcn.010209a4
xor eax, eax
cmp ax, word [ebp - 0x32]
jge 0x1013572
movzx eax, word [ebp - 0x32]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp ax, word [ebp - 0x34]
jge 0x101352b
movzx ebx, word [ebp - 0x34]
movzx eax, byte [esi]
push eax
push dword [0x1038334]
call fcn.0101c453
mov word [esi], ax
add esi, 4
dec ebx
jne 0x1013513
dec dword [ebp - 0x18]
je 0x1013572
jmp 0x1013507
mov cx, word [0x10382d8]
mov word [ebp - 8], cx
mov cx, word [0x10382da]
mov word [ebp - 6], cx
xor ecx, ecx
mov word [ebp - 0x3a], cx
mov word [ebp - 0x3c], cx
lea ecx, [eax - 1]
mov word [ebp - 0x38], cx
mov ecx, dword [ebp - 0x32]
dec ecx
mov word [ebp - 0x36], cx
lea ecx, [ebp - 0x3c]
push ecx
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
call fcn.0101cdcf
mov eax, dword [ebp - 0x24]
add eax, 2
imul eax, dword [ebp - 0x28]
lea eax, [eax + eax + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x10135af
push dword [ebp - 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1013a22
cmp byte [0x1038415], 0
je 0x10136f4
test byte [edi], 4
je 0x10135d4
test byte [0x10382f8], 1
jne 0x10135d4
and dword [ebp - 0x18], 0
and dword [ebp - 0x20], 0
jmp 0x10135e2
mov dword [ebp - 0x18], 0xd
mov dword [ebp - 0x20], 0xa
mov esi, dword [ebp - 4]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
shr eax, 0xf
not eax
and eax, 1
mov dword [ebp - 0x14], eax
xor eax, eax
cmp ax, word [ebp - 0x32]
jge 0x10137b7
inc eax
mov word [ebp - 0xe], ax
mov eax, dword [0x10382da]
mov cx, word [0x10382d8]
mov edx, dword [ebp - 0x34]
add eax, ebx
mov word [ebp - 6], ax
mov word [ebp - 0x42], ax
mov word [ebp - 0x3e], ax
lea eax, [ebp - 0x44]
push eax
mov word [ebp - 8], cx
mov word [ebp - 0x44], cx
mov ecx, dword [ebp - 8]
push edi
push ecx
push dword [ebp - 0x34]
lea edx, [edx + ecx - 1]
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x40], dx
call fcn.0103673b
mov ax, word [ebp - 0x44]
mov word [ebp - 8], ax
mov ax, word [ebp - 0x42]
mov word [ebp - 6], ax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x44]
inc eax
mov word [ebp - 0x10], ax
xor eax, eax
mov word [ebp - 0x36], ax
mov word [ebp - 0x3a], ax
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 1]
mov word [ebp - 0x38], cx
lea ecx, [ebp - 0x3c]
push ecx
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
call fcn.0101cdcf
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp cx, word [ebp - 0x10]
jge 0x10136b8
movzx ecx, word [ebp - 0x10]
mov edx, 0x200
test word [eax + 2], dx
jne 0x10136b2
mov dx, word [eax]
mov word [esi], dx
inc esi
inc esi
add eax, 4
dec ecx
jne 0x101369f
cmp dword [ebp - 0x14], 0
je 0x10136e4
push 2
pop eax
jmp 0x10136c9
cmp word [esi], 0x20
jne 0x10136d0
sub esi, eax
cmp esi, dword [ebp - 0x1c]
jae 0x10136c3
mov cx, word [ebp - 0x18]
add esi, eax
mov word [esi], cx
mov cx, word [ebp - 0x20]
add esi, eax
mov word [esi], cx
add esi, eax
inc ebx
cmp bx, word [ebp - 0x32]
jge 0x10137b7
jmp 0x101360b
mov ecx, dword [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test byte [edi], 4
mov esi, eax
je 0x101371a
test byte [0x10382f8], 1
jne 0x101371a
mov dword [ebp - 0x20], 1
jmp 0x101371e
and dword [ebp - 0x20], 0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
shr ebx, 0xf
not ebx
and ebx, 1
xor eax, eax
cmp ax, word [ebp - 0x32]
mov dword [ebp - 0x14], ebx
jge 0x10137b7
movzx eax, word [ebp - 0x32]
push 2
mov dword [ebp - 0x1c], eax
pop edi
xor eax, eax
cmp ax, word [ebp - 0x34]
mov edx, esi
jge 0x1013771
movzx ecx, word [ebp - 0x34]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov word [esi], ax
test ax, ax
jne 0x1013768
push 0x20
pop eax
mov word [esi], ax
add dword [ebp - 0x10], 4
add esi, edi
dec ecx
jne 0x1013754
test ebx, ebx
