Function at 0x1006bed0
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
sub esp, 0xc0
mov eax, dword [0x101ce00c]
xor eax, esp
mov dword [esp + 0xbc], eax
push ebp
push esi
mov esi, dword [esp + 0xcc]
push edi
mov edi, edx
mov eax, dword [edi + 0x32d4]
xor ebp, ebp
cmp eax, ebp
jne 0x1006bf26
mov eax, dword [esp + 0xd4]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_SendInput]
test al, al
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.101180ca
add esp, 0xc0
ret
cmp eax, 4
jne 0x1006c077
mov ah, ah
call fcn.10067ae0
test eax, eax
je 0x1006bffa
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
test dl, dl
mov edx, dword [esi]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebp
test edx, edx
mov eax, dword [esi]
cmp eax, 1
jne 0x1006bfb8
mov ax, word [esi + 4]
mov word [esp + 0x18], ax
test al, al
mov cx, word [esi + 6]
mov word [esp + 0x1a], cx
test ecx, ecx
mov edx, dword [esi + 8]
mov dword [esp + 0x1c], edx
mov bh, bh
mov eax, dword [esi + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
xchg ebx, eax
xchg ebx, eax
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebp
mov ebx, ebx
jmp 0x1006bffa
cmp eax, ebp
jne 0x1006bffa
mov edx, dword [esi + 4]
mov dword [esp + 0x18], edx
mov bl, bl
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov cl, cl
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x20], ecx
test ecx, ecx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x24], edx
push edx
pop edx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
mov eax, eax
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ebp
test dh, dh
mov esi, esi
mov dword [esp + 0xc], ebp
mov eax, eax
mov dword [esp + 0x38], 3
mov ebp, ebp
mov dword [esp + 0x3c], 1
test edi, edi
call fcn.10067ae0
test eax, eax
je 0x1006c02b
lea edx, [esp + 0x10]
mov dword [esp + 0x40], edx
test bh, bh
jmp 0x1006c031
mov dword [esp + 0x40], esi
push eax
pop eax
test cl, cl
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
test ecx, ecx
mov ch, ch
push 1
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebp
lea edx, [esp + 0x48]
push 0xc
push edx
call fcn.10024590
add esp, 0x18
test bh, bh
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.101180ca
add esp, 0xc0
ret
cmp eax, 1
push ebx
mov ebx, 3
je 0x1006c376
cmp eax, ebx
je 0x1006c376
cmp eax, 0xa
je 0x1006c376
cmp eax, 0xb
je 0x1006c376
cmp eax, 2
jne 0x1006c74b
mov dword [esp + 0x10], ebp
test ebx, ebx
mov dword [esp + 0x3c], ebx
test eax, eax
mov eax, dword [esi]
cmp eax, 1
jne 0x1006c19c
push ecx
pop ecx
mov ecx, ecx
mov dword [esp + 0x40], 7
mov ecx, ecx
movzx edx, word [esi + 4]
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0xc0]
push ecx
push edx
call fcn.10064470
add esp, 0xc
test eax, eax
je 0x1006c74b
test byte [esi + 8], 2
je 0x1006c14a
mov al, byte [esp + 0xc4]
test al, al
jbe 0x1006c74b
movzx esi, al
push esi
lea eax, [esp + 0xc9]
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.10119900
add esp, 0xc
test cl, cl
mov dword [esp + 0x44], esi
mov ebx, ebx
push 1
lea edx, [esp + 0x14]
push edx
push ebp
push ebp
add esi, 0xc
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.10024590
add esp, 0x18
test ch, ch
jmp 0x1006c74b
movzx esi, byte [esp + 0xbc]
push esi
lea ecx, [esp + 0xc1]
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.10119900
add esp, 0xc
test eax, 0x33e0
mov dword [esp + 0x44], esi
mov ah, ah
movzx ecx, byte [esp + 0xc4]
push 1
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
add ecx, 0xc
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.10024590
add esp, 0x18
mov ecx, ecx
jmp 0x1006c74b
cmp eax, ebp
jne 0x1006c74b
test edx, edx
xor ebp, ebp
test esi, esi
mov dword [esp + 0x40], 8
mov edx, edx
