Function at 0x100542a0
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [edi + 0x32dc]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, edx
jne 0x100542ed
mov eax, dword [esp + 0xcc]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
mov ebx, ebx
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
cmp eax, 4
jne 0x1005443d
mov cl, cl
call fcn.100505f0
test eax, eax
je 0x100543c1
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov ebx, ebx
mov edx, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
push ecx
pop ecx
mov eax, dword [esi]
cmp eax, 1
jne 0x1005437f
mov ax, word [esi + 4]
mov word [esp + 0x14], ax
mov bh, bh
mov cx, word [esi + 6]
mov word [esp + 0x16], cx
mov ah, ah
mov edx, dword [esi + 8]
mov dword [esp + 0x18], edx
mov ebx, ebx
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov ecx, ecx
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
mov bh, bh
jmp 0x100543c1
cmp eax, ebx
jne 0x100543c1
mov edx, dword [esi + 4]
mov dword [esp + 0x14], edx
mov dl, dl
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov bh, bh
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
push ebx
pop ebx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x20], edx
mov ch, ch
mov eax, dword [esi + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov ch, ch
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
push ecx
pop ecx
mov bh, bh
mov dword [esp + 8], ebx
mov esi, esi
mov dword [esp + 0x34], 3
mov cl, cl
mov dword [esp + 0x38], 1
mov eax, eax
call fcn.100505f0
test eax, eax
je 0x100543f2
lea edx, [esp + 0xc]
mov dword [esp + 0x3c], edx
mov ebp, ebp
jmp 0x100543f8
mov dword [esp + 0x3c], esi
mov edi, edi
mov dh, dh
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov ebp, ebp
mov ch, ch
push 1
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
lea edx, [esp + 0x44]
push 0xc
push edx
call fcn.1001f940
add esp, 0x18
mov ch, ch
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
cmp eax, 1
push ebp
mov ebp, 3
je 0x10054768
cmp eax, ebp
je 0x10054768
cmp eax, 0xa
je 0x10054768
cmp eax, 0xb
je 0x10054768
cmp eax, 2
jne 0x10054b66
mov dword [esp + 0xc], ebx
mov ch, ch
mov dword [esp + 0x38], ebp
mov ah, ah
mov eax, dword [esi]
cmp eax, 1
jne 0x10054584
push eax
pop eax
mov bh, bh
mov dword [esp + 0x3c], 7
mov edx, edx
movzx edx, word [esi + 4]
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0xbc]
push ecx
push edx
call fcn.1004cc40
add esp, 0xc
test eax, eax
je 0x10054b66
test byte [esi + 8], 2
je 0x10054523
mov al, byte [esp + 0xc0]
test al, al
jbe 0x10054b66
movzx esi, al
push esi
lea eax, [esp + 0xc5]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.100f6f60
add esp, 0xc
mov ecx, ecx
mov dword [esp + 0x40], esi
mov eax, eax
push 1
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
add esi, 0xc
lea eax, [esp + 0x48]
push esi
push eax
call fcn.1001f940
add esp, 0x18
push ebx
pop ebx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
movzx esi, byte [esp + 0xb8]
push esi
lea ecx, [esp + 0xbd]
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.100f6f60
add esp, 0xc
nop
mov dword [esp + 0x40], esi
mov ebx, ebx
movzx ecx, byte [esp + 0xc0]
push 1
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
add ecx, 0xc
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.1001f940
add esp, 0x18
mov dh, dh
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
cmp eax, ebx
jne 0x10054b66
mov ecx, ecx
xor ebp, ebp
xchg ebx, eax
xchg ebx, eax
mov dword [esp + 0x3c], 8
mov dl, dl
test byte [esi + 0x10], 1
je 0x100545cd
