Function at 0x100016b0
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x10009018]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0x10faa5e0]
mov ecx, dword [esi]
mov edx, dword [ecx + 0xe4]
push edi
xor edi, edi
push edi
push 7
push esi
mov dword [esp + 0x1c], eax
call edx
mov eax, dword [0x10009654]
cmp eax, edi
je 0x100016fb
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x10009654], edi
push 0x10009654
push str.Arial
push edi
push 2
push edi
mov ebx, 1
push ebx
push edi
push ebx
push 0x190
push edi
push 0xe
push esi
call dword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
cmp dword [0x10faa3d8], edi
je 0x10001781
mov eax, dword [esi]
mov edx, dword [eax + 0xc0]
lea ecx, [esp + 0x1c]
push ecx
push esi
call edx
fild dword [esp + 0x28]
mov eax, dword [esp + 0x28]
test eax, eax
jns 0x1000174a
fadd dword [0x100075b0]
fld qword [0x100075a8]
fmul st(1), st(0)
fxch st(1)
call fcn.100065d0
fild dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
test ecx, ecx
jns 0x1000176b
fadd dword [0x100075b0]
fmulp st(1)
mov dword [esp + 0x14], eax
call fcn.100065d0
mov ecx, dword [esp + 0x14]
mov edx, eax
call fcn.10001130
mov eax, dword [0x10faa3d0]
mov dl, byte [0x10faa3f4]
mov ecx, dword [0x10009660]
cmp eax, edi
jne 0x1000179a
cmp ecx, edi
je 0x100017b5
test dl, dl
jne 0x100017ad
push edi
push edi
mov byte [0x10faa3f4], bl
push 0x100015e0
jmp 0x100017c7
cmp eax, edi
jne 0x100017d0
cmp ecx, edi
jne 0x100017d0
test dl, dl
je 0x100017d0
push edi
push edi
mov byte [0x10faa3f4], 0
push 0x10001690
call dword [sym.imp.MSVCR100.dll__beginthread]
add esp, 0xc
push 0x2d
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bl, al
je 0x100017ed
xor edx, edx
cmp dword [0x100091c8], edi
sete dl
mov dword [0x100091c8], edx
cmp dword [0x100091c8], edi
je 0x10002172
fldz
mov eax, dword [esi]
mov edx, dword [eax + 0xac]
push edi
push ecx
fstp dword [esp]
push 0xff000000
push ebx
lea ecx, [esp + 0x2c]
push ecx
push ebx
push esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], 0xaa
mov dword [esp + 0x44], 0x14c
call edx
push 0xffff0000
push ebx
push edi
push edi
mov edx, 0x14a
call fcn.10001040
push 0xffff0000
push 0xaa
push 0x14a
push edi
mov edx, ebx
call fcn.10001040
push 0xffff0000
push 0xaa
push edi
push edi
mov edx, ebx
call fcn.10001040
push 0xffff0000
push ebx
push edi
push 0xaa
mov edx, 0x14b
call fcn.10001040
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_SetRect]
add esp, 0x40
add eax, 2
push eax
add ecx, 0xa
push ecx
push eax
push ecx
lea eax, [esp + 0x2c]
push eax
call esi
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push 0xff7fff00
push 0x100
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x1c]
push 0xffffffffffffffff
push edx
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], ebx
mov dword [eax + 0x10fa9a80], 0x10009674
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
mov dword [esp + 0x10], ecx
push 0xf
push 0xf
push 0xf
push 0xf
lea edx, [esp + 0x2c]
push edx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x1000726c
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x1e
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 2
push 0xf
mov dword [eax + 0x10fa9a80], 0x10faa3d8
push 0x1e
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007270
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x2d
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 3
push 0xf
mov dword [eax + 0x10fa9a80], 0x10009678
push 0x2d
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007278
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x3c
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 4
push 0xf
mov dword [eax + 0x10fa9a80], 0x1000967c
push 0x3c
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007284
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x4b
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 5
push 0xf
mov dword [eax + 0x10fa9a80], 0x10faa3cc
push 0x4b
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], 3
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007294
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 6
mov dword [eax + 0x10fa9a80], 0x10009650
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0x5a
push 0xf
push 0x5a
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072a4
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x69
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 7
push 0xf
mov dword [eax + 0x10fa9a80], 0x10009670
push 0x69
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072b0
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x78
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 8
push 0xf
mov dword [eax + 0x10fa9a80], 0x10faa3d0
push 0x78
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072c0
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x87
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 9
push 0xf
mov dword [eax + 0x10fa9a80], 0x10009660
push 0x87
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072cc
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x96
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 0xa
push 0xf
mov dword [eax + 0x10fa9a80], 0x10009684
push 0x96
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push str.AFK_
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 0xb
push 0xa5
push 0xf
mov dword [eax + 0x10fa9a80], 0x10faa3c0
push 0xa5
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072e8
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0xb4
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 0xc
push 0xf
mov dword [eax + 0x10fa9a80], 0x1000966c
push 0xb4
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072f4
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0xc3
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 0xd
push 0xf
mov dword [eax + 0x10fa9a80], 0x10faa3dc
push 0xc3
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov eax, dword [0x10009654]
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007300
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0xd2
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 0xe
push 0xf
mov dword [eax + 0x10fa9a80], 0x10009668
push 0xd2
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007310
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0xe1
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 0xf
push 0xf
mov dword [eax + 0x10fa9a80], 0x10faa3d4
push 0xe1
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x1000731c
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0xf0
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 0x10
push 0xf
mov dword [eax + 0x10fa9a80], 0x10009658
push 0xf0
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x1000732c
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
add eax, eax
push 0xff
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 0x11
push 0xf
mov dword [eax + 0x10fa9a80], 0x10faa3c8
push 0xff
mov dword [eax + 0x10fa9a84], ebx
mov dword [eax + 0x10fa9a88], edi
mov ecx, dword [eax + 0x10fa9a8c]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x1000733c
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a70]
add eax, ebx
mov dword [0x10fa9a70], eax
lea eax, [eax + eax*2]
push 0x10e
add eax, eax
push 0xf
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a78], 0x12
push 0x10e
mov dword [eax + 0x10fa9a80], 0x10faa3e4
mov dword [eax + 0x10fa9a84], ebx
push 0xf
lea ecx, [esp + 0x2c]
mov dword [eax + 0x10fa9a88], edi
mov ebx, dword [eax + 0x10fa9a8c]
push ecx
call esi
mov eax, dword [0x10009654]
mov edx, dword [eax]
mov edx, dword [edx + 0x38]
push ebx
push 0x100
lea ecx, [esp + 0x24]
push ecx
push 0xffffffffffffffff
push 0x1000734c
push edi
push eax
call edx
call fcn.10001290
push 0x127
push 5
push 0x127
push 5
lea eax, [esp + 0x2c]
push eax
call esi
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push 0xfffffffffffffff9
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push str.www.
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
push 0x136
push 5
push 0x136
push 5
lea ecx, [esp + 0x2c]
push ecx
call esi
mov eax, dword [0x10009654]
mov edx, dword [eax]
mov edx, dword [edx + 0x38]
push 0xfffffffffffffff9
push 0x100
lea ecx, [esp + 0x24]
push ecx
push 0xffffffffffffffff
push str.www.ruch
push edi
push eax
call edx
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10005bba
mov esp, ebp
pop ebp
ret