Function at 0x1003daf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x108
mov eax, dword [0x100d5018]
xor eax, esp
mov dword [esp + 0x104], eax
cmp byte [0x100daf30], 0
movss xmm2, dword [0x100ce2fc]
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
je 0x1003e5d0
cmp dword [0x100def4c], 0
jbe 0x1003e5d0
push dword [0x100d5ab8]
call esi
test ax, ax
je 0x1003e5c8
push dword [0x100d5ab8]
call esi
test ax, ax
je 0x1003e5c8
mov cl, 0x75
mov byte [esp + 0x60], 0x19
mov byte [esp + 0x1a], cl
mov al, 0x7a
xor al, byte [esp + 0x60]
mov ah, 0x7c
mov byte [esp + 0x61], al
mov dl, 0x70
mov byte [esp + 0x1b], cl
mov ch, 0x77
xor cl, byte [esp + 0x60]
mov dh, 0x6d
mov byte [esp + 0x62], cl
mov cl, byte [esp + 0x60]
mov byte [esp + 0x18], 0x37
xor ah, cl
mov al, byte [esp + 0x18]
xor dl, cl
xor al, cl
mov byte [esp + 0x19], 0x7d
mov byte [esp + 0x67], al
xor ch, cl
mov al, byte [esp + 0x19]
xor dh, cl
xor al, cl
mov byte [esp + 0x64], ah
mov byte [esp + 0x68], al
mov al, byte [esp + 0x1a]
xor al, cl
mov byte [esp + 0x6b], 0
mov byte [esp + 0x69], al
mov al, byte [esp + 0x1b]
xor al, cl
mov byte [esp + 0x63], dl
mov byte [esp + 0x6a], al
lea eax, [esp + 0x61]
push eax
mov byte [esp + 0x69], ch
mov byte [esp + 0x6a], dh
mov byte [esp + 0x6f], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1003e5c8
cmp dword [0xb6fc58], 1
movd xmm0, dword [0xc9c040]
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x54], xmm0
movd xmm0, dword [0xc9c044]
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x58], xmm0
jne 0x1003e5c8
call fcn.1003a570
movss xmm0, dword [0x100ce468]
xor esi, esi
mov dword [esp + 0x5c], eax
xor edi, edi
mov dword [esp + 0x14], esi
movss dword [esp + 0x34], xmm0
nop dword [eax + eax]
mov cl, 0x6a
mov byte [esp + 0x74], 6
mov byte [esp + 0x19], cl
mov al, 0x65
xor al, byte [esp + 0x74]
mov ah, 0x63
mov byte [esp + 0x75], al
mov dl, 0x6f
mov byte [esp + 0x18], cl
mov ch, 0x68
xor cl, byte [esp + 0x74]
mov dh, 0x72
mov byte [esp + 0x76], cl
mov cl, byte [esp + 0x74]
mov byte [esp + 0x1b], 0x28
xor ah, cl
mov al, byte [esp + 0x1b]
xor dl, cl
xor al, cl
mov byte [esp + 0x1a], 0x62
mov byte [esp + 0x7b], al
xor ch, cl
mov al, byte [esp + 0x1a]
xor dh, cl
xor al, cl
mov byte [esp + 0x78], ah
mov byte [esp + 0x7c], al
mov al, byte [esp + 0x19]
xor al, cl
mov byte [esp + 0x7f], 0
mov byte [esp + 0x7d], al
mov al, byte [esp + 0x18]
xor al, cl
mov byte [esp + 0x77], dl
mov byte [esp + 0x7e], al
lea eax, [esp + 0x75]
push eax
mov byte [esp + 0x7d], ch
mov byte [esp + 0x7e], dh
mov byte [esp + 0x83], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1003e1c0
mov eax, 0xb6fc58
cmp dword [eax], 1
jne 0x1003e1c0
mov eax, dword [0x100daf34]
test eax, eax
jne 0x1003dcf5
mov esi, 0x100daf4c
jmp 0x1003dd05
cmp eax, 1
mov esi, 0x100d6f2c
mov eax, 0x100daf4c
cmovne esi, eax
mov esi, dword [esi + edi]
test esi, esi
je 0x1003e1bc
mov ecx, esi
call fcn.1003a940
test al, al
je 0x1003e1a7
