Function at 0x1000dbc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019c08
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10023018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1011fabc], 0
je 0x1000dd82
mov eax, dword [0x1011fae4]
mov dword [0x1011fab8], 0
mov dword [0x1011fac0], 1
cmp eax, 4
ja case.0x1000dc15.0
jmp dword [eax*4 + 0x1000e138]
mov eax, 5
jmp 0x1000dc36
mov eax, 4
jmp 0x1000dc36
mov eax, 2
jmp 0x1000dc36
mov eax, 6
fld dword [0x10024250]
push eax
push ecx
fstp dword [esp]
call fcn.10009b60
push eax
call fcn.10009770
cmp dword [0x1011fac0], 0
mov esi, eax
je 0x1000dc8a
fld dword [0x10024250]
test esi, esi
je 0x1000dca3
push 0xffff0000
push 0x1e
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x1011c570]
fstp dword [esp + 4]
fld dword [0x1011f4d4]
fstp dword [esp]
call fcn.1000bba0
add esp, 0x14
test esi, esi
je 0x1000dd82
mov eax, dword [0x1011fae4]
cmp eax, 4
ja case.0x1000dc9c.0
jmp dword [eax*4 + 0x1000e14c]
push 0xff00ff00
push 0x1e
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x1011c570]
fstp dword [esp + 4]
fld dword [0x1011f4d4]
fstp dword [esp]
call fcn.1000bba0
add esp, 0x14
jmp 0x1000dd82
mov edi, 5
jmp 0x1000dceb
mov edi, 4
jmp 0x1000dceb
mov edi, 2
jmp 0x1000dceb
mov edi, 6
push esi
call fcn.10008aa0
mov esi, eax
call fcn.100089c0
fld dword [eax + 0x30]
fstp dword [ebp - 0x2c]
call fcn.100089c0
fld dword [eax + 0x34]
fstp dword [ebp - 0x3c]
call fcn.100089c0
fld dword [eax + 0x38]
fstp dword [ebp - 0x40]
fld dword [ebp - 0x2c]
fstp dword [ebp - 0x38]
fld dword [ebp - 0x40]
fstp dword [ebp - 0x30]
fld dword [ebp - 0x3c]
fadd qword [0x1001eda8]
fstp dword [ebp - 0x34]
call fcn.1000db60
test al, al
je 0x1000dd82
mov eax, dword [0x1011fad8]
cmp eax, 4
ja case.0x1000dd3f.0
jmp dword [eax*4 + 0x1000e160]
fild dword [0x1011fad8]
fmul qword [0x1001edb0]
jmp 0x1000dd5a
fld dword [0x1001e7cc]
mov ecx, dword [ebp - 0x38]
fstp dword [ebp - 0x2c]
fld dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
sub esp, 0x10
mov eax, esp
fstp dword [esp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
call fcn.1000d950
add esp, 0x10
cmp dword [0x1011fab0], 0
je 0x1000dedb
mov eax, dword [0x1011fae4]
mov dword [0x1011fab8], 0
mov dword [0x1011fac0], 1
cmp eax, 4
ja case.0x1000ddad.0
jmp dword [eax*4 + 0x1000e174]
mov esi, 5
jmp 0x1000ddce
mov esi, 4
jmp 0x1000ddce
mov esi, 2
jmp 0x1000ddce
mov esi, 6
call fcn.10009b60
push esi
call fcn.10009900
cmp dword [0x1011fac0], 0
mov esi, eax
je 0x1000de17
fld dword [0x10024250]
test esi, esi
je 0x1000de30
push 0xffff0000
push 0x1e
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x1011c570]
fstp dword [esp + 4]
fld dword [0x1011f4d4]
fstp dword [esp]
call fcn.1000bba0
add esp, 0x14
test esi, esi
je 0x1000de59
mov eax, dword [0x1011fae4]
cmp eax, 4
ja case.0x1000de29.0
jmp dword [eax*4 + 0x1000e188]
push 0xff00ff00
push 0x1e
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x1011c570]
fstp dword [esp + 4]
fld dword [0x1011f4d4]
fstp dword [esp]
call fcn.1000bba0
add esp, 0x14
mov edi, 0x22ca8bb8
lea esi, [ebp - 0x28]
call fcn.10015b70
mov dword [ebp - 4], 2
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x44]
