Function at 0x10034980
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x10132f1c]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [edi + 0x32dc]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, edx
jne 0x100349cd
mov eax, dword [esp + 0xcc]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
mov dh, dh
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
cmp eax, 4
jne 0x10034b1d
mov ah, ah
call fcn.10032ed0
test eax, eax
je 0x10034aa1
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov ah, ah
mov edx, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov al, al
mov eax, dword [esi]
cmp eax, 1
jne 0x10034a5f
mov ax, word [esi + 4]
mov word [esp + 0x14], ax
mov eax, eax
mov cx, word [esi + 6]
mov word [esp + 0x16], cx
push ebx
pop ebx
mov edx, dword [esi + 8]
mov dword [esp + 0x18], edx
mov edi, edi
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov bh, bh
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
mov cl, cl
jmp 0x10034aa1
cmp eax, ebx
jne 0x10034aa1
mov edx, dword [esi + 4]
mov dword [esp + 0x14], edx
mov eax, eax
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov ecx, ecx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
mov ah, ah
mov edx, dword [esi + 0x10]
mov dword [esp + 0x20], edx
mov edi, edi
mov eax, dword [esi + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov edx, edx
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
push edx
pop edx
mov dl, dl
mov dword [esp + 8], ebx
push ebx
pop ebx
mov dword [esp + 0x34], 3
mov bh, bh
mov dword [esp + 0x38], 1
push ebx
pop ebx
call fcn.10032ed0
test eax, eax
je 0x10034ad2
lea edx, [esp + 0xc]
mov dword [esp + 0x3c], edx
mov bh, bh
jmp 0x10034ad8
mov dword [esp + 0x3c], esi
push ecx
pop ecx
mov eax, eax
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov bh, bh
mov edx, edx
push 1
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
lea edx, [esp + 0x44]
push 0xc
push edx
call fcn.1001bd20
add esp, 0x18
mov dl, dl
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
cmp eax, 1
push ebp
mov ebp, 3
je 0x10034e53
cmp eax, ebp
je 0x10034e53
cmp eax, 0xa
je 0x10034e53
cmp eax, 0xb
je 0x10034e53
cmp eax, 2
jne 0x10035258
mov dword [esp + 0xc], ebx
nop
mov dword [esp + 0x38], ebp
push ebx
pop ebx
mov eax, dword [esi]
cmp eax, 1
jne 0x10034c63
mov ecx, ecx
mov ch, ch
mov dword [esp + 0x3c], 7
mov ebx, ebx
movzx edx, word [esi + 4]
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0xbc]
push ecx
push edx
call fcn.1002fe90
add esp, 0xc
test eax, eax
je 0x10035258
test byte [esi + 8], 2
je 0x10034c01
mov al, byte [esp + 0xc0]
test al, al
jbe 0x10035258
movzx esi, al
push esi
lea eax, [esp + 0xc5]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.100abe40
add esp, 0xc
push edx
pop edx
mov dword [esp + 0x40], esi
mov al, al
push 1
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
add esi, 0xc
lea eax, [esp + 0x48]
push esi
push eax
call fcn.1001bd20
add esp, 0x18
nop
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
movzx esi, byte [esp + 0xb8]
push esi
lea ecx, [esp + 0xbd]
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.100abe40
add esp, 0xc
mov ebp, ebp
mov dword [esp + 0x40], esi
push ecx
pop ecx
movzx ecx, byte [esp + 0xc0]
push 1
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
add ecx, 0xc
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.1001bd20
add esp, 0x18
mov al, al
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
cmp eax, ebx
jne 0x10035258
mov ch, ch
xor ebp, ebp
mov ch, ch
mov dword [esp + 0x3c], 8
mov ecx, ecx
test byte [esi + 0x10], 1
je 0x10034cac
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.100346b0