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.10053fd0
add esp, 0x18
mov ebp, eax
mov eax, eax
test byte [esi + 0x10], 2
je 0x100545f2
nop
nop
mov byte [esp + 0x44], 9
mov dh, dh
mov byte [esp + 0x45], bl
mov edi, edi
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
push ebx
pop ebx
mov ebp, 4
nop
test byte [esi + 0x10], 8
je 0x10054618
nop
nop
mov byte [esp + 0x44], 0xa
mov ebp, ebp
mov byte [esp + 0x45], bl
mov edi, edi
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
push ebx
pop ebx
mov ebp, 4
mov edx, edx
test byte [esi + 0x10], 0x20
je 0x1005463e
nop
nop
mov byte [esp + 0x44], 0xc
mov edi, edi
mov byte [esp + 0x45], bl
mov edi, edi
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
push ebx
pop ebx
mov ebp, 4
mov dl, dl
test dword [esi + 0x10], 0x800
je 0x100546a4
mov ebx, dword [esi + 0xc]
nop
nop
test ebx, ebx
mov byte [esp + 0x44], 8
je 0x10054689
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x1005466a
or byte [esp + 0x44], 1
nop
push 2
call ebp
test ax, ax
je 0x1005467a
or byte [esp + 0x44], 2
mov ecx, ecx
push 4
call ebp
test ax, ax
je 0x10054689
or byte [esp + 0x44], 4
nop
mov byte [esp + 0x45], 0
mov edi, edi
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], bl
push ebx
pop ebx
mov ebp, 4
push edx
pop edx
xor ebx, ebx
test byte [esi + 0x10], 1
jne 0x100546cf
cmp ebp, ebx
jne 0x100546cf
nop
nop
mov byte [esp + 0x44], 8
mov byte [esp + 0x45], 0
mov edi, edi
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
push ebx
pop ebx
mov ebp, 4
push edx
pop edx
mov dword [esp + 0x40], ebp
push ecx
pop ecx
test byte [esi + 0x10], 1
je 0x10054734
cmp dword [edi + 0x3300], ebx
je 0x10054734
mov eax, dword [edi + 0x37d0]
cmp eax, 0x398
jae 0x10054734
push ebp
lea edx, [esp + 0x48]
push edx
lea eax, [edi + eax + 0x3380]
push eax
call fcn.100f6f60
add esp, 0xc
mov esi, esi
mov dword [edi + 0x37d4], 4
mov bl, bl
add dword [edi + 0x37d0], ebp
mov edx, edx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
push 1
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
add ebp, 0xc
lea edx, [esp + 0x48]
push ebp
push edx
call fcn.1001f940
add esp, 0x18
mov dh, dh
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
mov edx, edx
mov dword [esp + 0x38], ebp
mov dl, dl
mov eax, dword [esi]
cmp eax, 1
jne 0x100549af
mov eax, dword [edi + 0x32dc]
cmp eax, ebp
mov ebx, 2
jne 0x10054796
mov dword [esp + 0x3c], 0x14
mov ebp, ebp
jmp 0x100547bd
cmp eax, 0xa
jne 0x100547a7
mov dword [esp + 0x3c], 0
mov ch, ch
jmp 0x100547bd
cmp eax, 0xb
jne 0x100547b8
mov dword [esp + 0x3c], 0x10000
mov ebx, ebx
jmp 0x100547bd
mov dword [esp + 0x3c], ebx
nop
mov ax, word [esi + 6]
mov word [esp + 0x40], ax
mov eax, dword [esi + 8]
test al, 1
je 0x100547de
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x42], cx
jmp 0x100547f6
test al, 2
je 0x100547ed
mov word [esp + 0x42], 1
push ecx
pop ecx
jmp 0x100547f6
mov word [esp + 0x42], 0
mov ch, ch
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x100548db
mov eax, dword [esi + 8]
test al, 1
je 0x100548db
test al, 2
je 0x10054877
mov word [esp + 0x40], 0x37
mov ah, ah
mov word [esp + 0x42], bp
mov dh, dh
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.1004db30
add esp, 4
mov bh, bh
mov word [esp + 0x40], 0x2a
mov ah, ah
mov word [esp + 0x42], bp
mov ebx, ebx
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.1004db30
add esp, 4
mov dl, dl
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
mov word [esp + 0x40], 0x2a
mov ebp, ebp
mov word [esp + 0x42], bx
push ebx
pop ebx
lea ecx, [esp + 0x38]
push ecx
mov edx, 0xc
