Function at 0x1000cd20
Capabilities:
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008d960
push 0x100731bc
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10092400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
call fcn.10016b60
call fcn.10016950
call fcn.100171b0
call fcn.10016540
call fcn.10017100
call fcn.100164b0
call fcn.10015c70
call fcn.10017030
call fcn.10015370
call fcn.100166c0
call fcn.100160c0
call fcn.100168d0
mov eax, dword [0x10093e20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000cdfd
mov eax, dword [0x10095dc0]
movss xmm0, dword [0x1008cb98]
comiss xmm0, dword [ecx + eax]
jbe 0x1000cdfd
mov eax, dword [0x10095bf0]
mov ecx, dword [ecx + eax]
test ecx, ecx
je 0x1000cdfd
mov eax, dword [0x10095e2c]
mov ecx, dword [ecx + eax]
test ecx, ecx
je 0x1000cdfd
mov eax, dword [0x10095e84]
mov ecx, dword [ecx + eax]
test ecx, ecx
je 0x1000cdfd
mov eax, dword [0x10095df8]
mov eax, dword [ecx + eax + 0xc]
cmp dword [0x100939dc], 1
jne 0x1000cdf7
mov dword [eax], 0xc479c000
wait
jmp 0x1000ce09
mov dword [eax], 0x3ecccccd
wait
jmp 0x1000ce09
mov dword [ebp - 4], 0xfffffffe
call fcn.1000fd20
call fcn.1000cb10
call fcn.10015d70
call fcn.100161e0
mov eax, dword [0x10095f64]
cmp dword [eax], 1
jne 0x1000ce4e
cmp dword [0x10093b38], 0
je 0x1000ce4e
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 9
je 0x1000ce4e
mov eax, dword [0x10095f64]
mov dword [eax], 4
mov eax, dword [0x10095f64]
mov eax, dword [eax]
cmp eax, 1
je 0x1000ce64
cmp eax, 2
je 0x1000ce64
cmp eax, 3
jne 0x1000cea0
mov ecx, dword [0x10095c18]
mov eax, dword [0x10095cc4]
imul ecx, dword [eax + ecx], 0x45
sub ecx, dword [0x10095b90]
mov eax, dword [0x10095da8]
add ecx, dword [0x10095b68]
add ecx, dword [0x10095cdc]
cmp dword [0x10093a8c], 0
je 0x1000ce9a
mov edx, 1
jmp 0x1000ce9c
xor edx, edx
mov word [ecx + eax], dx
cmp dword [0x10093d04], 0
je 0x1000cef9
mov eax, dword [0x10095f64]
cmp dword [eax], 0
jne 0x1000cef9
mov eax, dword [0x10093cc0]
inc eax
mov dword [0x10093cc0], eax
mov ecx, eax
cmp eax, 9
jbe 0x1000ced5
mov dword [0x10093cc0], 0xffffffff
or eax, 0xffffffff
or ecx, 0xffffffff
cmp eax, 0xa
jae 0x1000cef9
lea ecx, [ecx*4 + 0xc]
sub ecx, dword [0x10095cec]
add ecx, dword [0x10095e9c]
mov eax, dword [0x10095e80]
mov dword [ecx + eax], 0
mov eax, dword [0x10095f64]
cmp dword [eax], 1
jne 0x1000d002
mov eax, dword [0x10095df4]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000d002
mov eax, dword [0x10095c50]
movss xmm0, dword [0x10093e30]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx + 0x10], xmm0
movss xmm0, dword [0x10093de4]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx], xmm0
mov eax, dword [0x100939ac]
cmp eax, 1
jne 0x1000cf5f
mov dword [0x10093e30], 0x3d4ccccd
mov dword [0x10093de4], 0x3dcccccd
jmp 0x1000d002
cmp eax, 2
jne 0x1000cf7d
mov dword [0x10093e30], 0x3dcccccd
mov dword [0x10093de4], 0x3e19999a
jmp 0x1000d002
cmp eax, 3
jne 0x1000cf98
mov dword [0x10093e30], 0x3e19999a
mov dword [0x10093de4], 0x3e4ccccd
jmp 0x1000d002
cmp eax, 4
jne 0x1000cfb3
mov dword [0x10093e30], 0x3e4ccccd
mov dword [0x10093de4], 0x3e800000
jmp 0x1000d002
cmp eax, 5
jne 0x1000cfce
mov dword [0x10093e30], 0x3e800000
mov dword [0x10093de4], 0x3e99999a
jmp 0x1000d002
cmp eax, 6
jne 0x1000cfe9
mov dword [0x10093e30], 0x3e99999a
mov dword [0x10093de4], 0x3eb33333
jmp 0x1000d002
cmp eax, 7
jne 0x1000d002
mov dword [0x10093e30], 0x3eb33333
mov dword [0x10093de4], 0x3ecccccd
call fcn.100155f0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x10093a0c], 0
je 0x1000d063
cmp byte [0x10093a5f], 0
jne 0x1000d059
