Function at 0x1000dc60
Capabilities:
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100838a8
push 0x1006b0dc
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10086400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
call fcn.1000ff50
call fcn.1000fb50
call fcn.1000fd30
call fcn.10010500
call fcn.1000f8d0
call fcn.10010450
call fcn.1000f840
call fcn.1000f000
call fcn.1000e2b0
call fcn.1000fa50
call fcn.1000f450
wait
jmp 0x1000dce1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000f100
call fcn.1000f570
mov eax, dword [0x10089138]
cmp dword [eax], 1
jne 0x1000dd1c
cmp dword [0x100877fc], 0
je 0x1000dd1c
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 9
je 0x1000dd1c
mov eax, dword [0x10089138]
mov dword [eax], 4
mov eax, dword [0x10089138]
mov eax, dword [eax]
cmp eax, 1
je 0x1000dd32
cmp eax, 2
je 0x1000dd32
cmp eax, 3
jne 0x1000dd6e
mov ecx, dword [0x10088e98]
mov eax, dword [0x10088f34]
imul ecx, dword [eax + ecx], 0x45
sub ecx, dword [0x10088e1c]
mov eax, dword [0x10088fdc]
add ecx, dword [0x10088e00]
add ecx, dword [0x10088f4c]
cmp dword [0x10087750], 0
je 0x1000dd68
mov edx, 1
jmp 0x1000dd6a
xor edx, edx
mov word [ecx + eax], dx
cmp dword [0x100879c0], 0
je 0x1000ddc7
mov eax, dword [0x10089138]
cmp dword [eax], 0
jne 0x1000ddc7
mov eax, dword [0x10087978]
inc eax
mov dword [0x10087978], eax
mov ecx, eax
cmp eax, 9
jbe 0x1000dda3
mov dword [0x10087978], 0xffffffff
or eax, 0xffffffff
or ecx, 0xffffffff
cmp eax, 0xa
jae 0x1000ddc7
lea ecx, [ecx*4 + 0xc]
sub ecx, dword [0x10088f60]
add ecx, dword [0x1008908c]
mov eax, dword [0x10089078]
mov dword [ecx + eax], 0
mov eax, dword [0x10089138]
cmp dword [eax], 1
jne 0x1000ded0
mov eax, dword [0x10089014]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000ded0
mov eax, dword [0x10088ec4]
movss xmm0, dword [0x10087ad4]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx + 0x10], xmm0
movss xmm0, dword [0x10087a9c]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx], xmm0
mov eax, dword [0x10087684]
cmp eax, 1
jne 0x1000de2d
mov dword [0x10087ad4], 0x3d4ccccd
mov dword [0x10087a9c], 0x3dcccccd
jmp 0x1000ded0
cmp eax, 2
jne 0x1000de4b
mov dword [0x10087ad4], 0x3dcccccd
mov dword [0x10087a9c], 0x3e19999a
jmp 0x1000ded0
cmp eax, 3
jne 0x1000de66
mov dword [0x10087ad4], 0x3e19999a
mov dword [0x10087a9c], 0x3e4ccccd
jmp 0x1000ded0
cmp eax, 4
jne 0x1000de81
mov dword [0x10087ad4], 0x3e4ccccd
mov dword [0x10087a9c], 0x3e800000
jmp 0x1000ded0
cmp eax, 5
jne 0x1000de9c
mov dword [0x10087ad4], 0x3e800000
mov dword [0x10087a9c], 0x3e99999a
jmp 0x1000ded0
cmp eax, 6
jne 0x1000deb7
mov dword [0x10087ad4], 0x3e99999a
mov dword [0x10087a9c], 0x3eb33333
jmp 0x1000ded0
cmp eax, 7
jne 0x1000ded0
mov dword [0x10087ad4], 0x3eb33333
mov dword [0x10087a9c], 0x3ecccccd
call fcn.1000e950
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x100876d8], 0
je 0x1000df31
cmp byte [0x1008772b], 0
jne 0x1000df27
mov esi, dword [0x10089134]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x66
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov al, 1
jmp 0x1000df7a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x1000df7a
cmp byte [0x1008772b], 1
jne 0x1000df72
mov esi, dword [0x10089134]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x46
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
jmp 0x1000df78
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov byte [0x1008772b], al
cmp dword [0x10087d78], 0
je 0x1000dfc3
mov eax, dword [0x10088fe8]
mov esi, dword [eax]
test esi, esi
je 0x1000dfc3
mov ecx, dword [0x10087800]
sub ecx, dword [0x10088e1c]
add ecx, dword [0x10088f4c]
mov eax, dword [0x10088fdc]
mov ecx, dword [ecx + eax]
call fcn.10008130
test eax, eax
jle 0x1000dfc3
mov dword [esi], 0x42700000
mov dword [esi + 4], 0x42700000
mov eax, dword [0x100876a8]
cmp eax, 1
jne 0x1000e014
cmp byte [0x10087abb], 0
jne 0x1000e00b
mov esi, dword [0x10088e14]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x7a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10087abb], 1
jmp 0x1000e05d
test eax, eax
jne 0x1000e05d
cmp byte [0x10087abb], 1
jne 0x1000e056
mov esi, dword [0x10088e14]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x77a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10087abb], 0
mov eax, dword [0x10088e20]
cmp dword [eax], 6
jne 0x1000e11a
mov eax, dword [0x10089138]
cmp dword [eax], 0
jne 0x1000e11a
cmp dword [0x10087ac4], 0
je 0x1000e0d3
cmp byte [0x10087691], 0
jne 0x1000e0c0
mov esi, dword [0x10088e18]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x15eb
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x100878d3], 0
mov al, 1
mov byte [0x10087691], al
jmp 0x1000e166
cmp byte [0x10087691], 1
jne 0x1000e111
mov esi, dword [0x10088e18]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
xor al, al
mov byte [0x10087691], al
jmp 0x1000e166
cmp byte [0x100878d3], 0
jne 0x1000e158
mov esi, dword [0x10088e18]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x100878d3], 1
mov byte [0x10087691], 0
mov eax, dword [0x10087ac8]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000e18f
mov eax, dword [0x10088e7c]
cmp dword [0x10087744], 0
je 0x1000e188
mov dword [ecx + eax], 0x42480000
jmp 0x1000e18f
mov dword [ecx + eax], 0
call fcn.1000e320
cmp dword [0x10087894], 0
je 0x1000e291
mov dword [0x10087894], 0
mov dword [0x10087d48], 1
mov dword [0x100878a4], 8
mov dword [0x10087798], 1
mov dword [0x10087700], 1
mov dword [0x100879e4], 1
mov dword [0x10087758], 1
mov dword [0x100876c4], 1
mov dword [0x10087684], 7
mov dword [0x10087784], 1
mov dword [0x10087a18], 4
mov dword [0x10087d70], 4
mov dword [0x100879c4], 4
mov dword [0x100879d8], 4
mov dword [0x100878dc], 1
mov dword [0x10087ac0], 1
mov dword [0x1008789c], 1
mov dword [0x100876a8], 1
mov dword [0x10087d78], 1
mov dword [0x100879c0], 1
mov dword [0x100877f8], 1
mov dword [0x100877c4], 1
mov dword [0x10087744], 1
mov dword [0x10087d74], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1006b10b
mov esp, ebp
pop ebp
ret