Function at 0x1000bcc0
Capabilities:
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008b420
push 0x10071a3c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1008f400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
call fcn.10015980
call fcn.10015770
call fcn.10015fe0
call fcn.10015360
call fcn.10015f20
call fcn.100152d0
call fcn.10014a80
call fcn.10015e50
call fcn.10013f80
call fcn.100154e0
call fcn.10014ed0
call fcn.100156f0
mov eax, dword [0x10091758]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000bd9d
mov eax, dword [0x100936bc]
movss xmm0, dword [0x1008a64c]
comiss xmm0, dword [ecx + eax]
jbe 0x1000bd9d
mov eax, dword [0x1009350c]
mov ecx, dword [ecx + eax]
test ecx, ecx
je 0x1000bd9d
mov eax, dword [0x10093714]
mov ecx, dword [ecx + eax]
test ecx, ecx
je 0x1000bd9d
mov eax, dword [0x10093768]
mov ecx, dword [ecx + eax]
test ecx, ecx
je 0x1000bd9d
mov eax, dword [0x100936e8]
mov eax, dword [ecx + eax + 0xc]
cmp dword [0x1009133c], 1
jne 0x1000bd97
mov dword [eax], 0xc479c000
wait
jmp 0x1000bda9
mov dword [eax], 0x3ecccccd
wait
jmp 0x1000bda9
mov dword [ebp - 4], 0xfffffffe
call fcn.1000eae0
call fcn.10014b80
call fcn.10015000
mov eax, dword [0x10093834]
cmp dword [eax], 1
jne 0x1000bde9
cmp dword [0x10091490], 0
je 0x1000bde9
push 0x74
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 9
je 0x1000bde9
mov eax, dword [0x10093834]
mov dword [eax], 4
mov eax, dword [0x10093834]
mov eax, dword [eax]
cmp eax, 1
je 0x1000bdff
cmp eax, 2
je 0x1000bdff
cmp eax, 3
jne 0x1000be3b
mov ecx, dword [0x10093534]
mov eax, dword [0x100935e0]
imul ecx, dword [eax + ecx], 0x45
sub ecx, dword [0x100934b0]
mov eax, dword [0x100936a4]
add ecx, dword [0x1009348c]
add ecx, dword [0x100935f8]
cmp dword [0x100913e0], 0
je 0x1000be35
mov edx, 1
jmp 0x1000be37
xor edx, edx
mov word [ecx + eax], dx
cmp dword [0x1009164c], 0
je 0x1000be94
mov eax, dword [0x10093834]
cmp dword [eax], 0
jne 0x1000be94
mov eax, dword [0x10091608]
inc eax
mov dword [0x10091608], eax
mov ecx, eax
cmp eax, 9
jbe 0x1000be70
mov dword [0x10091608], 0xffffffff
or eax, 0xffffffff
or ecx, 0xffffffff
cmp eax, 0xa
jae 0x1000be94
lea ecx, [ecx*4 + 0xc]
sub ecx, dword [0x10093608]
add ecx, dword [0x10093778]
mov eax, dword [0x10093764]
mov dword [ecx + eax], 0
mov eax, dword [0x10093834]
cmp dword [eax], 1
jne 0x1000bf9d
mov eax, dword [0x100936e4]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000bf9d
mov eax, dword [0x1009356c]
movss xmm0, dword [0x10091768]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx + 0x10], xmm0
movss xmm0, dword [0x10091728]
shufps xmm0, xmm0, 0
movups xmmword [eax + ecx], xmm0
mov eax, dword [0x1009130c]
cmp eax, 1
jne 0x1000befa
mov dword [0x10091768], 0x3d4ccccd
mov dword [0x10091728], 0x3dcccccd
jmp 0x1000bf9d
cmp eax, 2
jne 0x1000bf18
mov dword [0x10091768], 0x3dcccccd
mov dword [0x10091728], 0x3e19999a
jmp 0x1000bf9d
cmp eax, 3
jne 0x1000bf33
mov dword [0x10091768], 0x3e19999a
mov dword [0x10091728], 0x3e4ccccd
jmp 0x1000bf9d
cmp eax, 4
jne 0x1000bf4e
mov dword [0x10091768], 0x3e4ccccd
mov dword [0x10091728], 0x3e800000
jmp 0x1000bf9d
cmp eax, 5
jne 0x1000bf69
mov dword [0x10091768], 0x3e800000
mov dword [0x10091728], 0x3e99999a
jmp 0x1000bf9d
cmp eax, 6
jne 0x1000bf84
mov dword [0x10091768], 0x3e99999a
mov dword [0x10091728], 0x3eb33333
jmp 0x1000bf9d
cmp eax, 7
jne 0x1000bf9d
mov dword [0x10091768], 0x3eb33333
mov dword [0x10091728], 0x3ecccccd
call fcn.10014400