test byte [esi + 0x10], 1
je 0x1006c1e5
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x5c]
push ecx
call fcn.1006bad0
add esp, 0x18
mov ebp, eax
mov ebx, ebx
test byte [esi + 0x10], 2
je 0x1006c210
test esi, esi
mov ch, ch
mov byte [esp + 0x48], 9
push ecx
pop ecx
mov byte [esp + 0x49], 0
test cl, cl
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov ah, ah
mov ebp, 4
mov edi, edi
test byte [esi + 0x10], 8
je 0x1006c23e
test esi, esi
mov ch, ch
mov byte [esp + 0x48], 0xa
test eax, 0x4405
mov byte [esp + 0x49], 0
test cl, cl
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov ah, ah
mov ebp, 4
mov edi, edi
test byte [esi + 0x10], 0x20
je 0x1006c268
test esi, esi
mov ch, ch
mov byte [esp + 0x48], 0xc
nop
mov byte [esp + 0x49], 0
test cl, cl
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov ah, ah
mov ebp, 4
test bl, bl
test dword [esi + 0x10], 0x800
je 0x1006c2d0
mov ebx, dword [esi + 0xc]
test esi, esi
mov ch, ch
test ebx, ebx
mov byte [esp + 0x48], 8
je 0x1006c2b7
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebp
test ax, ax
je 0x1006c297
or byte [esp + 0x48], 1
push ebx
pop ebx
push 2
call ebp
test ax, ax
je 0x1006c2a7
or byte [esp + 0x48], 2
test ah, ah
push 4
call ebp
test ax, ax
je 0x1006c2b7
or byte [esp + 0x48], 4
test edx, edx
mov byte [esp + 0x49], 0
test cl, cl
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], bl
mov ah, ah
mov ebp, 4
test cl, cl
test byte [esi + 0x10], 1
jne 0x1006c2fd
test ebp, ebp
jne 0x1006c2fd
test esi, esi
mov ch, ch
mov byte [esp + 0x48], 8
mov byte [esp + 0x49], 0
test cl, cl
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov ah, ah
mov ebp, 4
mov cl, cl
mov dword [esp + 0x44], ebp
test eax, 0x3eb1
test byte [esi + 0x10], 1
je 0x1006c353
cmp dword [edi + 0x32f8], 0
je 0x1006c353
mov eax, dword [edi + 0x37c8]
cmp eax, 0x398
jae 0x1006c353
push ebp
lea edx, [esp + 0x4c]
push edx
lea eax, [edi + eax + 0x3378]
push eax
call fcn.10119900
add esp, 0xc
test edx, edx
mov dword [edi + 0x37cc], 4
mov ah, ah
add dword [edi + 0x37c8], ebp
mov bh, bh
jmp 0x1006c74b
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
add ebp, 0xc
lea edx, [esp + 0x4c]
push ebp
push edx
call fcn.10024590
add esp, 0x18
test ah, ah
jmp 0x1006c74b
test edi, edi
mov dword [esp + 0x3c], ebx
mov ch, ch
mov eax, dword [esi]
cmp eax, 1
jne 0x1006c5a9
mov eax, dword [edi + 0x32d4]
cmp eax, ebx
mov ebp, 2
mov edx, 0x10000
jne 0x1006c3a9
mov dword [esp + 0x40], 0x14
test bl, bl
jmp 0x1006c3cd
cmp eax, 0xa
jne 0x1006c3ba
mov dword [esp + 0x40], 0
mov al, al
jmp 0x1006c3cd
cmp eax, 0xb
jne 0x1006c3c7
mov dword [esp + 0x40], edx
mov ch, ch
jmp 0x1006c3cd
mov dword [esp + 0x40], ebp
xchg ebx, eax
xchg ebx, eax
mov ax, word [esi + 6]
mov word [esp + 0x44], ax
mov eax, dword [esi + 8]
test al, 1
je 0x1006c3ee
and al, 2
or al, 4
shr al, 1
movzx cx, al
mov word [esp + 0x46], cx
jmp 0x1006c406
test al, 2
je 0x1006c3fd
mov word [esp + 0x46], 1
test bl, bl
jmp 0x1006c406
mov word [esp + 0x46], 0
test cl, cl
movzx ecx, word [esi + 4]
cmp cx, 0x2c
jne 0x1006c4b4
mov eax, dword [esi + 8]
test al, 1
je 0x1006c4b4
test al, 2
je 0x1006c46a
mov word [esp + 0x44], 0x37
mov edi, edi
mov word [esp + 0x46], bx
test edi, edi
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006bdb0
test al, al
mov word [esp + 0x44], 0x2a
mov dh, dh
mov word [esp + 0x46], bx
test al, al
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006bdb0
mov esi, esi
jmp 0x1006c74b
mov word [esp + 0x44], 0x2a
push ecx
pop ecx
mov word [esp + 0x46], bp
mov ebp, ebp
xor esi, esi
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006bdb0
mov ebx, ebx
mov word [esp + 0x44], 0x37
test edx, edx
mov word [esp + 0x46], bp
mov al, al
