Function at 0x5009eecd
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x4d8
mov eax, dword [0x5029a6e4]
push ebx
xor ebx, ebx
push esi
push edi
lea ecx, [ebp - 0x478]
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x30], ebx
call fcn.500a785c
lea eax, [ebp + 0x54]
push eax
mov eax, 0x5002a174
push eax
push eax
mov dword [ebp + 0x34], ebx
call fcn.501a5bb0
mov esi, eax
cmp esi, ebx
jl 0x5009f569
cmp dword [ebp + 0x54], ebx
je 0x5009f3e6
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp + 0x38]
push eax
mov dword [ebp + 0x18], ebx
call fcn.5019e0ec
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [0x5029a6e4]
mov ecx, dword [ebp + 0x70]
cmp ecx, ebx
mov edi, dword [ebp + 0x78]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x6c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x478]
mov dword [ebp], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x20], ecx
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x28], ebx
je 0x5009efa0
mov eax, dword [ecx]
lea edx, [ebp + 0x28]
push edx
push 0x5002a064
push ecx
call dword [eax]
jmp 0x5009efb2
cmp eax, ebx
je 0x5009efb2
mov ecx, dword [eax]
lea edx, [ebp + 0x28]
push edx
push 0x5002a064
push eax
call dword [ecx]
lea eax, [ebp - 8]
mov dword [0x5028e8b4], eax
lea eax, [ebp + 0x5c]
push eax
call dword [0x5029af38]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
je 0x5009f3e6
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x14]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x12c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x118]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x34]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x204]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x3c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
neg edi
sbb edi, edi
and edi, 0x6f
add edi, 0x335e
mov esi, edi
push esi
call fcn.5005698e
shr eax, 0x10
test ax, ax
push esi
je 0x5009f0cf
call fcn.5005698e
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.50260700
mov edi, esp
push esi
call fcn.5005698e
push eax
push edi
call fcn.5024c7db
jmp 0x5009f0d4
call fcn.5005698e
mov ecx, dword [ebp + 0x5c]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x74]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
push dword [ebp + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
lea edx, [ebp + 0x50]
push edx
push eax
call dword [ecx + 0xc8]
cmp dword [ebp + 0x50], ebx
je 0x5009f3e6
mov eax, dword [ebp + 0x70]
cmp eax, ebx
je 0x5009f19d
mov ecx, dword [eax]
lea edx, [ebp + 0x40]
push edx
push eax
call dword [ecx + 0x28]
test eax, eax
jl 0x5009f19d
mov esi, dword [ebp + 0x40]
cmp esi, ebx
je 0x5009f19d
cmp word [esi], bx
mov eax, esi
je 0x5009f14d
cmp word [eax], 0xa
jne 0x5009f146
mov word [eax], bx
mov esi, dword [ebp + 0x40]
inc eax
inc eax
cmp word [eax], bx
jne 0x5009f13a
cmp esi, ebx
je 0x5009f19d
cmp word [esi], bx
je 0x5009f194
mov eax, dword [ebp + 0x50]
mov ecx, dword [eax]
push ebx
push esi
push eax
call dword [ecx + 0x18]
push 0x5000a69c
push esi
call dword [sym.imp.MSVCR70.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x5009f17a
mov dword [ebp + 0x34], 1
mov edi, dword [sym.imp.MSVCR70.dll_wcslen]
push esi
call edi
lea esi, [esi + eax*2 + 2]
push esi
call edi
lea esi, [esi + eax*2 + 2]
cmp esi, ebx
pop ecx
pop ecx
jne 0x5009f151
cmp dword [ebp + 0x34], ebx
jne 0x5009f23e
mov esi, 0x32e0
push esi
call fcn.5005698e
shr eax, 0x10
test ax, ax
push esi
je 0x5009f1e2
call fcn.5005698e
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.50260700
mov edi, esp
push esi
call fcn.5005698e
push eax
push edi
call fcn.5024c7db
jmp 0x5009f1e7
call fcn.5005698e
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.MSVCR70.dll_wcscpy]
cmp word [ebp - 0x58], bx
pop ecx
pop ecx
lea eax, [ebp - 0x58]
je 0x5009f20d
cmp word [eax], 0x3b
jne 0x5009f206
mov word [eax], bx
inc eax
inc eax
cmp word [eax], bx
jne 0x5009f1fd
mov word [eax + 2], bx
lea edi, [ebp - 0x58]
cmp word [edi], bx
je 0x5009f23e
mov eax, dword [ebp + 0x50]
mov ecx, dword [eax]
push ebx
push edi
push eax
call dword [ecx + 0x18]
mov esi, dword [sym.imp.MSVCR70.dll_wcslen]
push edi
call esi
lea edi, [edi + eax*2 + 2]
push edi
call esi
lea edi, [edi + eax*2 + 2]
cmp edi, ebx
pop ecx
pop ecx
jne 0x5009f214
mov eax, dword [ebp + 0x70]
cmp eax, ebx
je 0x5009f255
mov ecx, dword [eax]
lea edx, [ebp + 0x30]
push edx
lea edx, [ebp + 0x4c]
push edx
push eax
call dword [ecx + 0x24]
jmp 0x5009f266
mov eax, dword [ebp + 0x74]
cmp eax, ebx
je 0x5009f266
mov ecx, dword [eax]
lea edx, [ebp + 0x4c]
push edx
push eax
call dword [ecx + 0x20]
mov eax, dword [ebp + 0x4c]
cmp eax, ebx
jne 0x5009f275
mov ecx, dword [ebp + 0x68]
call fcn.500a70fc
mov ecx, dword [ebp]
push eax
call fcn.500a6e2f
mov ecx, dword [ebp + 0x68]
