Function at 0x10017d40
Capabilities:
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100933e8
push 0x100773bc
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10096400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
call fcn.10019f30
call fcn.10019c50
call fcn.10019d20
call fcn.1001a550
call fcn.100197f0
call fcn.1001a4a0
call fcn.10019760
call fcn.10018f20
call fcn.1001a3d0
call fcn.100183a0
call fcn.10019970
call fcn.10019370
call fcn.10019b80
wait
jmp 0x10017dcb
mov dword [ebp - 4], 0xfffffffe
call fcn.10012890
call fcn.10019020
call fcn.10019490
mov eax, dword [0x1009aaa0]
cmp dword [eax], 1
jne 0x10017e0b
cmp dword [0x10098714], 0
je 0x10017e0b
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 9
je 0x10017e0b
mov eax, dword [0x1009aaa0]
mov dword [eax], 4
mov eax, dword [0x1009aaa0]
mov eax, dword [eax]
cmp eax, 1
je 0x10017e21
cmp eax, 2
je 0x10017e21
cmp eax, 3
jne 0x10017e5d
mov ecx, dword [0x1009a7e0]
mov eax, dword [0x1009a878]
imul ecx, dword [eax + ecx], 0x45
sub ecx, dword [0x1009a75c]
mov eax, dword [0x1009a934]
add ecx, dword [0x1009a73c]
add ecx, dword [0x1009a88c]
cmp dword [0x10097a94], 0
je 0x10017e57
mov edx, 1
jmp 0x10017e59
xor edx, edx
mov word [ecx + eax], dx
cmp dword [0x100988cc], 0
je 0x10017eb6
mov eax, dword [0x1009aaa0]
cmp dword [eax], 0
jne 0x10017eb6
mov eax, dword [0x10098888]
inc eax
mov dword [0x10098888], eax
mov ecx, eax
cmp eax, 9
jbe 0x10017e92
mov dword [0x10098888], 0xffffffff
or eax, 0xffffffff
or ecx, 0xffffffff
cmp eax, 0xa
jae 0x10017eb6
lea ecx, [ecx*4 + 0xc]
sub ecx, dword [0x1009a8a0]
add ecx, dword [0x1009a9f4]
mov eax, dword [0x1009a9d8]
mov dword [ecx + eax], 0
mov eax, dword [0x1009aaa0]
cmp dword [eax], 1
jne 0x10017fbf
mov eax, dword [0x1009a96c]
mov ecx, dword [eax]
test ecx, ecx
je 0x10017fbf
mov eax, dword [0x1009a80c]
movss xmm0, dword [0x10098a00]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx + 0x10], xmm0
movss xmm0, dword [0x100989bc]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx], xmm0
mov eax, dword [0x100979bc]
cmp eax, 1
jne 0x10017f1c
mov dword [0x10098a00], 0x3d4ccccd
mov dword [0x100989bc], 0x3dcccccd
jmp 0x10017fbf
cmp eax, 2
jne 0x10017f3a
mov dword [0x10098a00], 0x3dcccccd
mov dword [0x100989bc], 0x3e19999a
jmp 0x10017fbf
cmp eax, 3
jne 0x10017f55
mov dword [0x10098a00], 0x3e19999a
mov dword [0x100989bc], 0x3e4ccccd
jmp 0x10017fbf
cmp eax, 4
jne 0x10017f70
mov dword [0x10098a00], 0x3e4ccccd
mov dword [0x100989bc], 0x3e800000
jmp 0x10017fbf
cmp eax, 5
jne 0x10017f8b
mov dword [0x10098a00], 0x3e800000
mov dword [0x100989bc], 0x3e99999a
jmp 0x10017fbf
cmp eax, 6
jne 0x10017fa6
mov dword [0x10098a00], 0x3e99999a
mov dword [0x100989bc], 0x3eb33333
jmp 0x10017fbf
cmp eax, 7
jne 0x10017fbf
mov dword [0x10098a00], 0x3eb33333
mov dword [0x100989bc], 0x3ecccccd
call fcn.100188a0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x10097a14], 0
je 0x10018020
cmp byte [0x10097a86], 0
jne 0x10018016
mov esi, dword [0x1009aa9c]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x66
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov al, 1
jmp 0x10018069
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x10018069
cmp byte [0x10097a86], 1
jne 0x10018061
mov esi, dword [0x1009aa9c]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x46
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
jmp 0x10018067
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov byte [0x10097a86], al
cmp dword [0x100996b4], 0
je 0x100180b2
mov eax, dword [0x1009a940]
mov esi, dword [eax]
test esi, esi
je 0x100180b2
mov ecx, dword [0x10098718]
sub ecx, dword [0x1009a75c]
add ecx, dword [0x1009a88c]
mov eax, dword [0x1009a934]
mov ecx, dword [ecx + eax]
call fcn.10009720
test eax, eax
jle 0x100180b2
mov dword [esi], 0x42700000
mov dword [esi + 4], 0x42700000
mov eax, dword [0x100979d8]
cmp eax, 1
jne 0x10018103
cmp byte [0x100989ea], 0
jne 0x100180fa
mov esi, dword [0x1009a754]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x7a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x100989ea], 1
jmp 0x1001814c
test eax, eax
jne 0x1001814c
cmp byte [0x100989ea], 1
jne 0x10018145
mov esi, dword [0x1009a754]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x77a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x100989ea], 0
mov eax, dword [0x1009a760]
cmp dword [eax], 6
jne 0x10018209
mov eax, dword [0x1009aaa0]
cmp dword [eax], 0
jne 0x10018209
cmp dword [0x100989e4], 0
je 0x100181c2
cmp byte [0x10097a04], 0
jne 0x100181af
mov esi, dword [0x1009a758]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x15eb
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x100982be], 0
mov al, 1
mov byte [0x10097a04], al
jmp 0x10018255
cmp byte [0x10097a04], 1
jne 0x10018200
mov esi, dword [0x1009a758]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
xor al, al
mov byte [0x10097a04], al
jmp 0x10018255
cmp byte [0x100982be], 0
jne 0x10018247
mov esi, dword [0x1009a758]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x100982be], 1
mov byte [0x10097a04], 0
mov eax, dword [0x100989ec]
mov ecx, dword [eax]
test ecx, ecx
je 0x1001827e
mov eax, dword [0x1009a7c0]
cmp dword [0x10097a88], 0
je 0x10018277
mov dword [ecx + eax], 0x42480000
jmp 0x1001827e
mov dword [ecx + eax], 0
call fcn.10018410
cmp dword [0x100987b0], 0
je 0x10018380
mov dword [0x100987b0], 0
mov dword [0x10098c7c], 1
mov dword [0x100987bc], 8
mov dword [0x100986b0], 1
mov dword [0x10097a40], 1
mov dword [0x100988f8], 1
mov dword [0x10097aa0], 1
mov dword [0x100979fc], 1
mov dword [0x100979bc], 7
mov dword [0x10097acc], 1
mov dword [0x1009892c], 4
mov dword [0x100996ac], 4
mov dword [0x100988d4], 4
mov dword [0x100988ec], 4
mov dword [0x100987f0], 1
mov dword [0x100989e0], 1
mov dword [0x100987b8], 1
mov dword [0x100979d8], 1
mov dword [0x100996b4], 1
mov dword [0x100988cc], 1
mov dword [0x10098710], 1
mov dword [0x100986dc], 1
mov dword [0x10097a88], 1
mov dword [0x100996b0], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100773eb
mov esp, ebp
pop ebp
ret