Function at 0x10016570
Capabilities:
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100913a0
push 0x10075bdc
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10094400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
call fcn.10018640
call fcn.10018360
call fcn.10018430
call fcn.10018d30
call fcn.10018020
call fcn.10018c80
call fcn.10017f90
call fcn.10017750
call fcn.10018bb0
call fcn.10016c30
call fcn.100181a0
call fcn.10017ba0
call fcn.10018ae0
mov eax, dword [0x10095be8]
mov ecx, dword [eax]
test ecx, ecx
je 0x10016645
add ecx, dword [0x100979bc]
je 0x10016645
call fcn.100196d0
mov esi, eax
mov edx, dword [0x10095904]
sub edx, dword [0x10097950]
add edx, dword [0x10097a7c]
mov ecx, dword [0x10097b18]
mov ecx, dword [edx + ecx]
call fcn.10008970
test eax, eax
jle 0x10016645
cmp dword [0x1009599c], 0
je 0x10016645
mov eax, dword [0x10097a5c]
mov eax, dword [eax + esi + 0xc]
mov dword [eax], 0x41200000
call fcn.100182a0
wait
jmp 0x10016656
mov dword [ebp - 4], 0xfffffffe
call fcn.10011170
call fcn.10017850
call fcn.10017cc0
mov eax, dword [0x10097c68]
cmp dword [eax], 1
jne 0x10016696
cmp dword [0x10095900], 0
je 0x10016696
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 9
je 0x10016696
mov eax, dword [0x10097c68]
mov dword [eax], 4
mov eax, dword [0x10097c68]
mov eax, dword [eax]
cmp eax, 1
je 0x100166ac
cmp eax, 2
je 0x100166ac
cmp eax, 3
jne 0x100166e8
mov ecx, dword [0x100979cc]
mov eax, dword [0x10097a68]
imul ecx, dword [eax + ecx], 0x45
sub ecx, dword [0x10097950]
mov eax, dword [0x10097b18]
add ecx, dword [0x10097930]
add ecx, dword [0x10097a7c]
cmp dword [0x1009584c], 0
je 0x100166e2
mov edx, 1
jmp 0x100166e4
xor edx, edx
mov word [ecx + eax], dx
cmp dword [0x10095ac8], 0
je 0x10016741
mov eax, dword [0x10097c68]
cmp dword [eax], 0
jne 0x10016741
mov eax, dword [0x10095a84]
inc eax
mov dword [0x10095a84], eax
mov ecx, eax
cmp eax, 9
jbe 0x1001671d
mov dword [0x10095a84], 0xffffffff
or eax, 0xffffffff
or ecx, 0xffffffff
cmp eax, 0xa
jae 0x10016741
lea ecx, [ecx*4 + 0xc]
sub ecx, dword [0x10097a90]
add ecx, dword [0x10097bc4]
mov eax, dword [0x10097bb0]
mov dword [ecx + eax], 0
mov eax, dword [0x10097c68]
cmp dword [eax], 1
jne 0x1001684a
mov eax, dword [0x10097b50]
mov ecx, dword [eax]
test ecx, ecx
je 0x1001684a
mov eax, dword [0x100979f8]
movss xmm0, dword [0x10095bf8]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx + 0x10], xmm0
movss xmm0, dword [0x10095bb8]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx], xmm0
mov eax, dword [0x1009577c]
cmp eax, 1
jne 0x100167a7
mov dword [0x10095bf8], 0x3d4ccccd
mov dword [0x10095bb8], 0x3dcccccd
jmp 0x1001684a
cmp eax, 2
jne 0x100167c5
mov dword [0x10095bf8], 0x3dcccccd
mov dword [0x10095bb8], 0x3e19999a
jmp 0x1001684a
cmp eax, 3
jne 0x100167e0
mov dword [0x10095bf8], 0x3e19999a
mov dword [0x10095bb8], 0x3e4ccccd
jmp 0x1001684a
cmp eax, 4
jne 0x100167fb
mov dword [0x10095bf8], 0x3e4ccccd
mov dword [0x10095bb8], 0x3e800000
jmp 0x1001684a
cmp eax, 5
jne 0x10016816
mov dword [0x10095bf8], 0x3e800000
mov dword [0x10095bb8], 0x3e99999a
jmp 0x1001684a
cmp eax, 6
jne 0x10016831
mov dword [0x10095bf8], 0x3e99999a
mov dword [0x10095bb8], 0x3eb33333
jmp 0x1001684a
cmp eax, 7
jne 0x1001684a
mov dword [0x10095bf8], 0x3eb33333
