Function at 0x100f5010
Capabilities:
Log keystrokes via polling
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c3f00
call fcn.1011c410
cmp dword [ebp + 8], 0
je 0x100f5b1e
mov esi, esp
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f506b
mov eax, dword [ebp + 8]
mov dword [eax], 0x20
jmp 0x100f5b1e
mov esi, esp
push 0xd
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5092
mov eax, dword [ebp + 8]
mov dword [eax], 0xd
jmp 0x100f5b1e
mov esi, esp
push 9
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f50b9
mov eax, dword [ebp + 8]
mov dword [eax], 9
jmp 0x100f5b1e
mov esi, esp
push 0x26
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f50e0
mov eax, dword [ebp + 8]
mov dword [eax], 0x80
jmp 0x100f5b1e
mov esi, esp
push 0x28
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5107
mov eax, dword [ebp + 8]
mov dword [eax], 0x81
jmp 0x100f5b1e
mov esi, esp
push 0x25
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f512e
mov eax, dword [ebp + 8]
mov dword [eax], 0x82
jmp 0x100f5b1e
mov esi, esp
push 0x27
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5155
mov eax, dword [ebp + 8]
mov dword [eax], 0x83
jmp 0x100f5b1e
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f517c
mov eax, dword [ebp + 8]
mov dword [eax], 0x84
jmp 0x100f5b1e
mov esi, esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f51a3
mov eax, dword [ebp + 8]
mov dword [eax], 0x85
jmp 0x100f5b1e
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f51ca
mov eax, dword [ebp + 8]
mov dword [eax], 0x86
jmp 0x100f5b1e
mov esi, esp
push 0x70
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f51f1
mov eax, dword [ebp + 8]
mov dword [eax], 0x87
jmp 0x100f5b1e
mov esi, esp
push 0x71
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5218
mov eax, dword [ebp + 8]
mov dword [eax], 0x88
jmp 0x100f5b1e
mov esi, esp
push 0x72
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f523f
mov eax, dword [ebp + 8]
mov dword [eax], 0x89
jmp 0x100f5b1e
mov esi, esp
push 0x73
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5266
mov eax, dword [ebp + 8]
mov dword [eax], 0x8a
jmp 0x100f5b1e
mov esi, esp
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f528d
mov eax, dword [ebp + 8]
mov dword [eax], 0x8b
jmp 0x100f5b1e
mov esi, esp
push 0x75
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f52b4
mov eax, dword [ebp + 8]
mov dword [eax], 0x8c
jmp 0x100f5b1e
mov esi, esp
push 0x76
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f52db
mov eax, dword [ebp + 8]
mov dword [eax], 0x8d
jmp 0x100f5b1e
mov esi, esp
push 0x77
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5302
mov eax, dword [ebp + 8]
mov dword [eax], 0x8e
jmp 0x100f5b1e
mov esi, esp
push 0x78
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5329
mov eax, dword [ebp + 8]
mov dword [eax], 0x8f
jmp 0x100f5b1e
mov esi, esp
push 0x79
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5350
mov eax, dword [ebp + 8]
mov dword [eax], 0x90
jmp 0x100f5b1e
mov esi, esp
push 0x7a
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5377
mov eax, dword [ebp + 8]
mov dword [eax], 0x91
jmp 0x100f5b1e
mov esi, esp
push 0x7b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f539e
mov eax, dword [ebp + 8]
mov dword [eax], 0x92
jmp 0x100f5b1e
mov esi, esp
push 0x22
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f53c5
mov eax, dword [ebp + 8]
mov dword [eax], 0x95
jmp 0x100f5b1e
mov esi, esp
push 0x21
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f53ec
mov eax, dword [ebp + 8]
mov dword [eax], 0x96
jmp 0x100f5b1e
mov esi, esp
push 0x24
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5413
mov eax, dword [ebp + 8]
mov dword [eax], 0x97
jmp 0x100f5b1e
mov esi, esp
push 0x23
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f543a
mov eax, dword [ebp + 8]
mov dword [eax], 0x98
jmp 0x100f5b1e
mov esi, esp
push 0x51
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5461
mov eax, dword [ebp + 8]
mov dword [eax], 0x71
jmp 0x100f5b1e
mov esi, esp
push 0x57
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5488
mov eax, dword [ebp + 8]
mov dword [eax], 0x77
jmp 0x100f5b1e
mov esi, esp
push 0x45
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f54af
mov eax, dword [ebp + 8]
mov dword [eax], 0x65
jmp 0x100f5b1e
mov esi, esp
push 0x52
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f54d6
mov eax, dword [ebp + 8]
mov dword [eax], 0x72
jmp 0x100f5b1e
mov esi, esp
push 0x54
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f54fd
mov eax, dword [ebp + 8]
mov dword [eax], 0x74
jmp 0x100f5b1e
mov esi, esp
push 0x59
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5524
mov eax, dword [ebp + 8]
mov dword [eax], 0x79
jmp 0x100f5b1e
mov esi, esp
push 0x55
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f554b
mov eax, dword [ebp + 8]
mov dword [eax], 0x75
jmp 0x100f5b1e
mov esi, esp
push 0x49
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5572
mov eax, dword [ebp + 8]
mov dword [eax], 0x69
jmp 0x100f5b1e
mov esi, esp
push 0x4f
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5599
mov eax, dword [ebp + 8]
mov dword [eax], 0x6f
jmp 0x100f5b1e
mov esi, esp
push 0x50
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f55c0