push ecx
push 0x40
mov esi, eax
push 1
push esi
call edi
push 1
push 0x1001e25c
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 0x44]
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
push eax
push 1
push esi
call edi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov byte [ebp - 0x12], al
cmp dword [0x1011fab8], 0
je 0x1000e11b
mov eax, dword [0x1011fae4]
mov dword [0x1011fabc], 0
cmp eax, 4
ja case.0x1000df00.0
jmp dword [eax*4 + 0x1000e19c]
mov edi, 5
jmp 0x1000df21
mov edi, 4
jmp 0x1000df21
mov edi, 2
jmp 0x1000df21
mov edi, 6
push esi
call fcn.10008aa0
mov esi, eax
call fcn.100089c0
fld dword [eax + 0x30]
fstp dword [ebp - 0x3c]
call fcn.100089c0
fld dword [eax + 0x34]
fstp dword [ebp - 0x2c]
call fcn.100089c0
fld dword [eax + 0x38]
push 1
fstp dword [ebp - 0x40]
fld dword [ebp - 0x3c]
fstp dword [ebp - 0x38]
fld dword [ebp - 0x40]
fstp dword [ebp - 0x30]
fld dword [ebp - 0x2c]
fadd qword [0x1001eda8]
fstp dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, 0x22ca8bb8
lea esi, [ebp - 0x28]
test ax, ax
je 0x1000dfff
call fcn.10015b70
mov dword [ebp - 4], 0
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push 0x1001e258
push eax
mov eax, dword [edx + 0x28]
call eax
mov esi, 1
mov edi, eax
call fcn.10002bb0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x1011fad8]
cmp eax, 4
ja case.0x1000dfb7.0
jmp dword [eax*4 + 0x1000e1b0]
fild dword [0x1011fad8]
fmul qword [0x1001edb0]
jmp 0x1000dfd2
fld dword [0x1001e7cc]
mov ecx, dword [ebp - 0x38]
fstp dword [ebp - 0x2c]
fld dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
sub esp, 0x10
mov eax, esp
fstp dword [esp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
call fcn.1000d950
add esp, 0x10
jmp 0x1000dedb
call fcn.10015b70
mov dword [ebp - 4], 1
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push 0x1001e25c
push eax
mov eax, dword [edx + 0x28]
call eax
mov esi, 1
mov edi, eax
call fcn.10002bb0
mov dword [ebp - 4], 0xffffffff
jmp 0x1000dedb
mov eax, 5
jmp 0x1000e050
mov eax, 4
jmp 0x1000e050
mov eax, 2
jmp 0x1000e050
mov eax, 6
push eax
call fcn.10009b60
push eax
call fcn.10009610
test eax, eax
je 0x1000e11b
mov ecx, dword [0x1011fae4]
cmp ecx, 4
ja case.0x1000e06f.0
jmp dword [ecx*4 + 0x1000e1c4]
mov edi, 5
jmp 0x1000e090
mov edi, 4
jmp 0x1000e090
mov edi, 2
jmp 0x1000e090
mov edi, 6
push eax
call fcn.10008aa0
mov esi, eax
call fcn.100089c0
fld dword [eax + 0x30]
fstp dword [ebp - 0x38]
call fcn.100089c0
fld dword [eax + 0x34]
fstp dword [ebp - 0x34]
call fcn.100089c0
fld dword [eax + 0x38]
fstp dword [ebp - 0x30]
fld dword [ebp - 0x34]
fadd qword [0x1001eda8]
fstp dword [ebp - 0x34]
call fcn.1000db60
test al, al
je 0x1000e11b
mov eax, dword [0x1011fad8]
cmp eax, 4
ja case.0x1000e0d8.0
jmp dword [eax*4 + 0x1000e1d8]
fild dword [0x1011fad8]
fmul qword [0x1001edb0]
jmp 0x1000e0f3
fld dword [0x1001e7cc]
mov ecx, dword [ebp - 0x38]
fstp dword [ebp - 0x2c]
fld dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
sub esp, 0x10
mov eax, esp
fstp dword [esp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
call fcn.1000d950
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017c55
mov esp, ebp
pop ebp
ret