jne 0x101377d
jmp 0x1013785
cmp word [esi], 0x20
jne 0x1013783
sub esi, edi
cmp esi, edx
jae 0x1013777
add esi, edi
cmp dword [ebp - 0x20], 0
je 0x101379e
push dword [0x1038334]
mov eax, esi
sub eax, edx
sar eax, 1
push eax
push edx
call fcn.0101c591
test ebx, ebx
je 0x10137b2
push 0xd
pop eax
mov word [esi], ax
push 0xa
add esi, edi
pop eax
mov word [esi], ax
add esi, edi
dec dword [ebp - 0x1c]
jne 0x1013746
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
je 0x10137c7
cmp word [ebp - 0x32], bx
je 0x10137c7
sub esi, 4
xor eax, eax
mov word [esi], ax
cmp byte [0x1038415], al
je 0x101389d
mov eax, dword [ebp - 0x24]
add eax, 8
imul eax, dword [ebp - 0x28]
lea eax, [eax + eax + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x1013828
push dword [ebp - 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push ebx
push dword [eax + 0x18]
call esi
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
jmp 0x1013a22
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 4]
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlSizeHeap]
push eax
push dword [ebp - 4]
push edi
call dword [sym.imp.msvcrt.dll_memmove]
sub esi, dword [ebp - 4]
add esp, 0xc
sar esi, 1
lea esi, [edi + esi*2]
cmp word [ebp - 0x18], bx
jne 0x101389d
push dword [0x1038334]
mov eax, esi
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.0101c591
mov eax, edi
cmp edi, esi
jae 0x101389d
cmp word [eax], bx
jne 0x1013897
lea ecx, [eax + 2]
cmp word [ecx], bx
jne 0x1013897
push 0xd
pop edx
mov word [eax], dx
mov eax, ecx
push 0xa
pop ecx
mov word [eax], cx
inc eax
inc eax
cmp eax, esi
jb 0x101387c
mov edi, dword [ebp - 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 4], ebx
je 0x10138c4
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [ebp - 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [0x1038260]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x10138e9
push edi
jmp 0x10138f4
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
test eax, eax
jne 0x10138ff
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1013a22
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1013a22
push esi
push esi
push dword [edi + 0x50]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [0x1038268]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
movsx ecx, word [ebp - 0x34]
mov ebx, eax
movsx eax, word [ebp - 0x32]
push eax
push ecx
push dword [0x1038268]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x2c], eax
cmp eax, esi
je 0x1013a11
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x2c]
cmp eax, esi
je 0x101396a
push esi
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [ebp - 0x28], eax
call fcn.01012e9b
mov ecx, dword [edi + 0x40]
cmp dword [ecx + 8], esi
jge 0x101398e
movsx edx, word [edi + 0xe]
or eax, 0xffffffff
sub eax, edx
movsx edx, word [0x10382de]
sub eax, edx
sub eax, dword [ecx + 8]
jmp 0x101399b
movsx eax, word [edi + 0xe]
movsx edx, word [0x10382de]
add eax, edx
movsx edx, word [ebp - 0x34]
push 0xcc0020
push dword [edi + 0x58]
push ecx
push dword [edi + 0x44]
movsx ecx, word [ebp - 0x32]
push ecx
push edx
movsx edx, word [0x10382d8]
push eax
movsx eax, word [edi + 0xc]
add eax, edx
push eax
movsx eax, word [ebp - 0x34]
push ecx
push eax
push esi
push esi
push ebx
call dword [sym.imp.GDI32.dll_StretchDIBits]
call fcn.01012e9b
cmp dword [edi + 0x2c], esi
je 0x10139e4
push esi
push dword [ebp - 0x28]
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [0x1038260]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp - 0x2c]
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push esi
push dword [edi + 0x50]
call dword [sym.imp.ntdll.dll_NtReleaseMutant]
pop ebx
pop edi
pop esi
leave
ret