Function at 0x1000a670
Capabilities:
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10019b08
push 0x10010129
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1001c040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
call fcn.1000c6a0
call fcn.1000c260
call fcn.1000c490
call fcn.1000cc20
call fcn.1000c0e0
call fcn.1000cb70
call fcn.1000ba80
wait
jmp 0x1000a6dd
mov dword [ebp - 4], 0xfffffffe
call fcn.1000bb80
call fcn.1000bed0
mov eax, dword [0x1001eae8]
cmp dword [eax], 1
jne 0x1000a718
cmp dword [0x1001d1fc], 0
je 0x1000a718
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 9
je 0x1000a718
mov eax, dword [0x1001eae8]
mov dword [eax], 4
mov eax, dword [0x1001eae8]
mov eax, dword [eax]
cmp eax, 1
je 0x1000a72e
cmp eax, 2
je 0x1000a72e
cmp eax, 3
jne 0x1000a76a
mov ecx, dword [0x1001e850]
mov eax, dword [0x1001e8f4]
imul ecx, dword [eax + ecx], 0x45
sub ecx, dword [0x1001e7dc]
mov eax, dword [0x1001e9a0]
add ecx, dword [0x1001e7bc]
add ecx, dword [0x1001e910]
cmp dword [0x1001d158], 0
je 0x1000a764
mov edx, 1
jmp 0x1000a766
xor edx, edx
mov word [ecx + eax], dx
cmp dword [0x1001d398], 0
je 0x1000a7c3
mov eax, dword [0x1001eae8]
cmp dword [eax], 0
jne 0x1000a7c3
mov eax, dword [0x1001d360]
inc eax
mov dword [0x1001d360], eax
mov ecx, eax
cmp eax, 9
jbe 0x1000a79f
mov dword [0x1001d360], 0xffffffff
or eax, 0xffffffff
or ecx, 0xffffffff
cmp eax, 0xa
jae 0x1000a7c3
lea ecx, [ecx*4 + 0xc]
sub ecx, dword [0x1001e920]
add ecx, dword [0x1001ea40]
mov eax, dword [0x1001ea30]
mov dword [ecx + eax], 0
mov eax, dword [0x1001eae8]
cmp dword [eax], 1
jne 0x1000a8cc
mov eax, dword [0x1001e9d8]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000a8cc
mov eax, dword [0x1001e884]
movss xmm0, dword [0x1001d4a4]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx + 0x10], xmm0
movss xmm0, dword [0x1001d46c]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx], xmm0
mov eax, dword [0x1001d090]
cmp eax, 1
jne 0x1000a829
mov dword [0x1001d4a4], 0x3d4ccccd
mov dword [0x1001d46c], 0x3dcccccd
jmp 0x1000a8cc
cmp eax, 2
jne 0x1000a847
mov dword [0x1001d4a4], 0x3dcccccd
mov dword [0x1001d46c], 0x3e19999a
jmp 0x1000a8cc
cmp eax, 3
jne 0x1000a862
mov dword [0x1001d4a4], 0x3e19999a
mov dword [0x1001d46c], 0x3e4ccccd
jmp 0x1000a8cc
cmp eax, 4
jne 0x1000a87d
mov dword [0x1001d4a4], 0x3e4ccccd
mov dword [0x1001d46c], 0x3e800000
jmp 0x1000a8cc
cmp eax, 5
jne 0x1000a898
mov dword [0x1001d4a4], 0x3e800000
mov dword [0x1001d46c], 0x3e99999a
jmp 0x1000a8cc
cmp eax, 6
jne 0x1000a8b3
mov dword [0x1001d4a4], 0x3e99999a
mov dword [0x1001d46c], 0x3eb33333
jmp 0x1000a8cc
cmp eax, 7
jne 0x1000a8cc
mov dword [0x1001d4a4], 0x3eb33333
mov dword [0x1001d46c], 0x3ecccccd
call fcn.1000b400
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x1001d0e4], 0
je 0x1000a92d
cmp byte [0x1001d14e], 0
jne 0x1000a923
mov esi, dword [0x1001eae4]
lea eax, [ebp - 0x28]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x66
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 1
push esi
call ebx
mov al, 1
jmp 0x1000a976
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x1000a976
cmp byte [0x1001d14e], 1
jne 0x1000a96e
mov esi, dword [0x1001eae4]
lea eax, [ebp - 0x28]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x46
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 1
push esi
call ebx
jmp 0x1000a974
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov byte [0x1001d14e], al