add esp, 0x18
mov ebp, eax
push ebx
pop ebx
test byte [esi + 0x10], 2
je 0x10034cd4
mov dl, dl
mov ecx, ecx
mov byte [esp + 0x44], 9
mov al, al
mov byte [esp + 0x45], bl
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
xchg ebx, eax
xchg ebx, eax
mov ebp, 4
mov ecx, ecx
test byte [esi + 0x10], 8
je 0x10034cfc
mov dl, dl
mov ecx, ecx
mov byte [esp + 0x44], 0xa
mov cl, cl
mov byte [esp + 0x45], bl
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
xchg ebx, eax
xchg ebx, eax
mov ebp, 4
push edx
pop edx
test byte [esi + 0x10], 0x20
je 0x10034d24
mov dl, dl
mov ecx, ecx
mov byte [esp + 0x44], 0xc
push eax
pop eax
mov byte [esp + 0x45], bl
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
xchg ebx, eax
xchg ebx, eax
mov ebp, 4
push edx
pop edx
test dword [esi + 0x10], 0x800
je 0x10034d8e
mov ebx, dword [esi + 0xc]
mov dl, dl
mov ecx, ecx
test ebx, ebx
mov byte [esp + 0x44], 8
je 0x10034d73
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x10034d53
or byte [esp + 0x44], 1
mov cl, cl
push 2
call ebp
test ax, ax
je 0x10034d63
or byte [esp + 0x44], 2
mov dh, dh
push 4
call ebp
test ax, ax
je 0x10034d73
or byte [esp + 0x44], 4
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x45], 0
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], bl
xchg ebx, eax
xchg ebx, eax
mov ebp, 4
mov ebp, ebp
xor ebx, ebx
test byte [esi + 0x10], 1
jne 0x10034dbb
cmp ebp, ebx
jne 0x10034dbb
mov dl, dl
mov ecx, ecx
mov byte [esp + 0x44], 8
mov byte [esp + 0x45], 0
xchg ebx, eax
xchg ebx, eax
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
xchg ebx, eax
xchg ebx, eax
mov ebp, 4
mov ebx, ebx
mov dword [esp + 0x40], ebp
mov bl, bl
test byte [esi + 0x10], 1
je 0x10034e1f
cmp dword [edi + 0x3300], ebx
je 0x10034e1f
mov eax, dword [edi + 0x37d0]
cmp eax, 0x398
jae 0x10034e1f
push ebp
lea edx, [esp + 0x48]
push edx
lea eax, [edi + eax + 0x3380]
push eax
call fcn.100abe40
add esp, 0xc
mov ebx, ebx
mov dword [edi + 0x37d4], 4
nop
add dword [edi + 0x37d0], ebp
push edx
pop edx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
push 1
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
add ebp, 0xc
lea edx, [esp + 0x48]
push ebp
push edx
call fcn.1001bd20
add esp, 0x18
push ebx
pop ebx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
mov ebp, ebp
mov dword [esp + 0x38], ebp
mov edx, edx
mov eax, dword [esi]
cmp eax, 1
jne 0x1003509d
mov eax, dword [edi + 0x32dc]
cmp eax, ebp
mov ebx, 2
jne 0x10034e81
mov dword [esp + 0x3c], 0x14
mov ebx, ebx
jmp 0x10034ea9
cmp eax, 0xa
jne 0x10034e92
mov dword [esp + 0x3c], 0
push edx
pop edx
jmp 0x10034ea9
cmp eax, 0xb
jne 0x10034ea3
mov dword [esp + 0x3c], 0x10000
mov esi, esi
jmp 0x10034ea9
mov dword [esp + 0x3c], ebx
mov ebx, ebx
mov ax, word [esi + 6]
mov word [esp + 0x40], ax
mov eax, dword [esi + 8]
test al, 1
je 0x10034eca
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x42], cx
jmp 0x10034ee2
test al, 2
je 0x10034ed9
mov word [esp + 0x42], 1
mov ebx, ebx
jmp 0x10034ee2
mov word [esp + 0x42], 0
mov bl, bl
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x10034fc7
mov eax, dword [esi + 8]
test al, 1
je 0x10034fc7
test al, 2
je 0x10034f63
mov word [esp + 0x40], 0x37
push edx
pop edx
mov word [esp + 0x42], bp
mov dl, dl
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.10030d80
add esp, 4
mov dl, dl
mov word [esp + 0x40], 0x2a
push ebx
pop ebx
mov word [esp + 0x42], bp
mov dh, dh
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.10030d80
add esp, 4
mov ecx, ecx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
mov word [esp + 0x40], 0x2a
mov ah, ah
mov word [esp + 0x42], bx
mov cl, cl
