Function at 0x10015830
Capabilities:
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008fbf0
push 0x10074aac
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10093400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
call fcn.10017a50
call fcn.10017770
call fcn.10017840
call fcn.100180a0
call fcn.10017310
call fcn.10017ff0
call fcn.10017280
call fcn.10016a40
call fcn.10017f20
call fcn.10015e90
call fcn.10017490
call fcn.10016e90
call fcn.100176a0
wait
jmp 0x100158bb
mov dword [ebp - 4], 0xfffffffe
call fcn.10010390
call fcn.10016b40
call fcn.10016fb0
mov eax, dword [0x10096e94]
cmp dword [eax], 1
jne 0x100158fb
cmp dword [0x10094b28], 0
je 0x100158fb
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 9
je 0x100158fb
mov eax, dword [0x10096e94]
mov dword [eax], 4
mov eax, dword [0x10096e94]
mov eax, dword [eax]
cmp eax, 1
je 0x10015911
cmp eax, 2
je 0x10015911
cmp eax, 3
jne 0x1001594d
mov ecx, dword [0x10096bd8]
mov eax, dword [0x10096c6c]
imul ecx, dword [eax + ecx], 0x45
sub ecx, dword [0x10096b54]
mov eax, dword [0x10096d28]
add ecx, dword [0x10096b34]
add ecx, dword [0x10096c80]
cmp dword [0x10094a78], 0
je 0x10015947
mov edx, 1
jmp 0x10015949
xor edx, edx
mov word [ecx + eax], dx
cmp dword [0x10094cec], 0
je 0x100159a6
mov eax, dword [0x10096e94]
cmp dword [eax], 0
jne 0x100159a6
mov eax, dword [0x10094ca8]
inc eax
mov dword [0x10094ca8], eax
mov ecx, eax
cmp eax, 9
jbe 0x10015982
mov dword [0x10094ca8], 0xffffffff
or eax, 0xffffffff
or ecx, 0xffffffff
cmp eax, 0xa
jae 0x100159a6
lea ecx, [ecx*4 + 0xc]
sub ecx, dword [0x10096c94]
add ecx, dword [0x10096de8]
mov eax, dword [0x10096dcc]
mov dword [ecx + eax], 0
mov eax, dword [0x10096e94]
cmp dword [eax], 1
jne 0x10015aaf
mov eax, dword [0x10096d60]
mov ecx, dword [eax]
test ecx, ecx
je 0x10015aaf
mov eax, dword [0x10096c04]
movss xmm0, dword [0x10094e00]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx + 0x10], xmm0
movss xmm0, dword [0x10094dc8]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx], xmm0
mov eax, dword [0x100949ac]
cmp eax, 1
jne 0x10015a0c
mov dword [0x10094e00], 0x3d4ccccd
mov dword [0x10094dc8], 0x3dcccccd
jmp 0x10015aaf
cmp eax, 2
jne 0x10015a2a
mov dword [0x10094e00], 0x3dcccccd
mov dword [0x10094dc8], 0x3e19999a
jmp 0x10015aaf
cmp eax, 3
jne 0x10015a45
mov dword [0x10094e00], 0x3e19999a
mov dword [0x10094dc8], 0x3e4ccccd
jmp 0x10015aaf
cmp eax, 4
jne 0x10015a60
mov dword [0x10094e00], 0x3e4ccccd
mov dword [0x10094dc8], 0x3e800000
jmp 0x10015aaf
cmp eax, 5
jne 0x10015a7b
mov dword [0x10094e00], 0x3e800000
mov dword [0x10094dc8], 0x3e99999a
jmp 0x10015aaf
cmp eax, 6
jne 0x10015a96
mov dword [0x10094e00], 0x3e99999a
mov dword [0x10094dc8], 0x3eb33333
jmp 0x10015aaf
cmp eax, 7
jne 0x10015aaf
mov dword [0x10094e00], 0x3eb33333
mov dword [0x10094dc8], 0x3ecccccd
call fcn.100163c0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x100949fc], 0
je 0x10015b10
cmp byte [0x10094a56], 0
jne 0x10015b06
mov esi, dword [0x10096e90]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x66
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov al, 1
jmp 0x10015b59
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x10015b59
cmp byte [0x10094a56], 1
jne 0x10015b51
mov esi, dword [0x10096e90]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x46
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
jmp 0x10015b57
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov byte [0x10094a56], al
cmp dword [0x10095aa8], 0
je 0x10015ba2
mov eax, dword [0x10096d34]
mov esi, dword [eax]
test esi, esi
je 0x10015ba2
mov ecx, dword [0x10094b2c]
sub ecx, dword [0x10096b54]
add ecx, dword [0x10096c80]
mov eax, dword [0x10096d28]
mov ecx, dword [ecx + eax]
call fcn.10008040
test eax, eax
jle 0x10015ba2
mov dword [esi], 0x42700000
mov dword [esi + 4], 0x42700000
mov eax, dword [0x100949c8]
cmp eax, 1
jne 0x10015bf3
cmp byte [0x10094df2], 0
jne 0x10015bea
mov esi, dword [0x10096b4c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x7a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10094df2], 1
jmp 0x10015c3c
test eax, eax
jne 0x10015c3c
cmp byte [0x10094df2], 1
jne 0x10015c35
mov esi, dword [0x10096b4c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x77a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10094df2], 0
mov eax, dword [0x10096b58]
cmp dword [eax], 6
jne 0x10015cf9
mov eax, dword [0x10096e94]
cmp dword [eax], 0
jne 0x10015cf9
cmp dword [0x10094dec], 0
je 0x10015cb2
cmp byte [0x100949f0], 0
jne 0x10015c9f
mov esi, dword [0x10096b50]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x15eb
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10094c06], 0
mov al, 1
mov byte [0x100949f0], al
jmp 0x10015d45
cmp byte [0x100949f0], 1
jne 0x10015cf0
mov esi, dword [0x10096b50]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
xor al, al
mov byte [0x100949f0], al
jmp 0x10015d45
cmp byte [0x10094c06], 0
jne 0x10015d37
mov esi, dword [0x10096b50]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10094c06], 1
mov byte [0x100949f0], 0
mov eax, dword [0x10094df4]
mov ecx, dword [eax]
test ecx, ecx
je 0x10015d6e
mov eax, dword [0x10096bb8]
cmp dword [0x10094a6c], 0
je 0x10015d67
mov dword [ecx + eax], 0x42480000
jmp 0x10015d6e
mov dword [ecx + eax], 0
call fcn.10015f00
cmp dword [0x10094bc4], 0
je 0x10015e70
mov dword [0x10094bc4], 0
mov dword [0x10095074], 1
mov dword [0x10094bd0], 8
mov dword [0x10094ac4], 1
mov dword [0x10094a24], 1
mov dword [0x10094d10], 1
mov dword [0x10094a84], 1
mov dword [0x100949e8], 1
mov dword [0x100949ac], 7
mov dword [0x10094aac], 1
mov dword [0x10094d44], 4
mov dword [0x10095aa0], 4
mov dword [0x10094cf0], 4
mov dword [0x10094d04], 4
mov dword [0x10094c0c], 1
mov dword [0x10094de8], 1
mov dword [0x10094bcc], 1
mov dword [0x100949c8], 1
mov dword [0x10095aa8], 1
mov dword [0x10094cec], 1
mov dword [0x10094b24], 1
mov dword [0x10094af0], 1
mov dword [0x10094a6c], 1
mov dword [0x10095aa4], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10074adb
mov esp, ebp
pop ebp
ret