cmp dword [0x1001d734], 0
je 0x1000a9bf
mov eax, dword [0x1001e9ac]
mov esi, dword [eax]
test esi, esi
je 0x1000a9bf
mov ecx, dword [0x1001d200]
sub ecx, dword [0x1001e7dc]
add ecx, dword [0x1001e910]
mov eax, dword [0x1001e9a0]
mov ecx, dword [ecx + eax]
call fcn.10005bf0
test eax, eax
jle 0x1000a9bf
mov dword [esi], 0x42700000
mov dword [esi + 4], 0x42700000
mov eax, dword [0x1001d0b4]
cmp eax, 1
jne 0x1000aa10
cmp byte [0x1001d4a1], 0
jne 0x1000aa07
mov esi, dword [0x1001e7d4]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x7a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
push 2
push esi
call ebx
mov byte [0x1001d4a1], 1
jmp 0x1000aa59
test eax, eax
jne 0x1000aa59
cmp byte [0x1001d4a1], 1
jne 0x1000aa52
mov esi, dword [0x1001e7d4]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x77a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
push 2
push esi
call ebx
mov byte [0x1001d4a1], 0
mov eax, dword [0x1001e7e0]
cmp dword [eax], 6
jne 0x1000ab16
mov eax, dword [0x1001eae8]
cmp dword [eax], 0
jne 0x1000ab16
cmp dword [0x1001d490], 0
je 0x1000aacf
cmp byte [0x1001d08f], 0
jne 0x1000aabc
mov esi, dword [0x1001e7d8]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x15eb
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x1001d314], 0
mov al, 1
mov byte [0x1001d08f], al
jmp 0x1000ab62
cmp byte [0x1001d08f], 1
jne 0x1000ab0d
mov esi, dword [0x1001e7d8]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
xor al, al
mov byte [0x1001d08f], al
jmp 0x1000ab62
cmp byte [0x1001d314], 0
jne 0x1000ab54
mov esi, dword [0x1001e7d8]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x1001d314], 1
mov byte [0x1001d08f], 0
mov eax, dword [0x1001d494]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000ab8b
mov eax, dword [0x1001e834]
cmp dword [0x1001d150], 0
je 0x1000ab84
mov dword [ecx + eax], 0x42480000
jmp 0x1000ab8b
mov dword [ecx + eax], 0
mov eax, dword [0x1001eae8]
cmp dword [eax], 1
jne 0x1000ac45
cmp byte [0x1001d08d], 0
jne 0x1000ac45
mov byte [0x1001d08d], 1
mov esi, dword [0x1001e9c8]
add esi, 0xfffffffe
lea eax, [ebp - 0x24]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0xe084
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 2
push esi
call ebx
mov esi, dword [0x1001e7fc]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
mov byte [esi], 0xcc
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov esi, dword [0x1001e7f8]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
mov byte [esi], 0xcc
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov eax, dword [0x1001eae8]
cmp dword [eax], 0
jne 0x1000ac5f
cmp byte [0x1001d08d], 1
jne 0x1000ac5f
mov byte [0x1001d08d], 0
cmp dword [0x1001d284], 0
je 0x1000ad5c
mov dword [0x1001d284], 0
mov dword [0x1001d118], 1
mov dword [0x1001d70c], 1
mov dword [0x1001d294], 8
mov dword [0x1001d19c], 1
mov dword [0x1001d10c], 1
mov dword [0x1001d3b8], 1
mov dword [0x1001d160], 1
mov dword [0x1001d0d0], 1
mov dword [0x1001d090], 7
mov dword [0x1001d18c], 1
mov dword [0x1001d3ec], 4
mov dword [0x1001d72c], 4
mov dword [0x1001d39c], 4
mov dword [0x1001d3ac], 4
mov dword [0x1001d48c], 1
mov dword [0x1001d28c], 1
mov dword [0x1001d0b4], 1
mov dword [0x1001d734], 1
mov dword [0x1001d398], 1
mov dword [0x1001d1f8], 1
mov dword [0x1001d1c8], 1
mov dword [0x1001d150], 1
mov dword [0x1001d730], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10010158
mov esp, ebp
pop ebp
ret