cmp esi, dword [esp + 0x5c]
je 0x1003e1a7
lea edx, [esp + 0x18]
mov byte [esp + 0x18], 0
mov ecx, esi
call fcn.1003ac10
cmp byte [esp + 0x18], 0
je 0x1003e1a7
call fcn.1003a570
lea edx, [esp + 0x48]
mov ecx, eax
call fcn.1003a6d0
lea eax, [esp + 0x38]
mov edx, 8
push eax
mov ecx, esi
call fcn.1003ad40
movss xmm7, dword [esp + 0x44]
mov eax, 0xb6fa2c
movaps xmm6, xmm7
movss dword [esp + 0x28], xmm7
add esp, 4
movups xmm3, xmmword [eax + 0x20]
movups xmm2, xmmword [eax + 0x10]
movups xmm5, xmmword [eax]
movups xmm4, xmmword [eax + 0x30]
mov eax, dword [0xc17044]
movaps xmm0, xmm3
mulss xmm7, xmm3
shufps xmm0, xmm3, 0xaa
mulss xmm6, xmm0
movss xmm0, dword [esp + 0x3c]
movaps xmm1, xmm0
movss dword [esp + 0x28], xmm0
movaps xmm0, xmm2
shufps xmm3, xmm3, 0x55
shufps xmm0, xmm2, 0xaa
mulss xmm1, xmm0
movss xmm0, dword [esp + 0x38]
movss dword [esp + 0x20], xmm0
addss xmm6, xmm1
movaps xmm1, xmm0
movaps xmm0, xmm5
shufps xmm0, xmm5, 0xaa
mulss xmm1, xmm0
movaps xmm0, xmm4
shufps xmm0, xmm4, 0xaa
addss xmm6, xmm1
movss xmm1, dword [0x100ce334]
addss xmm6, xmm0
movss xmm0, dword [esp + 0x3c]
mulss xmm0, xmm2
shufps xmm2, xmm2, 0x55
addss xmm7, xmm0
movss xmm0, dword [esp + 0x20]
mulss xmm0, xmm5
divss xmm1, xmm6
addss xmm7, xmm0
shufps xmm5, xmm5, 0x55
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addss xmm7, xmm4
shufps xmm4, xmm4, 0x55
addsd xmm0, qword [eax*8 + 0x100ce990]
mov eax, dword [0xc17048]
cvtpd2ps xmm0, xmm0
mulss xmm0, xmm1
mulss xmm7, xmm0
movss xmm0, dword [esp + 0x3c]
mulss xmm0, xmm2
movss dword [esp + 0x1c], xmm0
movss xmm0, dword [esp + 0x24]
movss xmm2, dword [esp + 0x1c]
mulss xmm0, xmm3
addss xmm2, xmm0
movss xmm0, dword [esp + 0x20]
mulss xmm0, xmm5
movaps xmm5, xmm2
addss xmm5, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addss xmm5, xmm4
addsd xmm0, qword [eax*8 + 0x100ce990]
cvtpd2ps xmm0, xmm0
mulss xmm0, xmm1
mulss xmm5, xmm0
xorps xmm0, xmm0
comiss xmm6, xmm0
jbe 0x1003e1a7
mov eax, dword [0xbaa410]
cmp eax, 0x1e
je 0x1003e072
cmp eax, 0x1f
je 0x1003e072
cmp eax, 0x21
je 0x1003e072
cmp eax, 0x16
je 0x1003e072
cmp eax, 0x17
je 0x1003e072
cmp eax, 0x18
je 0x1003e072
cmp eax, 0x19
je 0x1003e072
cmp eax, 0x1a
je 0x1003e072
cmp eax, 0x1b
je 0x1003e072
cmp eax, 0x1c
je 0x1003e072
cmp eax, 0x1d
je 0x1003e072
cmp eax, 0x20
je 0x1003e072
movd xmm3, dword [0x100d5abc]
movss xmm2, dword [esp + 0x54]
movss xmm4, dword [0x100ce2fc]
cvtdq2ps xmm3, xmm3
mulss xmm2, xmm4
movaps xmm0, xmm3
addss xmm0, xmm2
comiss xmm0, xmm7
jb 0x1003e1a7
movss xmm1, dword [esp + 0x58]
mulss xmm1, xmm4
movaps xmm0, xmm1
addss xmm0, xmm3
comiss xmm0, xmm5
jb 0x1003e1a7
subss xmm2, xmm3
comiss xmm7, xmm2
jb 0x1003e1a7
subss xmm1, xmm3
comiss xmm5, xmm1
jb 0x1003e1a7
movss xmm0, dword [esp + 0x48]
sub esp, 0x10
movss dword [esp + 0x2c], xmm0
movss xmm0, dword [esp + 0x60]
movss dword [esp + 0x70], xmm0
movsd xmm0, qword [0x100ce3b8]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x38]
