Function at 0x10001730
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x10009018]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0x10faa5d0]
mov ecx, dword [esi]
mov edx, dword [ecx + 0xe4]
push edi
xor edi, edi
push edi
push 7
push esi
mov dword [esp + 0x1c], eax
call edx
mov eax, dword [0x10009654]
cmp eax, edi
je 0x1000177b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x10009654], edi
push 0x10009654
push str.Arial
push edi
push 2
push edi
mov ebx, 1
push ebx
push edi
push ebx
push 0x190
push edi
push 0xe
push esi
call dword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
cmp dword [0x10faa3cc], edi
je 0x10001801
mov eax, dword [esi]
mov edx, dword [eax + 0xc0]
lea ecx, [esp + 0x1c]
push ecx
push esi
call edx
fild dword [esp + 0x28]
mov eax, dword [esp + 0x28]
test eax, eax
jns 0x100017ca
fadd dword [0x10007570]
fld qword [0x10007568]
fmul st(1), st(0)
fxch st(1)
call fcn.10006070
fild dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
test ecx, ecx
jns 0x100017eb
fadd dword [0x10007570]
fmulp st(1)
mov dword [esp + 0x14], eax
call fcn.10006070
mov ecx, dword [esp + 0x14]
mov edx, eax
call fcn.10001170
mov eax, dword [0x10faa3c8]
mov dl, byte [0x10faa3e4]
mov ecx, dword [0x1000965c]
cmp eax, edi
jne 0x1000181a
cmp ecx, edi
je 0x10001835
test dl, dl
jne 0x1000182d
push edi
push edi
mov byte [0x10faa3e4], bl
push 0x10001670
jmp 0x10001847
cmp eax, edi
jne 0x10001850
cmp ecx, edi
jne 0x10001850
test dl, dl
je 0x10001850
push edi
push edi
mov byte [0x10faa3e4], 0
push 0x10001720
call dword [sym.imp.MSVCR100.dll__beginthread]
add esp, 0xc
push 0x2d
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bl, al
je 0x1000186d
xor edx, edx
cmp dword [0x100091c8], edi
sete dl
mov dword [0x100091c8], edx
cmp dword [0x100091c8], edi
je 0x10002012
fldz
mov eax, dword [esi]
mov edx, dword [eax + 0xac]
push edi
push ecx
fstp dword [esp]
push 0xff000000
push ebx
lea ecx, [esp + 0x2c]
push ecx
push ebx
push esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], 0xaa
mov dword [esp + 0x44], 0x110
call edx
push 0xffff0000
push ebx
push edi
push edi
mov edx, 0x10e
call fcn.10001080
push 0xffff0000
push 0xaa
push 0x10e
push edi
mov edx, ebx
call fcn.10001080
push 0xffff0000
push 0xaa
push edi
push edi
mov edx, ebx
call fcn.10001080
push 0xffff0000
push ebx
push edi
push 0xaa
mov edx, 0x10f
call fcn.10001080
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_SetRect]
add esp, 0x40
add eax, 2
push eax
add ecx, 0xa
push ecx
push eax
push ecx
lea eax, [esp + 0x2c]
push eax
call esi
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push 0xff7fff00
push 0x100
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x1c]
push 0xffffffffffffffff
push edx
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], ebx
mov dword [eax + 0x10fa9a78], 0x10009670
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
mov dword [esp + 0x10], ecx
push 0xf
push 0xf
push 0xf
push 0xf
lea edx, [esp + 0x2c]
push edx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x1000726c
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x1e
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 2
push 0xf
mov dword [eax + 0x10fa9a78], 0x10faa3cc
push 0x1e
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007270
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x2d
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 3
push 0xf
mov dword [eax + 0x10fa9a78], 0x10009674
push 0x2d
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007278
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x3c
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 4
push 0xf
mov dword [eax + 0x10fa9a78], 0x10009678
push 0x3c
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007284
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x4b
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 5
push 0xf
mov dword [eax + 0x10fa9a78], 0x10faa3c4
push 0x4b
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], 3
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007294
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 6
mov dword [eax + 0x10fa9a78], 0x10009650
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0x5a
push 0xf
push 0x5a
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072a4
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x69
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 7
push 0xf
mov dword [eax + 0x10fa9a78], 0x1000966c
push 0x69
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072b0
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x78
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 8
push 0xf
mov dword [eax + 0x10fa9a78], 0x10faa3c8
push 0x78
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072c0
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x87
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 9
push 0xf
mov dword [eax + 0x10fa9a78], 0x1000965c
push 0x87
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072cc
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
push 0x96
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 0xa
push 0xf
mov dword [eax + 0x10fa9a78], 0x10fa9a68
push 0x96
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push str.AFK_
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 0xb
push 0xa5
push 0xf
mov dword [eax + 0x10fa9a78], 0x10faa3bc
push 0xa5
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072e8
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
push 0xb4
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 0xc
push 0xf
mov dword [eax + 0x10fa9a78], 0x10009668
push 0xb4
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x100072f4
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
add eax, eax
push 0xc3
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 0xd
push 0xf
mov dword [eax + 0x10fa9a78], 0x10faa3d0
push 0xc3
mov dword [eax + 0x10fa9a7c], ebx
mov dword [eax + 0x10fa9a80], edi
mov ecx, dword [eax + 0x10fa9a84]
push 0xf
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], ecx
call esi
mov eax, dword [0x10009654]
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push edx
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push 0x10007300
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
mov eax, dword [0x10fa9a6c]
add eax, ebx
mov dword [0x10fa9a6c], eax
lea eax, [eax + eax*2]
push 0xd2
add eax, eax
push 0xf
add eax, eax
add eax, eax
mov dword [eax + 0x10fa9a70], 0xe
push 0xd2
mov dword [eax + 0x10fa9a78], 0x10009664
mov dword [eax + 0x10fa9a7c], ebx
push 0xf
lea ecx, [esp + 0x2c]
mov dword [eax + 0x10fa9a80], edi
mov ebx, dword [eax + 0x10fa9a84]
push ecx
call esi
mov eax, dword [0x10009654]
mov edx, dword [eax]
mov edx, dword [edx + 0x38]
push ebx
push 0x100
lea ecx, [esp + 0x24]
push ecx
push 0xffffffffffffffff
push 0x10007310
push edi
push eax
call edx
call fcn.10001320
push 0xeb
push 5
push 0xeb
push 5
lea eax, [esp + 0x2c]
push eax
call esi
mov eax, dword [0x10009654]
mov ecx, dword [eax]
push 0xfffffffffffffff9
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push str.www.
push edi
push eax
mov eax, dword [ecx + 0x38]
call eax
push 0xfa
push 5
push 0xfa
push 5
lea ecx, [esp + 0x2c]
push ecx
call esi
mov eax, dword [0x10009654]
mov edx, dword [eax]
mov edx, dword [edx + 0x38]
push 0xfffffffffffffff9
push 0x100
lea ecx, [esp + 0x24]
push ecx
push 0xffffffffffffffff
push str.www.ruch
push edi
push eax
call edx
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000565a
mov esp, ebp
pop ebp
ret