call fcn.500a70fc
test eax, eax
je 0x5009f294
mov ecx, dword [ebp + 0x68]
call fcn.500a70fc
jmp 0x5009f297
mov eax, dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x5c]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x54]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
push dword [ebp + 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc0]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x6c]
mov esi, dword [eax]
call fcn.500a70fc
push eax
push dword [ebp + 0x5c]
call dword [esi + 0xb8]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
lea edx, [ebp + 0x58]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [ebp + 0x58]
cmp eax, ebx
je 0x5009f3e6
mov ecx, dword [eax]
push ebx
push 0xc
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax]
push ebx
push 0xc
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax]
push ebx
push 0xd
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax]
push ebx
push 0xd
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax]
push ebx
push 0xf
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax]
push ebx
push 0xf
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax]
push ebx
push 0x11
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax]
push ebx
push 0x11
push eax
call dword [ecx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
lea edx, [ebp + 0x44]
push edx
push eax
call dword [ecx + 0xcc]
cmp dword [ebp + 0x44], ebx
je 0x5009f3e6
cmp dword [ebp + 0x28], ebx
je 0x5009f481
lea eax, [ebp + 0x48]
push eax
call dword [0x5029af34]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jne 0x5009f3f0
mov esi, 0x8007000e
jmp 0x5009f569
mov ecx, dword [eax]
push 0xa
push eax
call dword [ecx + 0x14]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov esi, 0x3616
push esi
call fcn.5005698e
shr eax, 0x10
test ax, ax
push esi
je 0x5009f447
call fcn.5005698e
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.50260700
mov edi, esp
push esi
call fcn.5005698e
push eax
push edi
call fcn.5024c7db
jmp 0x5009f44c
call fcn.5005698e
mov ecx, dword [ebp + 0x48]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x44]
push dword [ebp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x48]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x110]
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
push ebx
push 0x5009e4a1
push eax
call dword [ecx + 0x90]
push ebx
push 0x500541fa
call dword [0x5029af28]
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
push dword [0x5029a6cc]
push 0x5009e41b
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x54]
mov ecx, dword [eax]
lea edx, [ebp + 0x3c]
push edx
push eax
call dword [ecx + 0x28]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
mov eax, dword [ebp + 0x5c]
push dword [ebp + 0x3c]
mov dword [0x5028e8c0], eax
call fcn.50272bbe
mov eax, dword [ebp + 0x54]
push ebx
mov dword [0x5028e8c0], ebx
mov dword [0x5028e8bc], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
push dword [ebp + 0x3c]
mov eax, dword [ebp + 0x5c]
mov ecx, dword [eax]
lea edx, [ebp + 0x2c]
push edx
push eax
call dword [ecx + 0x88]
mov edi, eax
mov eax, dword [ebp + 0x54]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x5009f569
cmp edi, ebx
mov esi, edi
jl 0x5009f569
mov eax, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x7c]
mov esi, dword [0x5028e8bc]
xor ecx, ecx
and eax, 0xff
cmp eax, 1
sete cl
cmp eax, 2
mov dword [0x5028e8b0], ebx
mov dword [edx], ecx
je 0x5009f569
cmp eax, 4
je 0x5009f569
mov esi, 0x8004000c
cmp dword [ebp + 0x18], ebx
je 0x5009f577
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 0x54]
cmp eax, ebx
je 0x5009f591
mov dword [ebp + 0x54], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
je 0x5009f5a1
mov dword [ebp + 0x5c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x50]
cmp eax, ebx
je 0x5009f5b1
mov dword [ebp + 0x50], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x58]
cmp eax, ebx
je 0x5009f5c1
mov dword [ebp + 0x58], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x44]
cmp eax, ebx
je 0x5009f5d1
mov dword [ebp + 0x44], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x28]
cmp eax, ebx
je 0x5009f5e1
mov dword [ebp + 0x28], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp + 0x38]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp + 0x40], ebx
je 0x5009f5fd
mov eax, dword [0x50297b30]
push dword [ebp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [ebp + 0x4c], ebx
je 0x5009f610
mov eax, dword [0x50297b30]
push dword [ebp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [ebp + 0x10], ebx
jne 0x5009f61b
push ebx
call fcn.50272bbe
push 1
call fcn.50272bbe
lea ecx, [ebp - 0x478]
mov dword [0x5028e8b4], ebx
call fcn.501b7afc
mov eax, esi
lea esp, [ebp - 0x484]
pop edi
pop esi
pop ebx
add ebp, 0x60
leave
ret 0x18