subss xmm0, dword [esp + 0x5c]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10095ae0
movsd xmm0, qword [0x100ce3b8]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x30]
subss xmm0, dword [esp + 0x2c]
fstp qword [esp + 0x38]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10095ae0
movsd xmm0, qword [0x100ce3b8]
fadd qword [esp + 0x38]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x34]
subss xmm0, dword [esp + 0x70]
fstp qword [esp + 0x38]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10095ae0
fadd qword [esp + 0x38]
add esp, 0x10
xorps xmm1, xmm1
fstp qword [esp + 0x60]
movsd xmm0, qword [esp + 0x60]
ucomisd xmm1, xmm0
ja 0x1003e03a
sqrtsd xmm0, xmm0
jmp 0x1003e03f
call fcn.100af4f0
movss xmm1, dword [esp + 0x34]
cvtsd2ss xmm0, xmm0
comiss xmm1, xmm0
jb 0x1003e1a7
movss xmm1, dword [0x100ce430]
comiss xmm1, xmm0
jb 0x1003e1a7
movss dword [esp + 0x34], xmm0
mov dword [esp + 0x14], esi
jmp 0x1003e1ab
movss xmm2, dword [esp + 0x54]
movd xmm3, dword [0x100d5abc]
cvtps2pd xmm2, xmm2
cvtdq2pd xmm3, xmm3
mulsd xmm2, qword [0x100ce398]
cvtps2pd xmm6, xmm7
movaps xmm0, xmm3
addsd xmm0, xmm2
comisd xmm0, xmm6
jb 0x1003e1a7
movss xmm1, dword [esp + 0x58]
cvtps2pd xmm1, xmm1
cvtps2pd xmm4, xmm5
mulsd xmm1, qword [0x100ce388]
movaps xmm0, xmm1
addsd xmm0, xmm3
comisd xmm0, xmm4
jb 0x1003e1a7
subsd xmm2, xmm3
comisd xmm6, xmm2
jb 0x1003e1a7
subsd xmm1, xmm3
comisd xmm4, xmm1
jb 0x1003e1a7
movss xmm0, dword [esp + 0x48]
sub esp, 0x10
movss dword [esp + 0x70], xmm0
movss xmm0, dword [esp + 0x60]
movss dword [esp + 0x2c], xmm0
movsd xmm0, qword [0x100ce3b8]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x38]
subss xmm0, dword [esp + 0x5c]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10095ae0
movsd xmm0, qword [0x100ce3b8]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x30]
subss xmm0, dword [esp + 0x70]
fstp qword [esp + 0x38]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10095ae0
movsd xmm0, qword [0x100ce3b8]
fadd qword [esp + 0x38]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x34]
subss xmm0, dword [esp + 0x2c]
fstp qword [esp + 0x70]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10095ae0
fadd qword [esp + 0x70]
add esp, 0x10
xorps xmm1, xmm1
fstp qword [esp + 0x60]
movsd xmm0, qword [esp + 0x60]
ucomisd xmm1, xmm0
ja 0x1003e03a
sqrtsd xmm0, xmm0
jmp 0x1003e03f
mov esi, dword [esp + 0x14]
add edi, 4
cmp edi, 0x3ffc
jle 0x1003dc40
jmp 0x1003e1c0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1003e5c2
mov ecx, esi
call fcn.1003a940
test al, al
je 0x1003e5c2
cmp byte [0x100daf32], 0
jne 0x1003e23f
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push dword [0x100def50]
call esi
mov eax, dword [0x100def50]
lea ecx, [esp + 0x28]
push ecx
mov byte [eax], 0xeb
push dword [esp + 0x2c]
push 1
push eax
call esi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push dword [0x100def4c]
call esi
mov eax, dword [0x100def4c]
lea ecx, [esp + 0x28]
