Function at 0x1001ec77
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push 4
call fcn.1006841c
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx], 0x100851cc
jmp 0x1001ecb0
push 0x3e8
call 0x1001f6cf
call 0x1001f839
push reloc.WS2_32.dll_getsockname
push 0
push 0x10043380
push 1
mov ebx, 0x9dc
call fcn.10069b40
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push 0
push 0
push dword [ebp - 8]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1001ed25
push 0xca
push 0x40107a3
push 6
call fcn.10068410
add esp, 0xc
cmp dword [0x113efbd0], 0
jne 0x1001eeb8
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, 0x10084635
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1001e423
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1001ed63
push ebx
call fcn.10068422
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1001ed73
push ebx
call fcn.10068422
add esp, 4
lea eax, [ebp - 0x10]
push eax
call fcn.1001e9d0
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1001ed8f
push ebx
call fcn.10068422
add esp, 4
push getsockname
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x1001eda2
mov eax, 0x10081277
push eax
push 1
mov ebx, 0x168
call fcn.10068d60
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1001edc8
push ebx
call fcn.10068422
add esp, 4
mov dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x1008463d
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.1001e423
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x1001edf9
push ebx
call fcn.10068422
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1001ee09
push ebx
call fcn.10068422
add esp, 4
lea eax, [ebp - 0x24]
push eax
call fcn.1001e9d0
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x1001ee25
push ebx
call fcn.10068422
add esp, 4
push getsockname
push 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1001ee38
mov eax, 0x10081277
push eax
push 1
mov ebx, 0x168
call fcn.10068d60
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x1001ee5e
push ebx
call fcn.10068422
add esp, 4
mov dword [ebp - 0x30], esp
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
xor eax, eax
call dword [sym.imp.USER32.dll_FindWindowA]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x1001ee8d
push 0x331
push 0x40107a3
push 6
call fcn.10068410
add esp, 0xc
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1001eea0
push ebx
call fcn.10068422
add esp, 4
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x1001eeb0
push ebx
call fcn.10068422
add esp, 4
mov eax, dword [ebp - 0x34]
mov dword [0x113efbd0], eax
cmp dword [0x113efbd0], 1
jle 0x1001ef52
push 0x80000301
push 0
push 0x3e8
push 1
mov ebx, 0x67c
call fcn.1006a970
add esp, 0x10
mov dword [ebp - 8], esp
push 0x113efbd4
push dword [0x113efbd0]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x1001ef17
push 0x423
push 0x40107a3
push 6
call fcn.10068410
add esp, 0xc
cmp dword [0x113efbd8], 0
jne 0x1001ef2f
push dword [0x113efbd4]
call fcn.100245f6
push 0x80000301
push 0
push 0x3e8
push 1
mov ebx, 0x67c
call fcn.1006a970
add esp, 0x10
jmp 0x1001efbf
mov dword [ebp - 8], esp
push 0x23
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 8], esp
je 0x1001ef80
push 0x51e
push 0x40107a3
push 6
call fcn.10068410
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1001ef9c
call fcn.100246c2
push 0
call fcn.1006843a
add esp, 4
push 0x80000301
push 0
push 0x3e8
push 1
mov ebx, 0x67c
call fcn.1006a970
add esp, 0x10
jmp 0x1001ed25
push 0x80000301
push 0
push 0x7d0
push 1
mov ebx, 0x67c
call fcn.1006a970
add esp, 0x10
push 0x80000301
push 0
push 0x3e8
push 1
mov ebx, 0x67c
call fcn.1006a970
add esp, 0x10
mov eax, 0x10084645
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1001f028
push ebx
call fcn.10068422
add esp, 4
cmp dword [ebp - 0xc], 4
je 0x1001f0ca
push 0x80000301
push 0
push 0x1388
push 1
mov ebx, 0x67c
call fcn.1006a970
add esp, 0x10
mov eax, 0x10084645
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1001f07d
push ebx
call fcn.10068422
add esp, 4
cmp dword [ebp - 0xc], 4
je 0x1001f0ca
call fcn.100246c2
mov ebx, 6
call fcn.10002c82
push 0x80000301
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x1008465a
push 4
mov ebx, 0x300
call fcn.10069110
add esp, 0x34
push 0
call fcn.1006843a
add esp, 4
call fcn.100246c9
xor eax, eax
cmp dword [0x113efbe0], 0
jg 0x1001f0e9
jl 0x1001f0e8
cmp dword [0x113efbdc], 0x186a0
jae 0x1001f0e9
inc eax
test eax, eax
je 0x1001f134
call fcn.100246c2
mov ebx, 6
call fcn.10002c82
push 0x80000301
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x1008466c
push 4
mov ebx, 0x300
call fcn.10069110
add esp, 0x34
push 0
call fcn.1006843a
add esp, 4
push reloc.WS2_32.dll_getsockname
push 0
push 0x10056507
push 1
mov ebx, 0x9dc
call fcn.10069b40
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push 0
push 0
push dword [ebp - 8]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1001f19a
push 0x967
push 0x40107a3
push 6
call fcn.10068410
add esp, 0xc
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
mov eax, 0x10084680
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10025a27
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1001f1ca
push ebx
call fcn.10068422
add esp, 4
push 1
push dword [ebp - 0x10]
call fcn.10026169
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [0x113efbe4]
test ebx, ebx
je 0x1001f1ee
push ebx
call fcn.10068422
add esp, 4
pop eax
mov dword [0x113efbe4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [0x113efbe4]
test eax, eax
jne 0x1001f209
mov eax, 0x1008124f
push eax
push 1
mov ebx, 0x24c
call fcn.1006a960
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1001f30a