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x10091368], 0
je 0x1000bffe
cmp byte [0x100913bb], 0
jne 0x1000bff4
mov esi, dword [0x1009382c]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x66
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
mov al, 1
jmp 0x1000c047
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x1000c047
cmp byte [0x100913bb], 1
jne 0x1000c03f
mov esi, dword [0x1009382c]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 1
push esi
call ebx
push 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push 1
call edi
mov byte [esi], 0x46
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 1
push esi
call ebx
jmp 0x1000c045
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov byte [0x100913bb], al
cmp dword [0x1009240c], 0
je 0x1000c090
mov eax, dword [0x100936b0]
mov esi, dword [eax]
test esi, esi
je 0x1000c090
mov ecx, dword [0x10091494]
sub ecx, dword [0x100934b0]
add ecx, dword [0x100935f8]
mov eax, dword [0x100936a4]
mov ecx, dword [ecx + eax]
call fcn.10006ac0
test eax, eax
jle 0x1000c090
mov dword [esi], 0x42700000
mov dword [esi + 4], 0x42700000
mov eax, dword [0x10091330]
cmp eax, 1
jne 0x1000c0e1
cmp byte [0x10091756], 0
jne 0x1000c0d8
mov esi, dword [0x100934a4]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x7a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10091756], 1
jmp 0x1000c12a
test eax, eax
jne 0x1000c12a
cmp byte [0x10091756], 1
jne 0x1000c123
mov esi, dword [0x100934a4]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x77a
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10091756], 0
mov eax, dword [0x100934b4]
cmp dword [eax], 6
jne 0x1000c1e7
mov eax, dword [0x10093834]
cmp dword [eax], 0
jne 0x1000c1e7
cmp dword [0x10091750], 0
je 0x1000c1a0
cmp byte [0x10091319], 0
jne 0x1000c18d
mov esi, dword [0x100934a8]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x15eb
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10091563], 0
mov al, 1
mov byte [0x10091319], al
jmp 0x1000c233
cmp byte [0x10091319], 1
jne 0x1000c1de
mov esi, dword [0x100934a8]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
xor al, al
mov byte [0x10091319], al
jmp 0x1000c233
cmp byte [0x10091563], 0
jne 0x1000c225
mov esi, dword [0x100934a8]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0x1578
mov word [esi], ax
push 1
call edi
push 1
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call ebx
mov byte [0x10091563], 1
mov byte [0x10091319], 0
mov eax, dword [0x10091758]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000c25c
mov eax, dword [0x10093510]
cmp dword [0x100913d4], 0
je 0x1000c255
mov dword [ecx + eax], 0x42480000
jmp 0x1000c25c
mov dword [ecx + eax], 0
call fcn.10013ff0
cmp dword [0x10091528], 0
je 0x1000c35e
mov dword [0x10091528], 0
mov dword [0x100919dc], 1
mov dword [0x10091538], 8
mov dword [0x1009142c], 1
mov dword [0x10091390], 1
mov dword [0x10091670], 1
mov dword [0x100913ec], 1
mov dword [0x10091350], 1
mov dword [0x1009130c], 7
mov dword [0x10091414], 1
mov dword [0x100916a4], 4
mov dword [0x10092404], 4
mov dword [0x10091650], 4
mov dword [0x10091664], 4
mov dword [0x1009156c], 1
mov dword [0x1009174c], 1
mov dword [0x10091530], 1
mov dword [0x10091330], 1
mov dword [0x1009240c], 1
mov dword [0x1009164c], 1
mov dword [0x1009148c], 1
mov dword [0x10091458], 1
mov dword [0x100913d4], 1
mov dword [0x10092408], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10071a6b
mov esp, ebp
pop ebp
ret