push ecx
mov byte [eax], 0xeb
push dword [esp + 0x2c]
push 1
push eax
call esi
mov esi, dword [esp + 0x14]
mov byte [0x100daf32], 1
lea eax, [esp + 0x38]
mov edx, 8
push eax
mov ecx, esi
call fcn.1003ad40
movss xmm3, dword [esp + 0x40]
mov eax, 0xb6fa2c
movaps xmm2, xmm3
movss dword [esp + 0x20], xmm3
movss xmm3, dword [esp + 0x44]
add esp, 4
movaps xmm1, xmm3
movups xmm4, xmmword [eax + 0x10]
movups xmm5, xmmword [eax + 0x20]
movups xmm7, xmmword [eax]
movups xmm6, xmmword [eax + 0x30]
mov eax, dword [0xc17044]
movaps xmm0, xmm4
shufps xmm0, xmm4, 0xaa
mulss xmm2, xmm0
movaps xmm0, xmm5
shufps xmm0, xmm5, 0xaa
mulss xmm1, xmm0
movaps xmm0, xmm7
shufps xmm0, xmm7, 0xaa
addss xmm2, xmm1
movss dword [esp + 0x20], xmm2
movss xmm2, dword [esp + 0x38]
movaps xmm1, xmm2
mulss xmm1, xmm0
movss xmm0, dword [esp + 0x20]
addss xmm0, xmm1
movss dword [esp + 0x20], xmm0
movaps xmm0, xmm6
movss xmm1, dword [esp + 0x20]
shufps xmm0, xmm6, 0xaa
addss xmm1, xmm0
movss xmm0, dword [0x100ce334]
divss xmm0, xmm1
movss dword [esp + 0x20], xmm1
movss xmm1, dword [esp + 0x1c]
movss dword [esp + 0x24], xmm0
movaps xmm0, xmm3
mulss xmm0, xmm5
mulss xmm1, xmm4
shufps xmm4, xmm4, 0x55
shufps xmm5, xmm5, 0x55
addss xmm1, xmm0
mulss xmm3, xmm5
movaps xmm0, xmm2
mulss xmm0, xmm7
shufps xmm7, xmm7, 0x55
mulss xmm2, xmm7
addss xmm1, xmm0
movaps xmm0, xmm1
addss xmm0, xmm6
shufps xmm6, xmm6, 0x55
movss dword [esp + 0x14], xmm0
movss xmm1, dword [esp + 0x14]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100ce990]
mov eax, dword [0xc17048]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [esp + 0x24]
mulss xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movss dword [esp + 0x14], xmm1
movss xmm1, dword [esp + 0x1c]
addsd xmm0, qword [eax*8 + 0x100ce990]
mulss xmm1, xmm4
addss xmm1, xmm3
cvtpd2ps xmm0, xmm0
addss xmm1, xmm2
mulss xmm0, dword [esp + 0x24]
addss xmm1, xmm6
mulss xmm1, xmm0
movss dword [esp + 0x1c], xmm1
movss xmm0, dword [esp + 0x20]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1003e5c2
mov eax, 0xb6fa2c
push 0x40
push 0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0xc8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esp + 0xd8], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [esp + 0xe8], xmm0
movups xmm0, xmmword [eax + 0x30]
lea eax, [esp + 0x88]
push eax
movups xmmword [esp + 0xfc], xmm0
call fcn.10087ba0
add esp, 0xc
mov dword [esp + 0xfc], 0x3f800000
lea eax, [esp + 0xc0]
push eax
push 0
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.d3dx9_42.dll_D3DXMatrixInverse]
mov eax, dword [0xc17044]
mov esi, 0xb6f258
movss xmm5, dword [esp + 0x14]
movss xmm3, dword [esp + 0x1c]
movss xmm6, dword [esp + 0x20]
movd xmm0, eax
lea edi, [esi - 0x10]
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movss xmm4, dword [esp + 0xa0]
addsd xmm0, qword [eax*8 + 0x100ce990]
mov eax, dword [0xc17048]
movss xmm2, dword [esp + 0xa4]
mulss xmm4, xmm6
cvtpd2ps xmm0, xmm0