mov esi, dword [0x10095f58]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x66
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov al, 1
jmp 0x1000d0ac
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x1000d0ac
cmp byte [0x10093a5f], 1
jne 0x1000d0a4
mov esi, dword [0x10095f58]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x46
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
jmp 0x1000d0aa
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov byte [0x10093a5f], al
cmp dword [0x10094ad8], 0
je 0x1000d0f5
mov eax, dword [0x10095db4]
mov esi, dword [eax]
test esi, esi
je 0x1000d0f5
mov ecx, dword [0x10093b3c]
sub ecx, dword [0x10095b90]
add ecx, dword [0x10095cdc]
mov eax, dword [0x10095da8]
mov ecx, dword [ecx + eax]
call fcn.10007310
test eax, eax
jle 0x1000d0f5
mov dword [esi], 0x42700000
mov dword [esi + 4], 0x42700000
mov eax, dword [0x100939d0]
cmp eax, 1
jne 0x1000d146
cmp byte [0x10093d87], 0
jne 0x1000d13d
mov esi, dword [0x10095b80]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x7a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10093d87], 1
jmp 0x1000d18f
test eax, eax
jne 0x1000d18f
cmp byte [0x10093d87], 1
jne 0x1000d188
mov esi, dword [0x10095b80]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x77a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10093d87], 0
mov eax, dword [0x10095b94]
cmp dword [eax], 6
jne 0x1000d24c
mov eax, dword [0x10095f64]
cmp dword [eax], 0
jne 0x1000d24c
cmp dword [0x10093e1c], 0
je 0x1000d205
cmp byte [0x100939b9], 0
jne 0x1000d1f2
mov esi, dword [0x10095b84]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x15eb
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10093c1e], 0
mov al, 1
mov byte [0x100939b9], al
jmp 0x1000d298
cmp byte [0x100939b9], 1
jne 0x1000d243
mov esi, dword [0x10095b84]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
xor al, al
mov byte [0x100939b9], al
jmp 0x1000d298
cmp byte [0x10093c1e], 0
jne 0x1000d28a
mov esi, dword [0x10095b84]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10093c1e], 1
mov byte [0x100939b9], 0
mov eax, dword [0x10093e20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000d2c1
mov eax, dword [0x10095bf4]
cmp dword [0x10093a80], 0
je 0x1000d2ba
mov dword [ecx + eax], 0x42480000
jmp 0x1000d2c1
mov dword [ecx + eax], 0
call fcn.100153e0
cmp dword [0x10094adc], 0
je 0x1000d311
cmp byte [0x100939bb], 0
jne 0x1000d351
mov esi, dword [0x10095f40]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
mov byte [esi], 0xc3
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 1
push esi
call ebx
mov byte [0x100939bb], 1
jmp 0x1000d351
cmp byte [0x100939bb], 1
jne 0x1000d351
mov esi, dword [0x10095f40]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
mov byte [esi], 0x55
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 1
push esi
call ebx
mov byte [0x100939bb], 0
cmp dword [0x10093bcc], 0
je 0x1000d44e
mov dword [0x10093bcc], 0
mov dword [0x100940a8], 1
mov dword [0x10093bd8], 8
mov dword [0x10093ad8], 1
mov dword [0x10093a34], 1
mov dword [0x10093d28], 1
mov dword [0x10093a98], 1
mov dword [0x100939f0], 1
mov dword [0x100939ac], 7
mov dword [0x10093ac4], 1
mov dword [0x10093d5c], 4
mov dword [0x10094ad0], 4
mov dword [0x10093d08], 4
mov dword [0x10093d1c], 4
mov dword [0x10093c24], 1
mov dword [0x10093e18], 1
mov dword [0x10093bd4], 1
mov dword [0x100939d0], 1
mov dword [0x10094ad8], 1
mov dword [0x10093d04], 1
mov dword [0x10093b34], 1
mov dword [0x10093b04], 1
mov dword [0x10093a80], 1
mov dword [0x10094ad4], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100731eb
mov esp, ebp
pop ebp
ret