Function at 0x1000e590
Capabilities:
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100847e8
push 0x1006b88c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10087400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
call fcn.100105e0
call fcn.100103d0
call fcn.10010d30
call fcn.10010150
call fcn.10010c80
call fcn.100100c0
call fcn.1000f870
call fcn.10010bb0
call fcn.1000ed00
call fcn.100102d0
call fcn.1000fcc0
call fcn.10010ae0
mov eax, dword [0x10089500]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000e660
add ecx, dword [0x1008a8b8]
je 0x1000e660
call fcn.100113f0
mov esi, eax
mov edx, dword [0x10089230]
sub edx, dword [0x1008a84c]
add edx, dword [0x1008a97c]
mov ecx, dword [0x1008aa10]
mov ecx, dword [edx + ecx]
call fcn.100082e0
test eax, eax
jle 0x1000e660
cmp dword [0x100892c0], 0
je 0x1000e660
mov eax, dword [0x1008a958]
mov eax, dword [eax + esi + 0xc]
mov dword [eax], 0x41200000
wait
jmp 0x1000e66c
mov dword [ebp - 4], 0xfffffffe
call fcn.1000f970
call fcn.1000fdf0
mov eax, dword [0x1008ab60]
cmp dword [eax], 1
jne 0x1000e6a7
cmp dword [0x1008922c], 0
je 0x1000e6a7
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 9
je 0x1000e6a7
mov eax, dword [0x1008ab60]
mov dword [eax], 4
mov eax, dword [0x1008ab60]
mov eax, dword [eax]
cmp eax, 1
je 0x1000e6bd
cmp eax, 2
je 0x1000e6bd
cmp eax, 3
jne 0x1000e6f9
mov ecx, dword [0x1008a8c8]
mov eax, dword [0x1008a964]
imul ecx, dword [eax + ecx], 0x45
sub ecx, dword [0x1008a84c]
mov eax, dword [0x1008aa10]
add ecx, dword [0x1008a82c]
add ecx, dword [0x1008a97c]
cmp dword [0x10089180], 0
je 0x1000e6f3
mov edx, 1
jmp 0x1000e6f5
xor edx, edx
mov word [ecx + eax], dx
cmp dword [0x100893f0], 0
je 0x1000e752
mov eax, dword [0x1008ab60]
cmp dword [eax], 0
jne 0x1000e752
mov eax, dword [0x100893a8]
inc eax
mov dword [0x100893a8], eax
mov ecx, eax
cmp eax, 9
jbe 0x1000e72e
mov dword [0x100893a8], 0xffffffff
or eax, 0xffffffff
or ecx, 0xffffffff
cmp eax, 0xa
jae 0x1000e752
lea ecx, [ecx*4 + 0xc]
sub ecx, dword [0x1008a98c]
add ecx, dword [0x1008aab8]
mov eax, dword [0x1008aaa4]
mov dword [ecx + eax], 0
mov eax, dword [0x1008ab60]
cmp dword [eax], 1
jne 0x1000e85b
mov eax, dword [0x1008aa44]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000e85b
mov eax, dword [0x1008a8f4]
movss xmm0, dword [0x1008950c]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx + 0x10], xmm0
movss xmm0, dword [0x100894d4]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx], xmm0
mov eax, dword [0x100890b4]
cmp eax, 1
jne 0x1000e7b8
mov dword [0x1008950c], 0x3d4ccccd
mov dword [0x100894d4], 0x3dcccccd
jmp 0x1000e85b
cmp eax, 2
jne 0x1000e7d6
mov dword [0x1008950c], 0x3dcccccd
mov dword [0x100894d4], 0x3e19999a
jmp 0x1000e85b
cmp eax, 3
jne 0x1000e7f1
mov dword [0x1008950c], 0x3e19999a
mov dword [0x100894d4], 0x3e4ccccd
jmp 0x1000e85b
cmp eax, 4
jne 0x1000e80c
mov dword [0x1008950c], 0x3e4ccccd
mov dword [0x100894d4], 0x3e800000
jmp 0x1000e85b
cmp eax, 5
jne 0x1000e827
mov dword [0x1008950c], 0x3e800000
mov dword [0x100894d4], 0x3e99999a
jmp 0x1000e85b
cmp eax, 6
jne 0x1000e842
mov dword [0x1008950c], 0x3e99999a
mov dword [0x100894d4], 0x3eb33333
jmp 0x1000e85b
cmp eax, 7
jne 0x1000e85b
mov dword [0x1008950c], 0x3eb33333
mov dword [0x100894d4], 0x3ecccccd
call fcn.1000f1f0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x10089108], 0
je 0x1000e8bc
cmp byte [0x1008915e], 0
jne 0x1000e8b2
mov esi, dword [0x1008ab5c]
lea eax, [ebp - 0x28]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x66
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 1
push esi
call ebx
mov al, 1
jmp 0x1000e905
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x1000e905