movss xmm1, dword [esp + 0xa8]
mulss xmm0, dword [esp + 0x24]
mulss xmm2, xmm6
divss xmm5, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mulss xmm1, xmm6
addsd xmm0, qword [eax*8 + 0x100ce990]
lea eax, [esp + 0x48]
push eax
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [esp + 0x28]
divss xmm3, xmm0
movss xmm0, dword [esp + 0x94]
mulss xmm0, xmm3
addss xmm4, xmm0
movss xmm0, dword [esp + 0x84]
mulss xmm0, xmm5
addss xmm4, xmm0
movss xmm0, dword [esp + 0x98]
mulss xmm0, xmm3
addss xmm2, xmm0
movss xmm0, dword [esp + 0x88]
mulss xmm0, xmm5
addss xmm4, dword [esp + 0xb4]
addss xmm2, xmm0
movss xmm0, dword [esp + 0x9c]
mulss xmm0, xmm3
movss dword [esp + 0x4c], xmm4
addss xmm2, dword [esp + 0xb8]
addss xmm1, xmm0
movss xmm0, dword [esp + 0x8c]
mulss xmm0, xmm5
movss dword [esp + 0x50], xmm2
addss xmm1, xmm0
movss xmm0, dword [0xb6f338]
movss dword [esp + 0x78], xmm0
movss xmm0, dword [0xb6f33c]
movss dword [esp + 0x7c], xmm0
movss xmm0, dword [0xb6f340]
addss xmm1, dword [esp + 0xbc]
movss dword [esp + 0x80], xmm0
movss dword [esp + 0x54], xmm1
movss xmm3, dword [esp + 0x38]
lea edx, [esp + 0x78]
lea ecx, [esp + 0x64]
call fcn.1003a180
movss xmm0, dword [esp + 0x68]
add esp, 4
subss xmm0, dword [esi]
mulss xmm0, dword [0x100ce320]
addss xmm0, dword [esi]
movss dword [esi], xmm0
movss xmm0, dword [esp + 0x60]
subss xmm0, dword [edi]
mulss xmm0, dword [0x100ce320]
addss xmm0, dword [edi]
movss dword [edi], xmm0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
movss xmm2, dword [0x100ce2fc]
cmp byte [0x100d5ab1], 0
je 0x1003e6bb
cmp byte [0x100daf30], 0
je 0x1003e6bb
movd xmm1, dword [0xc9c040]
movd xmm0, dword [0xc9c044]
mov eax, dword [0xbaa410]
mov dword [esp + 0x38], 0xff
mov dword [esp + 0x3c], 0xff
mov dword [esp + 0x40], 0xff
mov dword [esp + 0x44], 0xff
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm0, xmm0
cmp eax, 0x1e
je 0x1003e68e
cmp eax, 0x1f
je 0x1003e68e
cmp eax, 0x21
je 0x1003e68e
cmp eax, 0x16
je 0x1003e68e
cmp eax, 0x17
je 0x1003e68e
cmp eax, 0x18
je 0x1003e68e
cmp eax, 0x19
je 0x1003e68e
cmp eax, 0x1a
je 0x1003e68e
cmp eax, 0x1b
je 0x1003e68e
cmp eax, 0x1c
je 0x1003e68e
cmp eax, 0x1d
je 0x1003e68e
cmp eax, 0x20
je 0x1003e68e
cmp eax, 0x25
je 0x1003e68e
cmp eax, 0x26
je 0x1003e68e
cmp eax, 0x2a
je 0x1003e68e
cmp eax, 0x29
je 0x1003e68e
push ecx
lea eax, [esp + 0x3c]
mulss xmm0, xmm2
push eax
mulss xmm1, xmm2
push ecx
cvttss2si edx, xmm0
cvttss2si ecx, xmm1
jmp 0x1003e6b3
cvtps2pd xmm0, xmm0
push ecx
lea eax, [esp + 0x3c]
push eax
push ecx
mulsd xmm0, qword [0x100ce388]
cvttsd2si edx, xmm0
cvtps2pd xmm0, xmm1
mulsd xmm0, qword [0x100ce398]
cvttsd2si ecx, xmm0
call fcn.1003b000
add esp, 0xc
cmp byte [0x100d6efa], 0
je 0x1003e6e8
push 0x23
call esi
bt ax, 0xf
jae 0x1003e6e8
push 0xbe
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x100daf30], 0
sete byte [0x100daf30]
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.10044b19
mov esp, ebp
pop ebp
ret