mov eax, edi
call fcn.1004db30
add esp, 4
mov dh, dh
mov word [esp + 0x40], 0x37
mov ebx, ebx
mov word [esp + 0x42], bx
push eax
pop eax
lea edx, [esp + 0x38]
push edx
mov edx, 0xc
mov eax, edi
call fcn.1004db30
add esp, 4
mov dl, dl
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
cmp cx, 0x13
jne 0x10054981
mov eax, dword [esi + 8]
test al, 1
je 0x10054981
test al, 2
jne 0x10054b66
mov esi, 0x1d
mov word [esp + 0x40], si
push ecx
pop ecx
mov word [esp + 0x42], 4
mov edi, edi
lea eax, [esp + 0x38]
push eax
lea edx, [esi - 0x11]
mov eax, edi
call fcn.1004db30
add esp, 4
mov ecx, ecx
mov word [esp + 0x40], 0x45
mov bl, bl
mov word [esp + 0x42], 0
nop
lea ecx, [esp + 0x38]
push ecx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.1004db30
add esp, 4
mov bl, bl
mov word [esp + 0x40], si
mov ecx, ecx
mov word [esp + 0x42], 5
nop
lea edx, [esp + 0x38]
push edx
lea edx, [esi - 0x11]
mov eax, edi
call fcn.1004db30
add esp, 4
mov dl, dl
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
lea eax, [esp + 0x38]
push eax
mov edx, 0xc
mov eax, edi
call fcn.1004db30
add esp, 4
mov ah, ah
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
cmp eax, ebx
jne 0x10054b66
xchg ebx, eax
xchg ebx, eax
xor ecx, ecx
push eax
pop eax
xor edx, edx
mov dh, dh
xor ebp, ebp
nop
xor ebx, ebx
push ebx
pop ebx
mov edi, edi
mov eax, dword [edi + 0x32dc]
cmp eax, 3
jne 0x100549e1
mov dword [esp + 0x3c], 0x1e
mov edi, edi
jmp 0x10054a09
cmp eax, 0xa
jne 0x100549ee
mov dword [esp + 0x3c], ecx
mov bl, bl
jmp 0x10054a09
cmp eax, 0xb
jne 0x100549ff
mov dword [esp + 0x3c], 0x10000
mov al, al
jmp 0x10054a09
mov dword [esp + 0x3c], 3
mov dh, dh
test dword [esi + 0x10], 0x8000
je 0x10054a1a
mov eax, 3
nop
jmp 0x10054a1e
xor eax, eax
mov bl, bl
test byte [esi + 0x10], 1
je 0x10054a2d
mov ebp, dword [esi + 4]
nop
mov ebx, dword [esi + 8]
mov bl, bl
test byte [esi + 0x10], 2
je 0x10054a3c
mov ecx, 1
mov dh, dh
mov eax, eax
test byte [esi + 0x10], 4
je 0x10054a47
or ecx, 2
mov bh, bh
test byte [esi + 0x10], 8
je 0x10054a54
or ecx, 4
push ebx
pop ebx
mov edi, edi
test byte [esi + 0x10], 0x10
je 0x10054a5e
or ecx, 8
nop
test byte [esi + 0x10], 0x20
je 0x10054a6b
or ecx, 0x10
mov ch, ch
mov ebx, ebx
test byte [esi + 0x10], 0x40
je 0x10054a76
or ecx, 0x20
mov ecx, ecx
test dword [esi + 0x10], 0x800
je 0x10054a8d
or ecx, 0x400
mov ebp, ebp
movzx edx, word [esi + 0xc]
mov ebp, ebp
mov word [esp + 0x40], ax
mov bh, bh
mov word [esp + 0x42], cx
mov edi, edi
mov word [esp + 0x44], dx
push eax
pop eax
mov dh, dh
mov dword [esp + 0x46], ebp
mov edx, edx
mov dword [esp + 0x4a], ebx
mov dl, dl
cmp dword [edi + 0x3300], 0
je 0x10054b4c
mov eax, dword [edi + 0x3360]
cmp eax, 6
jae 0x10054b4c
mov cx, word [esp + 0x40]
mov word [edi + eax*2 + 0x330c], cx
mov al, al
mov edx, dword [edi + 0x3360]
mov ax, word [esp + 0x42]
mov word [edi + edx*2 + 0x3318], ax
mov bh, bh
mov ecx, dword [edi + 0x3360]
mov dx, word [esp + 0x44]
mov word [edi + ecx*2 + 0x3324], dx
mov al, al
mov eax, dword [edi + 0x3360]
mov ecx, dword [esp + 0x46]
mov dword [edi + eax*4 + 0x3330], ecx
mov esi, esi
mov edx, dword [edi + 0x3360]
mov eax, dword [esp + 0x4a]
mov dword [edi + edx*4 + 0x3348], eax
mov ecx, ecx
add dword [edi + 0x3360], 1
mov dh, dh
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret
xchg ebx, eax
xchg ebx, eax
mov al, al
lea ecx, [esp + 0x38]
push ecx
mov edx, 0x16
mov eax, edi
call fcn.1004db60
add esp, 4
mov eax, eax
mov ecx, dword [esp + 0xc8]
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.100f5016
add esp, 0xc0
ret