Function at 0x1000f280
Capabilities:
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10085b78
push 0x1006cc4c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10088400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
call fcn.10011390
call fcn.10010fa0
call fcn.10011180
call fcn.10011ab0
call fcn.10010d20
call fcn.10011a00
call fcn.10010c90
call fcn.10010450
call fcn.10011930
call fcn.1000f930
call fcn.10010ea0
call fcn.100108a0
call fcn.10011860
mov eax, dword [0x10089b14]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f355
add ecx, dword [0x1008b8e0]
je 0x1000f355
call fcn.10012550
mov esi, eax
mov edx, dword [0x10089828]
sub edx, dword [0x1008b874]
add edx, dword [0x1008b9a4]
mov ecx, dword [0x1008ba3c]
mov ecx, dword [edx + ecx]
call fcn.100087d0
test eax, eax
jle 0x1000f355
cmp dword [0x100898bc], 0
je 0x1000f355
mov eax, dword [0x1008b980]
mov eax, dword [eax + esi + 0xc]
mov dword [eax], 0x41200000
wait
jmp 0x1000f361
mov dword [ebp - 4], 0xfffffffe
call fcn.10010550
call fcn.100109c0
mov eax, dword [0x1008bb8c]
cmp dword [eax], 1
jne 0x1000f39c
cmp dword [0x10089824], 0
je 0x1000f39c
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 9
je 0x1000f39c
mov eax, dword [0x1008bb8c]
mov dword [eax], 4
mov eax, dword [0x1008bb8c]
mov eax, dword [eax]
cmp eax, 1
je 0x1000f3b2
cmp eax, 2
je 0x1000f3b2
cmp eax, 3
jne 0x1000f3ee
mov ecx, dword [0x1008b8f0]
mov eax, dword [0x1008b990]
imul ecx, dword [eax + ecx], 0x45
sub ecx, dword [0x1008b874]
mov eax, dword [0x1008ba3c]
add ecx, dword [0x1008b858]
add ecx, dword [0x1008b9a4]
cmp dword [0x10089770], 0
je 0x1000f3e8
mov edx, 1
jmp 0x1000f3ea
xor edx, edx
mov word [ecx + eax], dx
cmp dword [0x100899f0], 0
je 0x1000f447
mov eax, dword [0x1008bb8c]
cmp dword [eax], 0
jne 0x1000f447
mov eax, dword [0x100899a8]
inc eax
mov dword [0x100899a8], eax
mov ecx, eax
cmp eax, 9
jbe 0x1000f423
mov dword [0x100899a8], 0xffffffff
or eax, 0xffffffff
or ecx, 0xffffffff
cmp eax, 0xa
jae 0x1000f447
lea ecx, [ecx*4 + 0xc]
sub ecx, dword [0x1008b9b8]
add ecx, dword [0x1008bae8]
mov eax, dword [0x1008bad4]
mov dword [ecx + eax], 0
mov eax, dword [0x1008bb8c]
cmp dword [eax], 1
jne 0x1000f550
mov eax, dword [0x1008ba74]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f550
mov eax, dword [0x1008b91c]
movss xmm0, dword [0x10089b24]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx + 0x10], xmm0
movss xmm0, dword [0x10089ae8]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx], xmm0
mov eax, dword [0x1008969c]
cmp eax, 1
jne 0x1000f4ad
mov dword [0x10089b24], 0x3d4ccccd
mov dword [0x10089ae8], 0x3dcccccd
jmp 0x1000f550
cmp eax, 2
jne 0x1000f4cb
mov dword [0x10089b24], 0x3dcccccd
mov dword [0x10089ae8], 0x3e19999a
jmp 0x1000f550
cmp eax, 3
jne 0x1000f4e6
mov dword [0x10089b24], 0x3e19999a
mov dword [0x10089ae8], 0x3e4ccccd
jmp 0x1000f550
cmp eax, 4
jne 0x1000f501
mov dword [0x10089b24], 0x3e4ccccd
mov dword [0x10089ae8], 0x3e800000
jmp 0x1000f550
cmp eax, 5
jne 0x1000f51c
mov dword [0x10089b24], 0x3e800000
mov dword [0x10089ae8], 0x3e99999a
jmp 0x1000f550
cmp eax, 6
jne 0x1000f537
mov dword [0x10089b24], 0x3e99999a
mov dword [0x10089ae8], 0x3eb33333
jmp 0x1000f550
cmp eax, 7
jne 0x1000f550
mov dword [0x10089b24], 0x3eb33333
mov dword [0x10089ae8], 0x3ecccccd
call fcn.1000fdd0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x100896f4], 0
je 0x1000f5b1
cmp byte [0x1008974b], 0
jne 0x1000f5a7
mov esi, dword [0x1008bb88]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x66
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov al, 1
jmp 0x1000f5fa
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x1000f5fa
cmp byte [0x1008974b], 1
jne 0x1000f5f2
mov esi, dword [0x1008bb88]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x46
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
jmp 0x1000f5f8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov byte [0x1008974b], al
cmp dword [0x1008a7d0], 0
je 0x1000f643
mov eax, dword [0x1008ba48]
mov esi, dword [eax]
test esi, esi
je 0x1000f643
mov ecx, dword [0x10089828]
sub ecx, dword [0x1008b874]
add ecx, dword [0x1008b9a4]
mov eax, dword [0x1008ba3c]
mov ecx, dword [ecx + eax]
call fcn.100087d0
test eax, eax
jle 0x1000f643
mov dword [esi], 0x42700000
mov dword [esi + 4], 0x42700000
mov eax, dword [0x100896c0]
cmp eax, 1
jne 0x1000f694
cmp byte [0x10089a87], 0
jne 0x1000f68b
mov esi, dword [0x1008b86c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x7a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10089a87], 1
jmp 0x1000f6dd
test eax, eax
jne 0x1000f6dd
cmp byte [0x10089a87], 1
jne 0x1000f6d6
mov esi, dword [0x1008b86c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x77a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10089a87], 0
mov eax, dword [0x1008b878]
cmp dword [eax], 6
jne 0x1000f79a
mov eax, dword [0x1008bb8c]
cmp dword [eax], 0
jne 0x1000f79a
cmp dword [0x10089b10], 0
je 0x1000f753
cmp byte [0x100896a9], 0
jne 0x1000f740
mov esi, dword [0x1008b870]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x15eb
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10089903], 0
mov al, 1
mov byte [0x100896a9], al
jmp 0x1000f7e6
cmp byte [0x100896a9], 1
jne 0x1000f791
mov esi, dword [0x1008b870]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
xor al, al
mov byte [0x100896a9], al
jmp 0x1000f7e6
cmp byte [0x10089903], 0
jne 0x1000f7d8
mov esi, dword [0x1008b870]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10089903], 1
mov byte [0x100896a9], 0
mov eax, dword [0x10089b14]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f80f
mov eax, dword [0x1008b8d4]
cmp dword [0x10089764], 0
je 0x1000f808
mov dword [ecx + eax], 0x42480000
jmp 0x1000f80f
mov dword [ecx + eax], 0
call fcn.1000f9a0
cmp dword [0x100898c0], 0
je 0x1000f911
mov dword [0x100898c0], 0
mov dword [0x10089da0], 1
mov dword [0x100898d0], 8
mov dword [0x100897bc], 1
mov dword [0x10089720], 1
mov dword [0x10089a1c], 1
mov dword [0x10089778], 1
mov dword [0x100896dc], 1
mov dword [0x1008969c], 7
mov dword [0x100897a4], 1
mov dword [0x10089a54], 4
mov dword [0x1008a7c8], 4
mov dword [0x100899f8], 4
mov dword [0x10089a10], 4
mov dword [0x1008990c], 1
mov dword [0x10089b0c], 1
mov dword [0x100898c8], 1
mov dword [0x100896c0], 1
mov dword [0x1008a7d0], 1
mov dword [0x100899f0], 1
mov dword [0x10089820], 1
mov dword [0x100897e8], 1
mov dword [0x10089764], 1
mov dword [0x1008a7cc], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1006cc7b
mov esp, ebp
pop ebp
ret