Function at 0x10003410
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor edx, edx
push esi
mov esi, eax
div dword [ebx + 0x1c0]
test edx, edx
jne 0x100036d3
call fcn.100042b0
xor edx, edx
mov eax, esi
div dword [ebx + 0x1c0]
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x100036d3
push edi
jmp 0x10003450
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov eax, dword [ebx + 0x1c0]
imul eax, dword [ebp - 8]
add eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x1b8]
push 0x76
push ecx
mov dword [ebx + 0x1bc], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec eax
mov dword [ebp - 4], eax
mov edx, dword [ebx + 0x1bc]
fild dword [ebp - 4]
push 0x75
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
fdivr qword [0x1002a980]
or eax, 0xc00
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x1b8]
mov edi, edx
push eax
fimul dword [edx + 0x10]
fldcw word [ebp - 0xc]
fistp qword [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov esi, dword [ebp - 0x18]
fldcw word [ebp - 2]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
fild dword [ebp - 0xc]
fnstcw word [ebp - 2]
fdivr qword [0x1002a980]
movzx eax, word [ebp - 2]
or eax, 0xc00
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 4]
fimul dword [edi + 0x14]
fldcw word [ebp - 0xc]
fistp qword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
fldcw word [ebp - 2]
cmp eax, 0x200
ja 0x100035e4
je 0x100035d4
sub eax, 0x100
cmp eax, 5
ja case.default.0x100035f2
jmp dword [eax*4 + 0x100036dc]
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x10003551
cmp eax, 0x27
je 0x10003551
cmp eax, 0x26
je 0x10003551
cmp eax, 0x28
je 0x10003551
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebx + 0x1bc]
movzx edx, byte [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x100035f2
push 0
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
mov eax, dword [ebx + 0x1bc]
movzx ecx, byte [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x100035f2
mov eax, dword [ecx + 8]
cmp eax, 0x25
je 0x100035b0
cmp eax, 0x27
je 0x100035b0
cmp eax, 0x26
je 0x100035b0
cmp eax, 0x28
je 0x100035b0
push 0
push 2
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [ebx + 0x1bc]
push eax
movzx eax, byte [edx + 8]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x100035f2
push 0
push 3
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebx + 0x1bc]
movzx edx, byte [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x100035f2
push 0
push 0
push edi
push esi
push 0x8001
jmp 0x100036bc
sub eax, 0x201
cmp eax, 9
ja case.default.0x100035f2
jmp dword [eax*4 + 0x100036f4]
push 0
push 0
push edi
push esi
push 0x8002
jmp 0x100036bc
push 0
push 0
push edi
push esi
push 0x8004
jmp 0x100036bc
push 0
push 0
push edi
push esi
push 0x8008
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8010
jmp 0x100036bc
push 0
push 0
push edi
push esi
push 0x8006
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8006
jmp 0x100036bc
push 0
push 0
push edi
push esi
push 0x8018
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8018
jmp 0x100036bc
push 0
push 0
push edi
push esi
push 0x8020
jmp 0x100036bc
push 0
push 0
push edi
push esi
push 0x8040
jmp 0x100036bc
push 0
push 0
push edi
push esi
push 0x8060
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push edi
push esi
push 0x8060
jmp 0x100036bc
movsx eax, word [ecx + 0xa]
push 0
push eax
push edi
push esi
push 0x8800
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x1c]
jl 0x10003450
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4