Function at 0x100142b0
Capabilities:
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008d4b8
push 0x1007293c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10090400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
call fcn.100166f0
call fcn.10016410
call fcn.100164e0
call fcn.10016d40
call fcn.10015fb0
call fcn.10016c90
call fcn.10015f20
call fcn.100156e0
call fcn.10016bc0
call fcn.10014910
call fcn.10016130
call fcn.10015b30
call fcn.10016340
wait
jmp 0x1001433b
mov dword [ebp - 4], 0xfffffffe
call fcn.1000ee10
call fcn.100157e0
call fcn.10015c50
mov eax, dword [0x10094ba0]
cmp dword [eax], 1
jne 0x1001437b
cmp dword [0x10092838], 0
je 0x1001437b
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 9
je 0x1001437b
mov eax, dword [0x10094ba0]
mov dword [eax], 4
mov eax, dword [0x10094ba0]
mov eax, dword [eax]
cmp eax, 1
je 0x10014391
cmp eax, 2
je 0x10014391
cmp eax, 3
jne 0x100143cd
mov ecx, dword [0x100948c8]
mov eax, dword [0x10094964]
imul ecx, dword [eax + ecx], 0x45
sub ecx, dword [0x10094840]
mov eax, dword [0x10094a28]
add ecx, dword [0x10094820]
add ecx, dword [0x1009497c]
cmp dword [0x10091bc0], 0
je 0x100143c7
mov edx, 1
jmp 0x100143c9
xor edx, edx
mov word [ecx + eax], dx
cmp dword [0x100929e4], 0
je 0x10014426
mov eax, dword [0x10094ba0]
cmp dword [eax], 0
jne 0x10014426
mov eax, dword [0x100929a8]
inc eax
mov dword [0x100929a8], eax
mov ecx, eax
cmp eax, 9
jbe 0x10014402
mov dword [0x100929a8], 0xffffffff
or eax, 0xffffffff
or ecx, 0xffffffff
cmp eax, 0xa
jae 0x10014426
lea ecx, [ecx*4 + 0xc]
sub ecx, dword [0x10094990]
add ecx, dword [0x10094aec]
mov eax, dword [0x10094ad0]
mov dword [ecx + eax], 0
mov eax, dword [0x10094ba0]
cmp dword [eax], 1
jne 0x1001452f
mov eax, dword [0x10094a64]
mov ecx, dword [eax]
test ecx, ecx
je 0x1001452f
mov eax, dword [0x100948f4]
movss xmm0, dword [0x10092af4]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx + 0x10], xmm0
movss xmm0, dword [0x10092abc]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx], xmm0
mov eax, dword [0x10091af4]
cmp eax, 1
jne 0x1001448c
mov dword [0x10092af4], 0x3d4ccccd
mov dword [0x10092abc], 0x3dcccccd
jmp 0x1001452f
cmp eax, 2
jne 0x100144aa
mov dword [0x10092af4], 0x3dcccccd
mov dword [0x10092abc], 0x3e19999a
jmp 0x1001452f
cmp eax, 3
jne 0x100144c5
mov dword [0x10092af4], 0x3e19999a
mov dword [0x10092abc], 0x3e4ccccd
jmp 0x1001452f
cmp eax, 4
jne 0x100144e0
mov dword [0x10092af4], 0x3e4ccccd
mov dword [0x10092abc], 0x3e800000
jmp 0x1001452f
cmp eax, 5
jne 0x100144fb
mov dword [0x10092af4], 0x3e800000
mov dword [0x10092abc], 0x3e99999a
jmp 0x1001452f
cmp eax, 6
jne 0x10014516
mov dword [0x10092af4], 0x3e99999a
mov dword [0x10092abc], 0x3eb33333
jmp 0x1001452f
cmp eax, 7
jne 0x1001452f
mov dword [0x10092af4], 0x3eb33333
mov dword [0x10092abc], 0x3ecccccd
call fcn.10015060
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x10091b44], 0
je 0x10014590
cmp byte [0x10091b9e], 0
jne 0x10014586
mov esi, dword [0x10094b9c]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x66
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov al, 1
jmp 0x100145d9
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x100145d9
cmp byte [0x10091b9e], 1
jne 0x100145d1
mov esi, dword [0x10094b9c]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x46
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
jmp 0x100145d7
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov byte [0x10091b9e], al
cmp dword [0x10093798], 0
je 0x10014622
mov eax, dword [0x10094a34]
mov esi, dword [eax]
test esi, esi
je 0x10014622
mov ecx, dword [0x1009283c]
sub ecx, dword [0x10094840]
add ecx, dword [0x1009497c]
mov eax, dword [0x10094a28]
mov ecx, dword [ecx + eax]
call fcn.10006ae0
test eax, eax
jle 0x10014622
mov dword [esi], 0x42700000
mov dword [esi + 4], 0x42700000
mov eax, dword [0x10091b10]
cmp eax, 1
jne 0x10014673
cmp byte [0x10092a5f], 0
jne 0x1001466a
mov esi, dword [0x10094838]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x7a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10092a5f], 1
jmp 0x100146bc
test eax, eax
jne 0x100146bc
cmp byte [0x10092a5f], 1
jne 0x100146b5
mov esi, dword [0x10094838]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x77a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10092a5f], 0
mov eax, dword [0x10094844]
cmp dword [eax], 6
jne 0x10014779
mov eax, dword [0x10094ba0]
cmp dword [eax], 0
jne 0x10014779
cmp dword [0x10092ae0], 0
je 0x10014732
cmp byte [0x10091b38], 0
jne 0x1001471f
mov esi, dword [0x1009483c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x15eb
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x100923e7], 0
mov al, 1
mov byte [0x10091b38], al
jmp 0x100147c5
cmp byte [0x10091b38], 1
jne 0x10014770
mov esi, dword [0x1009483c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
xor al, al
mov byte [0x10091b38], al
jmp 0x100147c5
cmp byte [0x100923e7], 0
jne 0x100147b7
mov esi, dword [0x1009483c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x100923e7], 1
mov byte [0x10091b38], 0
mov eax, dword [0x10092ae4]
mov ecx, dword [eax]
test ecx, ecx
je 0x100147ee
mov eax, dword [0x100948a4]
cmp dword [0x10091bb4], 0
je 0x100147e7
mov dword [ecx + eax], 0x42480000
jmp 0x100147ee
mov dword [ecx + eax], 0
call fcn.10014980
cmp dword [0x100928cc], 0
je 0x100148f0
mov dword [0x100928cc], 0
mov dword [0x10092d68], 1
mov dword [0x100928d8], 8
mov dword [0x100927d8], 1
mov dword [0x10091b6c], 1
mov dword [0x10092a08], 1
mov dword [0x10091bcc], 1
mov dword [0x10091b30], 1
mov dword [0x10091af4], 7
mov dword [0x10091bf4], 1
mov dword [0x10092a3c], 4
mov dword [0x10093790], 4
mov dword [0x100929e8], 4
mov dword [0x100929fc], 4
mov dword [0x1009290c], 1
mov dword [0x10092adc], 1
mov dword [0x100928d4], 1
mov dword [0x10091b10], 1
mov dword [0x10093798], 1
mov dword [0x100929e4], 1
mov dword [0x10092834], 1
mov dword [0x10092804], 1
mov dword [0x10091bb4], 1
mov dword [0x10093794], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1007296b
mov esp, ebp
pop ebp
ret