Function at 0x100115e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling
Write file on windows

Disassembly:
mov eax, 0x2728
call fcn.10097560
mov eax, dword [0x101222d0]
xor eax, esp
mov dword [esp + 0x2724], eax
push esi
push edi
push 0x79
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x10011766
cmp byte [0x10205f7b], 0
je 0x1001176d
cmp dword [0x2a33c49], 0x19999
je 0x1001174f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push ebp
xor ebp, ebp
lea esp, [esp]
mov eax, dword [ebp + 0x101238b0]
add eax, dword [0x10205f7c]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x10165420
push 1
lea edi, [ebp + 0x1021db48]
push edi
push eax
call esi
push eax
call ebx
cmp byte [0x1021dcce], 0
je 0x100116c9
mov edx, dword [0x10205f7c]
push 0x10165420
push 0x2710
lea ecx, [esp + 0x2c]
push ecx
inc edx
push edx
call esi
push eax
call ebx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000002
push str.a.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [esp + 0x24]
push eax
push 0x2710
lea ecx, [esp + 0x30]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
cmp edi, 2
jne 0x10011711
mov esi, dword [ebp + 0x101238b0]
add esi, dword [0x10205f7c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [esp + 0x14]
push edx
push 0x40
push 1
push esi
call edi
test eax, eax
je 0x10011708
mov edx, dword [esp + 0x14]
mov al, byte [0x1021513c]
lea ecx, [esp + 0x1c]
push ecx
push edx
push 1
push esi
mov byte [esi], al
call edi
mov byte [0x1021daa3], 1
jmp 0x10011738
cmp edi, 4
jne 0x10011738
mov edi, dword [ebp + 0x101238b0]
add edi, dword [0x10205f7c]
push 0x10194554
mov esi, 1
call fcn.10007d00
mov byte [0x1021daa3], 0
add ebp, 4
cmp ebp, 0x18
jl 0x10011640
pop ebp
pop ebx
mov byte [0x10205f7b], 0
jmp 0x1001176d
cmp byte [0x1021daa3], 0
mov byte [0x10205f7b], 0
sete byte [0x1021daa3]
jmp 0x1001176d
mov byte [0x10205f7b], 1
mov esi, dword [0x1019435c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 0x4b5094
cmp byte [0x1021daa3], 0
je 0x100117d6
lea eax, [esp + 8]
push eax
push 0x40
push 5
push esi
call edi
test eax, eax
je 0x100117b8
mov ecx, dword [str.XXXX]
mov dword [esi], ecx
mov ecx, dword [esp + 8]
mov dl, byte [0x101238a8]
lea eax, [esp + 0x10]
push eax
push ecx
push 5
push esi
mov byte [esi + 4], dl
call edi
pop edi
mov byte [0x1021da64], 1
pop esi
mov ecx, dword [esp + 0x2724]
xor ecx, esp
call fcn.10091e94
add esp, 0x2728
ret
lea edx, [esp + 8]
push edx
push 0x40
push 1
push esi
call edi
test eax, eax
je 0x100117fc
mov edx, dword [esp + 8]
mov al, byte [0x101238ac]
lea ecx, [esp + 0x10]
push ecx
push edx
push 1
push esi
mov byte [esi], al
call edi
mov esi, dword [0x1019435c]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
add esi, 0x4b5095
push esi
call edi
test eax, eax
je 0x1001182f
mov eax, dword [esp + 0xc]
mov ecx, dword [0x1021db08]
lea edx, [esp + 0x14]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call edi
mov ecx, dword [esp + 0x272c]
pop edi
pop esi
xor ecx, esp
mov byte [0x1021da64], 0
call fcn.10091e94
add esp, 0x2728
ret