mov eax, dword [ebp + 8]
mov dword [eax], 0x70
jmp 0x100f5b1e
mov esi, esp
push 0xdb
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f55ea
mov eax, dword [ebp + 8]
mov dword [eax], 0x5b
jmp 0x100f5b1e
mov esi, esp
push 0xdd
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5614
mov eax, dword [ebp + 8]
mov dword [eax], 0x5d
jmp 0x100f5b1e
mov esi, esp
push 0x41
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f563b
mov eax, dword [ebp + 8]
mov dword [eax], 0x61
jmp 0x100f5b1e
mov esi, esp
push 0x53
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5662
mov eax, dword [ebp + 8]
mov dword [eax], 0x73
jmp 0x100f5b1e
mov esi, esp
push 0x44
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5689
mov eax, dword [ebp + 8]
mov dword [eax], 0x64
jmp 0x100f5b1e
mov esi, esp
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f56b0
mov eax, dword [ebp + 8]
mov dword [eax], 0x66
jmp 0x100f5b1e
mov esi, esp
push 0x47
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f56d7
mov eax, dword [ebp + 8]
mov dword [eax], 0x67
jmp 0x100f5b1e
mov esi, esp
push 0x48
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f56fe
mov eax, dword [ebp + 8]
mov dword [eax], 0x68
jmp 0x100f5b1e
mov esi, esp
push 0x4a
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5725
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a
jmp 0x100f5b1e
mov esi, esp
push 0x4b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f574c
mov eax, dword [ebp + 8]
mov dword [eax], 0x6b
jmp 0x100f5b1e
mov esi, esp
push 0x4c
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5773
mov eax, dword [ebp + 8]
mov dword [eax], 0x6c
jmp 0x100f5b1e
mov esi, esp
push 0x5a
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f579a
mov eax, dword [ebp + 8]
mov dword [eax], 0x7a
jmp 0x100f5b1e
mov esi, esp
push 0x58
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f57c1
mov eax, dword [ebp + 8]
mov dword [eax], 0x78
jmp 0x100f5b1e
mov esi, esp
push 0x43
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f57e8
mov eax, dword [ebp + 8]
mov dword [eax], 0x63
jmp 0x100f5b1e
mov esi, esp
push 0x56
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f580f
mov eax, dword [ebp + 8]
mov dword [eax], 0x76
jmp 0x100f5b1e
mov esi, esp
push 0x42
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5836
mov eax, dword [ebp + 8]
mov dword [eax], 0x62
jmp 0x100f5b1e
mov esi, esp
push 0x4e
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f585d
mov eax, dword [ebp + 8]
mov dword [eax], 0x6e
jmp 0x100f5b1e
mov esi, esp
push 0x4d
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5884
mov eax, dword [ebp + 8]
mov dword [eax], 0x6d
jmp 0x100f5b1e
mov esi, esp
push 0xbc
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f58ae
mov eax, dword [ebp + 8]
mov dword [eax], 0x2c
jmp 0x100f5b1e
mov esi, esp
push 0xbe
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f58d8
mov eax, dword [ebp + 8]
mov dword [eax], 0x2e
jmp 0x100f5b1e
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f58ff
mov eax, dword [ebp + 8]
mov dword [eax], 0xf1
jmp 0x100f5b1e
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5926
mov eax, dword [ebp + 8]
mov dword [eax], 0xf2
jmp 0x100f5b1e
mov esi, esp
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f594d
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3
jmp 0x100f5b1e
mov esi, esp
push 5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5974
mov eax, dword [ebp + 8]
mov dword [eax], 0xf4
jmp 0x100f5b1e
mov esi, esp
push 6
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f599b
mov eax, dword [ebp + 8]
mov dword [eax], 0xf5
jmp 0x100f5b1e
mov esi, esp
push 0x30
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f59c2
mov eax, dword [ebp + 8]
mov dword [eax], 0x30
jmp 0x100f5b1e
mov esi, esp
push 0x31
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f59e9
mov eax, dword [ebp + 8]
mov dword [eax], 0x31
jmp 0x100f5b1e
mov esi, esp
push 0x32
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5a10
mov eax, dword [ebp + 8]
mov dword [eax], 0x32
jmp 0x100f5b1e
mov esi, esp
push 0x33
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5a37
mov eax, dword [ebp + 8]
mov dword [eax], 0x33
jmp 0x100f5b1e
mov esi, esp
push 0x34
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5a5e
mov eax, dword [ebp + 8]
mov dword [eax], 0x34
jmp 0x100f5b1e
mov esi, esp
push 0x35
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5a85
mov eax, dword [ebp + 8]
mov dword [eax], 0x35
jmp 0x100f5b1e
mov esi, esp
push 0x36
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5aa9
mov eax, dword [ebp + 8]
mov dword [eax], 0x36
jmp 0x100f5b1e
mov esi, esp
push 0x37
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5acd
mov eax, dword [ebp + 8]
mov dword [eax], 0x37
jmp 0x100f5b1e
mov esi, esp
push 0x38
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5af1
mov eax, dword [ebp + 8]
mov dword [eax], 0x38
jmp 0x100f5b1e
mov esi, esp
push 0x39
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1011c3e0
cwde
and eax, 0x8000
je 0x100f5b15
mov eax, dword [ebp + 8]
mov dword [eax], 0x39
jmp 0x100f5b1e
mov eax, dword [ebp + 8]
mov dword [eax], 0
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4