cmp byte [0x1008915e], 1
jne 0x1000e8fd
mov esi, dword [0x1008ab5c]
lea eax, [ebp - 0x28]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x46
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 1
push esi
call ebx
jmp 0x1000e903
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov byte [0x1008915e], al
cmp dword [0x100897a8], 0
je 0x1000e94e
mov eax, dword [0x1008aa1c]
mov esi, dword [eax]
test esi, esi
je 0x1000e94e
mov ecx, dword [0x10089230]
sub ecx, dword [0x1008a84c]
add ecx, dword [0x1008a97c]
mov eax, dword [0x1008aa10]
mov ecx, dword [ecx + eax]
call fcn.100082e0
test eax, eax
jle 0x1000e94e
mov dword [esi], 0x42700000
mov dword [esi + 4], 0x42700000
mov eax, dword [0x100890d8]
cmp eax, 1
jne 0x1000e99f
cmp byte [0x100894fe], 0
jne 0x1000e996
mov esi, dword [0x1008a844]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x7a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
push 2
push esi
call ebx
mov byte [0x100894fe], 1
jmp 0x1000e9e8
test eax, eax
jne 0x1000e9e8
cmp byte [0x100894fe], 1
jne 0x1000e9e1
mov esi, dword [0x1008a844]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x77a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
push 2
push esi
call ebx
mov byte [0x100894fe], 0
mov eax, dword [0x1008a850]
cmp dword [eax], 6
jne 0x1000eaa5
mov eax, dword [0x1008ab60]
cmp dword [eax], 0
jne 0x1000eaa5
cmp dword [0x100894f8], 0
je 0x1000ea5e
cmp byte [0x100890b3], 0
jne 0x1000ea4b
mov esi, dword [0x1008a848]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x15eb
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10089306], 0
mov al, 1
mov byte [0x100890b3], al
jmp 0x1000eaf1
cmp byte [0x100890b3], 1
jne 0x1000ea9c
mov esi, dword [0x1008a848]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
xor al, al
mov byte [0x100890b3], al
jmp 0x1000eaf1
cmp byte [0x10089306], 0
jne 0x1000eae3
mov esi, dword [0x1008a848]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10089306], 1
mov byte [0x100890b3], 0
mov eax, dword [0x10089500]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000eb1a
mov eax, dword [0x1008a8a8]
cmp dword [0x10089174], 0
je 0x1000eb13
mov dword [ecx + eax], 0x42480000
jmp 0x1000eb1a
mov dword [ecx + eax], 0
mov eax, dword [0x1008ab60]
cmp dword [eax], 1
jne 0x1000ebd4
cmp byte [0x100890b1], 0
jne 0x1000ebd4
mov byte [0x100890b1], 1
mov esi, dword [0x1008aa34]
add esi, 0xfffffffe
lea eax, [ebp - 0x24]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0xe084
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 2
push esi
call ebx
mov esi, dword [0x1008a868]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
mov byte [esi], 0xcc
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov esi, dword [0x1008a864]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
mov byte [esi], 0xcc
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov eax, dword [0x1008ab60]
cmp dword [eax], 0
jne 0x1000ebee
cmp byte [0x100890b1], 1
jne 0x1000ebee
mov byte [0x100890b1], 0
cmp dword [0x100892c4], 0
je 0x1000ece1
mov dword [0x100892c4], 0
mov dword [0x100892d0], 8
mov dword [0x100891c8], 1
mov dword [0x10089130], 1
mov dword [0x10089414], 1
mov dword [0x10089188], 1
mov dword [0x100890f4], 1
mov dword [0x100890b4], 7
mov dword [0x100891b4], 1
mov dword [0x10089448], 4
mov dword [0x100897a0], 4
mov dword [0x100893f4], 4
mov dword [0x10089408], 4
mov dword [0x1008930c], 1
mov dword [0x100894f4], 1
mov dword [0x100892cc], 1
mov dword [0x100890d8], 1
mov dword [0x100897a8], 1
mov dword [0x100893f0], 1
mov dword [0x10089228], 1
mov dword [0x100891f4], 1
mov dword [0x10089174], 1
mov dword [0x100897a4], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret