Function at 0x100511e0
Capabilities:
Log keystrokes

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esp + 0x10], eax
mov eax, eax
mov esi, dword [esp + 0x14]
cmp esi, 0xa0
je 0x10051204
cmp esi, 0xa1
jne 0x1005120d
mov esi, 0x10
test edx, edx
jmp 0x1005123d
cmp esi, 0xa4
je 0x1005121d
cmp esi, 0xa5
jne 0x10051226
mov esi, 0x12
push eax
pop eax
jmp 0x1005123d
cmp esi, 0xa2
je 0x10051236
cmp esi, 0xa3
jne 0x1005123d
mov esi, 0x11
test bh, bh
mov eax, dword [edi + 0x3c]
xor ebp, ebp
cmp eax, ebp
jne 0x1005125f
push 2
push edi
mov eax, esi
call fcn.10050450
add esp, 8
test eax, 0x238d
pop edi
pop esi
lea eax, [ebp + 1]
pop ebp
ret
cmp eax, 1
jne 0x100513a8
push ebx
push ebp
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test ebx, ebx
shl eax, 0x10
or eax, 1
mov ebx, eax
push eax
pop eax
test edi, edi
push esi
call fcn.10047830
add esp, 4
test eax, eax
je 0x10051294
or ebx, 0x1000000
test edi, edi
mov cl, cl
cmp dword [edi + 0x14], ebp
je 0x100512c4
cmp dword [edi + 0x32c8], ebp
jne 0x100512c4
push 0x717be38b
push edi
call fcn.10049ed0
add esp, 8
test eax, eax
jne 0x100512c4
or ebx, 0x4000000
mov dh, dh
mov ebp, 0x4000000
mov esi, esi
cmp esi, 0x12
jne 0x100512d2
mov dword [edi + 0x60], 0
test ebx, ebx
cmp dword [edi + 0x60], 0
jne 0x10051343
cmp esi, 0x79
je 0x10051343
or ebx, 0xc0000000
push eax
pop eax
cmp dword [edi + 0x32a8], 0
je 0x100512f2
mov ebx, ebp
test ebx, ebx
cmp dword [edi + 0x32a4], 0
je 0x10051326
mov ecx, dword [edi + 0x32ac]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push ebx
push esi
push 0x101
push edx
call fcn.1004d860
add esp, 0x1c
test ah, ah
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov eax, dword [esp + 0x14]
push ebx
push esi
push 0x101
push eax
call fcn.1004d720
mov esi, esi
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov dh, dh
or ebx, 0xe0000000
test eax, eax
cmp dword [edi + 0x32a8], 0
je 0x1005135a
mov ebx, ebp
mov dh, dh
cmp dword [edi + 0x32a4], 0
je 0x1005138b
mov ecx, dword [edi + 0x32ac]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push ebx
push esi
push 0x105
push edx
call fcn.1004d730
xchg ebx, eax
xchg ebx, eax
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov eax, dword [esp + 0x14]
push ebx
push esi
push 0x105
push eax
call fcn.1004d720
mov dh, dh
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
cmp eax, 2
jne 0x1005131d
cmp esi, 0x12
jne 0x100513bb
mov dword [edi + 0x60], ebp
test dh, dh
push 2
push esi
push edi
call fcn.100aa1a0
add esp, 0xc
test esi, esi
pop edi
pop esi
mov eax, 1
pop ebp
ret

Function at 0x100513e0
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.10048860
test cl, cl
test eax, eax
jle 0x100513f8
mov dword [esp + 8], eax
jmp fcn.10050a60
xor eax, eax
ret

Function at 0x10051400
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.10048860
test dh, dh
test eax, eax
jle 0x10051418
mov dword [esp + 8], eax
jmp fcn.10050f60
xor eax, eax
ret

Function at 0x10051420
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.10048860
push edx
pop edx
test eax, eax
jle 0x10051438
mov dword [esp + 8], eax
jmp fcn.100511e0
xor eax, eax
ret