push 0x80000301
push 0
push 0x1770
push 1
mov ebx, 0x67c
call fcn.1006a970
add esp, 0x10
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
mov eax, 0x10084680
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10025a27
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1001f277
push ebx
call fcn.10068422
add esp, 4
push 1
push dword [ebp - 0x10]
call fcn.10026169
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [0x113efbe4]
test ebx, ebx
je 0x1001f29b
push ebx
call fcn.10068422
add esp, 4
pop eax
mov dword [0x113efbe4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [0x113efbe4]
test eax, eax
jne 0x1001f2b6
mov eax, 0x1008124f
push eax
push 1
mov ebx, 0x24c
call fcn.1006a960
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1001f30a
mov ebx, 6
call fcn.10002c82
push 0x80000301
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x10084698
push 4
mov ebx, 0x300
call fcn.10069110
add esp, 0x34
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [0x113efbe4]
test eax, eax
jne 0x1001f31f
mov eax, 0x1008124f
push eax
push 1
mov ebx, 0x130
call fcn.10069350
add esp, 0x10
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fsub qword [0x100846bd]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.10001bbe
push 0x80000301
push 0
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [0x113efbe4]
test eax, eax
jne 0x1001f36c
mov eax, 0x1008124f
push eax
push 2
mov ebx, 0x134
call fcn.10069780
add esp, 0x1c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [0x113efbe4]
test ebx, ebx
je 0x1001f399
push ebx
call fcn.10068422
add esp, 4
pop eax
mov dword [0x113efbe4], eax
push 0
push 0
push 0
push 1
mov ebx, 0x90
call fcn.1006b990
add esp, 0x10
push dword [0x113efbd0]
call fcn.10026599
mov ebx, dword [0x113efbe8]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 1
push 0
push 0
push 0
push 1
mov ebx, 0x90
call fcn.1006b990
add esp, 0x10
push 0
mov ebx, 0x2d4
call fcn.1006b9c0
add esp, 4
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x14
push 0x80000301
push 0
push 1
push 2
mov ebx, 0x94
call fcn.1006b9d0
add esp, 0x1c
mov dword [ebp - 0xc], eax
fild dword [ebp - 8]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fild dword [ebp - 0xc]
fstp qword [ebp - 0x1c]
fadd qword [ebp - 0x1c]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.10001bbe
mov dword [0x113efbec], eax
push 0
mov ebx, 0x2d8
call fcn.1006ba30
add esp, 4
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x14
push 0x80000301
push 0
push 1
push 2
mov ebx, 0x94
call fcn.1006b9d0
add esp, 0x1c
mov dword [ebp - 0xc], eax
fild dword [ebp - 8]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fild dword [ebp - 0xc]
fstp qword [ebp - 0x1c]
fadd qword [ebp - 0x1c]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.10001bbe
mov dword [0x113efbf0], eax
mov ebx, dword [0x113efbf4]
mov dword [ebp - 8], ebx
mov ebx, dword [0x113efbf8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
fild dword [ebx]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x100846c5]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fstp dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov ebx, dword [0x113efbf4]
add ebx, 4
mov dword [ebp - 8], ebx
mov ebx, dword [0x113efbf8]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
fild dword [ebx]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x100846cd]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fstp dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov ebx, dword [0x113efbfc]
mov dword [ebp - 8], ebx
mov ebx, dword [0x113efbf8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
fild dword [ebx]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x1008427b]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fstp dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov ebx, dword [0x113efbfc]
add ebx, 4
mov dword [ebp - 8], ebx
mov ebx, dword [0x113efbf8]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
fild dword [ebx]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x100846d5]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fstp dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov ebx, dword [0x113efbf4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
fld dword [ebx]
fadd qword [0x10083ec0]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
call fcn.10001bbe
mov dword [0x113efc00], eax
mov ebx, dword [0x113efbf4]
add ebx, 4
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
fld dword [ebx]
fadd qword [0x100846dd]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
call fcn.10001bbe
mov dword [0x113efc04], eax
mov ebx, dword [0x113efbe8]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 1
mov dword [ebp - 8], esp
push 0x1008124f
push 0x100846e5
push 0
push 0
xor eax, eax
call dword [0x113f0090]
nop
nop
cmp dword [ebp - 8], esp
je 0x1001f62a
push 0x1052
push 0x40107a3
push 6
call fcn.10068410
add esp, 0xc
mov dword [0x113efc08], eax
push 1
push 0
push 1
mov eax, 0x100846f3
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 1
push 0x41800000
push dword [0x113efbf0]
push dword [0x113efbec]
push dword [0x113efc08]
call fcn.100269d5
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1001f672
push ebx
call fcn.10068422
add esp, 4
mov eax, 0x100846fe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.10027cdb
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1001f699
push ebx
call fcn.10068422
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [0x113efc0c], eax
call fcn.10027df0
call fcn.1002826e
jmp 0x1001f6bb
mov ebx, dword [ebp - 4]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.10068422
add esp, 4
mov esp, ebp
pop ebp
ret