lea ecx, [esp + 0x38]
push ecx
mov edx, 0xc
mov eax, edi
call fcn.10030d80
add esp, 4
mov cl, cl
mov word [esp + 0x40], 0x37
mov ebx, ebx
mov word [esp + 0x42], bx
mov bh, bh
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.10030d80
add esp, 4
mov eax, eax
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
cmp cx, 0x13
jne 0x1003506f
mov eax, dword [esi + 8]
test al, 1
je 0x1003506f
test al, 2
jne 0x10035258
mov esi, 0x1d
mov word [esp + 0x40], si
mov ch, ch
mov word [esp + 0x42], 4
push eax
pop eax
lea eax, [esp + 0x38]
push eax
lea edx, [esi - 0x11]
mov eax, edi
call fcn.10030d80
add esp, 4
push edx
pop edx
mov word [esp + 0x40], 0x45
mov ecx, ecx
mov word [esp + 0x42], 0
mov dh, dh
lea ecx, [esp + 0x38]
push ecx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.10030d80
add esp, 4
mov bl, bl
mov word [esp + 0x40], si
push ecx
pop ecx
mov word [esp + 0x42], 5
push eax
pop eax
lea edx, [esp + 0x38]
push edx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.10030d80
add esp, 4
mov edx, edx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.10030d80
add esp, 4
push ecx
pop ecx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
cmp eax, ebx
jne 0x10035258
xchg ebx, eax
xchg ebx, eax
xor ecx, ecx
mov ah, ah
xor edx, edx
mov dh, dh
xor ebp, ebp
mov dl, dl
xor ebx, ebx
mov dl, dl
mov dh, dh
mov eax, dword [edi + 0x32dc]
cmp eax, 3
jne 0x100350d0
mov dword [esp + 0x3c], 0x1e
mov esi, esi
jmp 0x100350f8
cmp eax, 0xa
jne 0x100350dd
mov dword [esp + 0x3c], ecx
mov cl, cl
jmp 0x100350f8
cmp eax, 0xb
jne 0x100350ee
mov dword [esp + 0x3c], 0x10000
mov al, al
jmp 0x100350f8
mov dword [esp + 0x3c], 3
push ecx
pop ecx
test dword [esi + 0x10], 0x8000
je 0x1003510a
mov eax, 3
mov bl, bl
jmp 0x1003510e
xor eax, eax
push edx
pop edx
test byte [esi + 0x10], 1
je 0x1003511e
mov ebp, dword [esi + 4]
mov al, al
mov ebx, dword [esi + 8]
push eax
pop eax
test byte [esi + 0x10], 2
je 0x1003512d
mov ecx, 1
xchg ebx, eax
xchg ebx, eax
mov dl, dl
test byte [esi + 0x10], 4
je 0x10035138
or ecx, 2
mov esi, esi
test byte [esi + 0x10], 8
je 0x10035145
or ecx, 4
mov dh, dh
mov ebp, ebp
test byte [esi + 0x10], 0x10
je 0x10035150
or ecx, 8
push eax
pop eax
test byte [esi + 0x10], 0x20
je 0x1003515d
or ecx, 0x10
mov ch, ch
push edx
pop edx
test byte [esi + 0x10], 0x40
je 0x10035168
or ecx, 0x20
xchg ebx, eax
xchg ebx, eax
test dword [esi + 0x10], 0x800
je 0x1003517f
or ecx, 0x400
mov dl, dl
movzx edx, word [esi + 0xc]
mov edi, edi
mov word [esp + 0x40], ax
mov ebx, ebx
mov word [esp + 0x42], cx
mov edx, edx
mov word [esp + 0x44], dx
push edx
pop edx
mov cl, cl
mov dword [esp + 0x46], ebp
mov esi, esi
mov dword [esp + 0x4a], ebx
mov dl, dl
cmp dword [edi + 0x3300], 0
je 0x1003523e
mov eax, dword [edi + 0x3360]
cmp eax, 6
jae 0x1003523e
mov cx, word [esp + 0x40]
mov word [edi + eax*2 + 0x330c], cx
push edx
pop edx
mov edx, dword [edi + 0x3360]
mov ax, word [esp + 0x42]
mov word [edi + edx*2 + 0x3318], ax
push eax
pop eax
mov ecx, dword [edi + 0x3360]
mov dx, word [esp + 0x44]
mov word [edi + ecx*2 + 0x3324], dx
mov esi, esi
mov eax, dword [edi + 0x3360]
mov ecx, dword [esp + 0x46]
mov dword [edi + eax*4 + 0x3330], ecx
push edx
pop edx
mov edx, dword [edi + 0x3360]
mov eax, dword [esp + 0x4a]
mov dword [edi + edx*4 + 0x3348], eax
mov ebp, ebp
add dword [edi + 0x3360], 1
mov dh, dh
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret
push edx
pop edx
mov eax, eax
lea ecx, [esp + 0x38]
push ecx
mov edx, 0x16
mov eax, edi
call fcn.10030db0
add esp, 4
mov edx, edx
mov ecx, dword [esp + 0xc8]
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.100aa646
add esp, 0xc0
ret