mov dword [0x10095bb8], 0x3ecccccd
call fcn.100170d0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x100957d0], 0
je 0x100168ab
cmp byte [0x1009583e], 0
jne 0x100168a1
mov esi, dword [0x10097c64]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x66
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov al, 1
jmp 0x100168f4
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x100168f4
cmp byte [0x1009583e], 1
jne 0x100168ec
mov esi, dword [0x10097c64]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x46
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
jmp 0x100168f2
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov byte [0x1009583e], al
cmp dword [0x100968a8], 0
je 0x1001693d
mov eax, dword [0x10097b24]
mov esi, dword [eax]
test esi, esi
je 0x1001693d
mov ecx, dword [0x10095904]
sub ecx, dword [0x10097950]
add ecx, dword [0x10097a7c]
mov eax, dword [0x10097b18]
mov ecx, dword [ecx + eax]
call fcn.10008970
test eax, eax
jle 0x1001693d
mov dword [esi], 0x42700000
mov dword [esi + 4], 0x42700000
mov eax, dword [0x10095798]
cmp eax, 1
jne 0x1001698e
cmp byte [0x10095be6], 0
jne 0x10016985
mov esi, dword [0x10097948]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x7a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10095be6], 1
jmp 0x100169d7
test eax, eax
jne 0x100169d7
cmp byte [0x10095be6], 1
jne 0x100169d0
mov esi, dword [0x10097948]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x77a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10095be6], 0
mov eax, dword [0x10097954]
cmp dword [eax], 6
jne 0x10016a94
mov eax, dword [0x10097c68]
cmp dword [eax], 0
jne 0x10016a94
cmp dword [0x10095be0], 0
je 0x10016a4d
cmp byte [0x100957c0], 0
jne 0x10016a3a
mov esi, dword [0x1009794c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x15eb
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x100959e2], 0
mov al, 1
mov byte [0x100957c0], al
jmp 0x10016ae0
cmp byte [0x100957c0], 1
jne 0x10016a8b
mov esi, dword [0x1009794c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
xor al, al
mov byte [0x100957c0], al
jmp 0x10016ae0
cmp byte [0x100959e2], 0
jne 0x10016ad2
mov esi, dword [0x1009794c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x100959e2], 1
mov byte [0x100957c0], 0
mov eax, dword [0x10095be8]
mov ecx, dword [eax]
test ecx, ecx
je 0x10016b09
mov eax, dword [0x100979b0]
cmp dword [0x10095840], 0
je 0x10016b02
mov dword [ecx + eax], 0x42480000
jmp 0x10016b09
mov dword [ecx + eax], 0
call fcn.10016ca0
cmp dword [0x100959a0], 0
je 0x10016c0b
mov dword [0x100959a0], 0
mov dword [0x10095e74], 1
mov dword [0x100959ac], 8
mov dword [0x10095898], 1
mov dword [0x100957fc], 1
mov dword [0x10095af4], 1
mov dword [0x10095854], 1
mov dword [0x100957b8], 1
mov dword [0x1009577c], 7
mov dword [0x1009587c], 1
mov dword [0x10095b28], 4
mov dword [0x100968a0], 4
mov dword [0x10095ad0], 4
mov dword [0x10095ae8], 4
mov dword [0x100959e8], 1
mov dword [0x10095bdc], 1
mov dword [0x100959a8], 1
mov dword [0x10095798], 1
mov dword [0x100968a8], 1
mov dword [0x10095ac8], 1
mov dword [0x100958fc], 1
mov dword [0x100958c4], 1
mov dword [0x10095840], 1
mov dword [0x100968a4], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10075c0b
mov esp, ebp
pop ebp
ret