Function at 0x10066580
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [edi + 0x32d0]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, edx
jne 0x100665cd
mov eax, dword [esp + 0xcc]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
test eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
cmp eax, 4
jne 0x10066726
test dl, dl
call fcn.10062980
test eax, eax
je 0x100666aa
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dh, dh
mov edx, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
push edx
pop edx
mov eax, dword [esi]
cmp eax, 1
jne 0x10066665
mov ax, word [esi + 4]
mov word [esp + 0x14], ax
test ch, ch
mov cx, word [esi + 6]
mov word [esp + 0x16], cx
mov ch, ch
mov edx, dword [esi + 8]
mov dword [esp + 0x18], edx
test eax, 0x1612
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov esi, esi
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
test eax, 0x52d3
jmp 0x100666aa
cmp eax, ebx
jne 0x100666aa
mov edx, dword [esi + 4]
mov dword [esp + 0x14], edx
test ebx, ebx
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
test dh, dh
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
test dh, dh
mov edx, dword [esi + 0x10]
mov dword [esp + 0x20], edx
mov eax, eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
test edx, edx
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
test eax, 0x66c5
mov bl, bl
mov dword [esp + 8], ebx
test dh, dh
mov dword [esp + 0x34], 3
test ecx, ecx
mov dword [esp + 0x38], 1
push eax
pop eax
call fcn.10062980
test eax, eax
je 0x100666db
lea edx, [esp + 0xc]
mov dword [esp + 0x3c], edx
test bh, bh
jmp 0x100666e1
mov dword [esp + 0x3c], esi
mov bl, bl
mov bh, bh
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov al, al
mov al, al
push 1
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
lea edx, [esp + 0x44]
push 0xc
push edx
call fcn.10020b00
add esp, 0x18
test cl, cl
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
cmp eax, 1
push ebp
mov ebp, 3
je 0x10066a70
cmp eax, ebp
je 0x10066a70
cmp eax, 0xa
je 0x10066a70
cmp eax, 0xb
je 0x10066a70
cmp eax, 2
jne 0x10066e57
mov dword [esp + 0xc], ebx
xchg ebx, eax
xchg ebx, eax
mov dword [esp + 0x38], ebp
mov ebx, ebx
mov eax, dword [esi]
cmp eax, 1
jne 0x1006686e
test al, al
mov ebx, ebx
mov dword [esp + 0x3c], 7
mov ebx, ebx
movzx edx, word [esi + 4]
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0xbc]
push ecx
push edx
call fcn.1005f030
add esp, 0xc
test eax, eax
je 0x10066e57
test byte [esi + 8], 2
je 0x1006680c
mov al, byte [esp + 0xc0]
test al, al
jbe 0x10066e57
movzx esi, al
push esi
lea eax, [esp + 0xc5]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.10102690
add esp, 0xc
mov bl, bl
mov dword [esp + 0x40], esi
test cl, cl
push 1
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
add esi, 0xc
lea eax, [esp + 0x48]
push esi
push eax
call fcn.10020b00
add esp, 0x18
test ecx, ecx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
movzx esi, byte [esp + 0xb8]
push esi
lea ecx, [esp + 0xbd]
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.10102690
add esp, 0xc
push ebx
pop ebx
mov dword [esp + 0x40], esi
test ch, ch
movzx ecx, byte [esp + 0xc0]
push 1
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
add ecx, 0xc
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.10020b00
add esp, 0x18
mov ch, ch
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
cmp eax, ebx
jne 0x10066e57
test ebx, ebx
xor ebp, ebp
mov ebp, ebp
mov dword [esp + 0x3c], 8
mov ch, ch
test byte [esi + 0x10], 1
je 0x100668b7
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.10066180
add esp, 0x18
mov ebp, eax
test eax, eax
test byte [esi + 0x10], 2
je 0x100668e2
test bl, bl
push ecx
pop ecx
mov byte [esp + 0x44], 9
test bh, bh
mov byte [esp + 0x45], bl
mov dl, dl
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
test eax, 0x48e1
mov ebp, 4
test dl, dl
test byte [esi + 0x10], 8
je 0x1006690d
test bl, bl
push ecx
pop ecx
mov byte [esp + 0x44], 0xa
mov cl, cl
mov byte [esp + 0x45], bl
mov dl, dl
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
test eax, 0x48e1
mov ebp, 4
test bh, bh
test byte [esi + 0x10], 0x20
je 0x10066938
test bl, bl
push ecx
pop ecx
mov byte [esp + 0x44], 0xc
push eax
pop eax
mov byte [esp + 0x45], bl
mov dl, dl
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
test eax, 0x48e1
mov ebp, 4
mov dl, dl
test dword [esi + 0x10], 0x800
je 0x100669a5
mov ebx, dword [esi + 0xc]
test bl, bl
push ecx
pop ecx
test ebx, ebx
mov byte [esp + 0x44], 8
je 0x10066987
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x10066967
or byte [esp + 0x44], 1
test ebx, ebx
push 2
call ebp
test ax, ax
je 0x10066977
or byte [esp + 0x44], 2
push edx
pop edx
push 4
call ebp
test ax, ax
je 0x10066987
or byte [esp + 0x44], 4
test edx, edx
mov byte [esp + 0x45], 0
mov dl, dl
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], bl
test eax, 0x48e1
mov ebp, 4
mov ebp, ebp
xor ebx, ebx
test byte [esi + 0x10], 1
jne 0x100669d5
cmp ebp, ebx
jne 0x100669d5
test bl, bl
push ecx
pop ecx
mov byte [esp + 0x44], 8
mov byte [esp + 0x45], 0
mov dl, dl
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
test eax, 0x48e1
mov ebp, 4
mov eax, eax
mov dword [esp + 0x40], ebp
test eax, 0x6953
test byte [esi + 0x10], 1
je 0x10066a3c
cmp dword [edi + 0x32f4], ebx
je 0x10066a3c
mov eax, dword [edi + 0x37c4]
cmp eax, 0x398
jae 0x10066a3c
push ebp
lea edx, [esp + 0x48]
push edx
lea eax, [edi + eax + 0x3374]
push eax
call fcn.10102690
add esp, 0xc
push eax
pop eax
mov dword [edi + 0x37c8], 4
nop
add dword [edi + 0x37c4], ebp
test eax, eax
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
push 1
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
add ebp, 0xc
lea edx, [esp + 0x48]
push ebp
push edx
call fcn.10020b00
add esp, 0x18
test al, al
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
push edx
pop edx
mov dword [esp + 0x38], ebp
mov ah, ah
mov eax, dword [esi]
cmp eax, 1
jne 0x10066c97
mov eax, dword [edi + 0x32d0]
cmp eax, ebp
mov ebx, 2
jne 0x10066a9e
mov dword [esp + 0x3c], 0x14
test ch, ch
jmp 0x10066ac6
cmp eax, 0xa
jne 0x10066aaf
mov dword [esp + 0x3c], 0
test bh, bh
jmp 0x10066ac6
cmp eax, 0xb
jne 0x10066ac0
mov dword [esp + 0x3c], 0x10000
mov cl, cl
jmp 0x10066ac6
mov dword [esp + 0x3c], ebx
test ebx, ebx
mov ax, word [esi + 6]
mov word [esp + 0x40], ax
mov eax, dword [esi + 8]
test al, 1
je 0x10066ae7
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x42], cx
jmp 0x10066afe
test al, 2
je 0x10066af5
mov word [esp + 0x42], 1
nop
jmp 0x10066afe
mov word [esp + 0x42], 0
test edi, edi
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x10066bce
mov eax, dword [esi + 8]
test al, 1
je 0x10066bce
test al, 2
je 0x10066b75
mov word [esp + 0x40], 0x37
test dl, dl
mov word [esp + 0x42], bp
test ecx, ecx
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10066460
test esi, esi
mov word [esp + 0x40], 0x2a
mov ebp, ebp
mov word [esp + 0x42], bp
mov ah, ah
lea edx, [esi + 0xc]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10066460
mov al, al
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
mov word [esp + 0x40], 0x2a
mov ah, ah
mov word [esp + 0x42], bx
mov ah, ah
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10066460
test al, al
mov word [esp + 0x40], 0x37
test edi, edi
mov word [esp + 0x42], bx
nop
lea edx, [esi + 0xc]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10066460
test ch, ch
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
cmp cx, 0x13
jne 0x10066c6a
mov eax, dword [esi + 8]
test al, 1
je 0x10066c6a
test al, 2
jne 0x10066e57
mov ebp, 0x1d
mov word [esp + 0x40], bp
push ecx
pop ecx
mov word [esp + 0x42], 4
push ebx
pop ebx
xor esi, esi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10066460
push ebx
pop ebx
mov word [esp + 0x40], 0x45
mov dl, dl
mov word [esp + 0x42], si
mov ebx, ebx
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10066460
push ecx
pop ecx
mov word [esp + 0x40], bp
test ebx, ebx
mov word [esp + 0x42], 5
push edx
pop edx
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10066460
test edx, edx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.10066460
test eax, 0x4f1a
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
cmp eax, ebx
jne 0x10066e57
test edx, edx
xor ecx, ecx
test bl, bl
xor edx, edx
mov al, al
xor ebp, ebp
push eax
pop eax
xor ebx, ebx
test al, al
mov eax, eax
mov eax, dword [edi + 0x32d0]
cmp eax, 3
jne 0x10066cca
mov dword [esp + 0x3c], 0x1e
mov ch, ch
jmp 0x10066cf2
cmp eax, 0xa
jne 0x10066cd7
mov dword [esp + 0x3c], ecx
push ecx
pop ecx
jmp 0x10066cf2
cmp eax, 0xb
jne 0x10066ce8
mov dword [esp + 0x3c], 0x10000
test ch, ch
jmp 0x10066cf2
mov dword [esp + 0x3c], 3
push ecx
pop ecx
test dword [esi + 0x10], 0x8000
je 0x10066d04
mov eax, 3
mov esi, esi
jmp 0x10066d08
xor eax, eax
mov edi, edi
test byte [esi + 0x10], 1
je 0x10066d18
mov ebp, dword [esi + 4]
xchg ebx, eax
xchg ebx, eax
mov ebx, dword [esi + 8]
test dh, dh
test byte [esi + 0x10], 2
je 0x10066d2a
mov ecx, 1
mov bh, bh
test eax, 0x175e
test byte [esi + 0x10], 4
je 0x10066d35
or ecx, 2
push ecx
pop ecx
test byte [esi + 0x10], 8
je 0x10066d42
or ecx, 4
test edi, edi
mov cl, cl
test byte [esi + 0x10], 0x10
je 0x10066d4d
or ecx, 8
test cl, cl
test byte [esi + 0x10], 0x20
je 0x10066d5a
or ecx, 0x10
push eax
pop eax
push eax
pop eax
test byte [esi + 0x10], 0x40
je 0x10066d68
or ecx, 0x20
test eax, 0x4abd
test dword [esi + 0x10], 0x800
je 0x10066d82
or ecx, 0x400
mov edx, edx
movzx edx, word [esi + 0xc]
test eax, 0x679e
mov word [esp + 0x40], ax
test esi, esi
mov word [esp + 0x42], cx
test al, al
mov word [esp + 0x44], dx
mov eax, eax
test al, al
mov dword [esp + 0x46], ebp
push ecx
pop ecx
mov dword [esp + 0x4a], ebx
push ecx
pop ecx
cmp dword [edi + 0x32f4], 0
je 0x10066e41
mov eax, dword [edi + 0x3354]
cmp eax, 6
jae 0x10066e41
mov dx, word [esp + 0x40]
mov word [edi + eax*2 + 0x3300], dx
test ecx, ecx
mov eax, dword [edi + 0x3354]
mov cx, word [esp + 0x42]
mov word [edi + eax*2 + 0x330c], cx
xchg ebx, eax
xchg ebx, eax
mov edx, dword [edi + 0x3354]
mov ax, word [esp + 0x44]
mov word [edi + edx*2 + 0x3318], ax
mov cl, cl
mov ecx, dword [edi + 0x3354]
mov edx, dword [esp + 0x46]
mov dword [edi + ecx*4 + 0x3324], edx
mov dh, dh
mov eax, dword [edi + 0x3354]
mov ecx, dword [esp + 0x4a]
mov dword [edi + eax*4 + 0x333c], ecx
mov dh, dh
add dword [edi + 0x3354], 1
push ecx
pop ecx
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret
test ebx, ebx
test edx, edx
xor esi, esi
lea edx, [esi + 0x16]
lea ecx, [esp + 0x38]
mov eax, edi
call fcn.100664f0
test bh, bh
mov ecx, dword [esp + 0xc8]
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.1010190d
add esp, 0xc0
ret