lea edx, [esi + 0xc]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006bdb0
test eax, 0x2d8
jmp 0x1006c74b
cmp cx, 0x13
jne 0x1006c535
mov eax, dword [esi + 8]
test al, 1
je 0x1006c535
test al, 2
jne 0x1006c74b
mov ebp, 0x1d
mov word [esp + 0x44], bp
mov ecx, ecx
mov word [esp + 0x46], 4
test edi, edi
xor esi, esi
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006bdb0
test bh, bh
mov word [esp + 0x44], 0x45
push ebx
pop ebx
mov word [esp + 0x46], si
push ebx
pop ebx
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006bdb0
mov dh, dh
mov word [esp + 0x44], bp
push ebx
pop ebx
mov word [esp + 0x46], 5
push ecx
pop ecx
lea edx, [ebp - 0x11]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006bdb0
push ebx
pop ebx
jmp 0x1006c74b
test ebx, ebx
mov edi, dword [edi + 0x32d4]
cmp edi, 1
je 0x1006c586
cmp edi, ebx
je 0x1006c586
cmp edi, 0xa
jne 0x1006c568
mov dword [esp + 0x40], 0
test ah, ah
lea edx, [esp + 0x3c]
push 0xc
push edx
call fcn.10069e90
add esp, 8
mov al, al
jmp 0x1006c5a2
cmp edi, 0xb
jne 0x1006c5a2
mov dword [esp + 0x40], edx
test ch, ch
lea eax, [esp + 0x3c]
push 0xc
push eax
call fcn.10069e90
add esp, 8
test dl, dl
jmp 0x1006c5a2
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x4c]
push 0xc
push edx
call fcn.10024590
add esp, 0x18
mov edx, edx
test ah, ah
jmp 0x1006c74b
cmp eax, ebp
jne 0x1006c74b
push edx
pop edx
xor ecx, ecx
mov bh, bh
xor edx, edx
test al, al
xor ebp, ebp
mov bh, bh
xor ebx, ebx
test edx, edx
mov al, al
mov eax, dword [edi + 0x32d4]
cmp eax, 3
jne 0x1006c5dc
mov dword [esp + 0x40], 0x1e
mov dl, dl
jmp 0x1006c604
cmp eax, 0xa
jne 0x1006c5e9
mov dword [esp + 0x40], ecx
test al, al
jmp 0x1006c604
cmp eax, 0xb
jne 0x1006c5fa
mov dword [esp + 0x40], 0x10000
mov ebp, ebp
jmp 0x1006c604
mov dword [esp + 0x40], 3
mov ebx, ebx
test dword [esi + 0x10], 0x8000
je 0x1006c616
mov eax, 3
test edi, edi
jmp 0x1006c61a
xor eax, eax
mov bl, bl
test byte [esi + 0x10], 1
je 0x1006c62a
mov ebp, dword [esi + 4]
mov ebx, ebx
mov ebx, dword [esi + 8]
mov bh, bh
test byte [esi + 0x10], 2
je 0x1006c639
mov ecx, 1
mov esi, esi
mov bl, bl
test byte [esi + 0x10], 4
je 0x1006c644
or ecx, 2
test bh, bh
test byte [esi + 0x10], 8
je 0x1006c654
or ecx, 4
mov dl, dl
test eax, 0x78e2
test byte [esi + 0x10], 0x10
je 0x1006c662
or ecx, 8
test eax, 0x6f98
test byte [esi + 0x10], 0x20
je 0x1006c66f
or ecx, 0x10
test bh, bh
mov ah, ah
test byte [esi + 0x10], 0x40
je 0x1006c67a
or ecx, 0x20
mov al, al
test dword [esi + 0x10], 0x800
je 0x1006c691
or ecx, 0x400
mov edi, edi
movzx edx, word [esi + 0xc]
push ebx
pop ebx
mov word [esp + 0x44], ax
test ch, ch
mov word [esp + 0x46], cx
test bh, bh
mov word [esp + 0x48], dx
mov edx, edx
test eax, 0x5eef
mov dword [esp + 0x4a], ebp
mov al, al
mov dword [esp + 0x4e], ebx
push edx
pop edx
cmp dword [edi + 0x32f8], 0
je 0x1006c735
mov eax, dword [edi + 0x3358]
cmp eax, 6
jae 0x1006c735
mov cx, word [esp + 0x44]
mov word [edi + eax*2 + 0x3304], cx
test dh, dh
mov edx, dword [edi + 0x3358]
mov ax, word [esp + 0x46]
mov word [edi + edx*2 + 0x3310], ax
test ebx, ebx
mov ecx, dword [edi + 0x3358]
mov dx, word [esp + 0x48]
mov word [edi + ecx*2 + 0x331c], dx
test dh, dh
mov eax, dword [edi + 0x3358]
mov ecx, dword [esp + 0x4a]
mov dword [edi + eax*4 + 0x3328], ecx
mov edi, edi
mov edx, dword [edi + 0x3358]
mov eax, dword [esp + 0x4e]
mov dword [edi + edx*4 + 0x3340], eax
test dh, dh
add dword [edi + 0x3358], 1
test al, al
jmp 0x1006c74b
mov bh, bh
push eax
pop eax
xor esi, esi
lea edx, [esi + 0x16]
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.1006be40
test ah, ah
mov ecx, dword [esp + 0xcc]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.101180ca
add esp, 0xc0
ret