Function at 0x1002ae91
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059f25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002b0e6
lea eax, [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1002b0d8
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], 0x129
mov dword [ebp - 0x50], str.olcuvdl_nmf_houkmq_aymlzm_vienqxq
cmp dword [ebp - 0x34], 0x35e
jle 0x1002af6c
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
and dword [ebp - 0x14], 0
jmp 0x1002af0f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x79e5
jge 0x1002af6c
and dword [ebp - 0x18], 0
jmp 0x1002af25
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x458c
jge 0x1002af6a
and dword [ebp - 0x1c], 0
jmp 0x1002af3b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e20
jge 0x1002af68
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
and eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov ecx, 0x10074f78
call fcn.10009792
jmp 0x1002af34
jmp 0x1002af1e
jmp 0x1002af08
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1002b093
mov dword [ebp - 0x30], 0x601d
mov dword [ebp - 0x4c], str.kxf_zgfor_iumxmka
cmp dword [ebp - 0x30], 0x6141
jle 0x1002b041
and dword [ebp - 0x20], 0
jmp 0x1002afa2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4230
jge 0x1002b041
and dword [ebp - 0x24], 0
jmp 0x1002afbc
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x736
jge 0x1002b03c
and dword [ebp - 0x28], 0
jmp 0x1002afd2
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x5eb0
jge 0x1002b037
and dword [ebp - 0x2c], 0
jmp 0x1002afe8
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x6d52
jge 0x1002b035
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
shl eax, cl
mov ecx, dword [ebp - 0x2c]
sar eax, cl
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
lea ecx, [ebp - 0x7c]
call fcn.10001335
pop ecx
pop ecx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
call fcn.10001437
push eax
call fcn.100420be
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.1000142d
jmp 0x1002afe1
jmp 0x1002afcb
jmp 0x1002afb5
jmp 0x1002af9b
push 1
push 0x2fa3
push 0
push 0x799d
call fcn.1002f661
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0x5c4e
jge 0x1002b06d
push dword [ebp - 0x4c]
call fcn.100420be
pop ecx
jmp 0x1002b089
or dword [ebp - 4], 0xffffffff
jmp 0x1002b093
mov dword [ebp - 4], 2
cmp dword [ebp - 0x34], 0xfffffe27
jge 0x1002b0b0
mov edx, dword [ebp - 0x50]
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x1002b0cc
or dword [ebp - 4], 0xffffffff
jmp 0x1002b0d6
jmp 0x1002b0e4
push 1
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1002b0f8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
push 1
push dword [ebp - 0x54]
call fcn.1002a094
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret