Function at 0x10041770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x10069040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1006efc4]
push esi
push edi
cmp dword [eax], 0
je 0x10042127
cmp byte [0x1006ef24], 0
je 0x10041ad0
push 1
push 0x11
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test ax, ax
jns 0x10041883
mov eax, dword [0x1006ef64]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
call edi
movq xmm0, qword [esi + 0x1d0]
movq qword [ebp - 0x5c], xmm0
mov eax, dword [esi + 0x1d8]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x5c]
push 0xc
push eax
call edi
movq xmm0, qword [ebp - 0x5c]
mov eax, dword [ebp - 0x54]
movq qword [0x1006eeb0], xmm0
movss xmm0, dword [ebp - 0x5c]
addss xmm0, dword [0x1006e128]
mov dword [0x1006eeb8], eax
mov eax, dword [0x1006ef64]
movss dword [0x1006eeb0], xmm0
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
add esi, 0x1d0
push esi
call edi
movq xmm0, qword [0x1006eeb0]
movq qword [esi], xmm0
mov eax, dword [0x1006eeb8]
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xc
push esi
call edi
push 1
push 0x1f
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10041950
mov eax, dword [0x1006ef64]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
call edi
movq xmm0, qword [esi + 0x1d0]
movq qword [ebp - 0x5c], xmm0
mov eax, dword [esi + 0x1d8]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x5c]
push 0xc
push eax
call edi
movq xmm0, qword [ebp - 0x5c]
mov eax, dword [ebp - 0x54]
movq qword [0x1006eeb0], xmm0
movss xmm0, dword [ebp - 0x5c]
subss xmm0, dword [0x1006e128]
mov dword [0x1006eeb8], eax
mov eax, dword [0x1006ef64]
movss dword [0x1006eeb0], xmm0
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
add esi, 0x1d0
push esi
call edi
movq xmm0, qword [0x1006eeb0]
movq qword [esi], xmm0
mov eax, dword [0x1006eeb8]
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xc
push esi
call edi
push 1
push 0x20
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10041a15
mov eax, dword [0x1006ef64]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
call edi
movq xmm0, qword [esi + 0x1d0]
movq qword [ebp - 0x5c], xmm0
mov eax, dword [esi + 0x1d8]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x5c]
push 0xc
push eax
call edi
movq xmm0, qword [ebp - 0x5c]
mov eax, dword [0x1006ef64]
movq qword [0x1006eeb0], xmm0
movss xmm0, dword [ebp - 0x54]
addss xmm0, dword [0x1006e128]
movss dword [0x1006eeb8], xmm0
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
add esi, 0x1d0
push esi
call edi
movq xmm0, qword [0x1006eeb0]
movq qword [esi], xmm0
mov eax, dword [0x1006eeb8]
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xc
push esi
call edi
push 1
push 0x1e
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10041f0d
mov eax, dword [0x1006ef64]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
call edi
movq xmm0, qword [esi + 0x1d0]
movq qword [ebp - 0x5c], xmm0
mov eax, dword [esi + 0x1d8]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x5c]
push 0xc
push eax
call edi
movq xmm0, qword [ebp - 0x5c]
mov eax, dword [0x1006ef64]
movq qword [0x1006eeb0], xmm0
movss xmm0, dword [ebp - 0x54]
subss xmm0, dword [0x1006e128]
movss dword [0x1006eeb8], xmm0
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
add esi, 0x1d0
push 0xc
push esi
call edi
movq xmm0, qword [0x1006eeb0]
movq qword [esi], xmm0
mov eax, dword [0x1006eeb8]
jmp 0x10041efe
mov eax, dword [0x1006ef64]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call edi
movq xmm0, qword [esi + 0x1d0]
movq qword [ebp - 0x14], xmm0
mov eax, dword [esi + 0x1d8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push 0xc
push eax
call edi
movsd xmm2, qword [ebp - 0x14]
lea eax, [ebp - 8]
movss xmm1, dword [ebp - 0xc]
mov esi, dword [0x1006efbc]
push eax
push 0x40
push 0xc
lea eax, [ebp - 0x20]
movlhps xmm2, xmm1
push eax
movaps xmmword [ebp - 0x60], xmm2
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call edi
movq xmm0, qword [esi]
movq qword [ebp - 0x20], xmm0
mov eax, dword [esi + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x20]
push 0xc
push eax
call edi
movss xmm1, dword [ebp - 0x18]
xorps xmm7, xmm7
movsd xmm2, qword [ebp - 0x20]
movaps xmm6, xmmword [ebp - 0x60]
movaps xmm3, xmmword [0x100630f0]
movlhps xmm2, xmm1
xorps xmm1, xmm1
subps xmm6, xmm2
movaps xmm0, xmm1
shufps xmm6, xmm6, 0xe1
movss xmm6, xmm0
shufps xmm6, xmm6, 0xe1
movaps xmm1, xmm6
shufps xmm1, xmm6, 0xc9
movaps xmm0, xmm1
mulps xmm3, xmm1
shufps xmm0, xmm1, 0xc9
mulps xmm0, xmmword [0x100630a0]
subps xmm3, xmm0
andps xmm3, xmmword [0x100623c0]
movaps xmm2, xmm3
mulps xmm2, xmm3
movaps xmm1, xmm2
shufps xmm1, xmm2, 0x99
addss xmm2, xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
addss xmm2, xmm0
shufps xmm2, xmm2, 0
sqrtps xmm0, xmm2
cmpneqps xmm2, xmmword [0x100623a0]
divps xmm3, xmm0
push 1
push 0x11
cmpneqps xmm7, xmm0
andps xmm7, xmm3
andps xmm7, xmm2
andnps xmm2, xmmword [0x100623b0]
orps xmm7, xmm2
mulps xmm7, xmmword [0x10063150]
addps xmm7, xmm6
movaps xmm2, xmm7
mulps xmm2, xmm7
movaps xmm1, xmm2
shufps xmm1, xmm2, 0x99
addss xmm2, xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
addss xmm2, xmm0
xorps xmm0, xmm0
shufps xmm2, xmm2, 0
sqrtps xmm1, xmm2
cmpneqps xmm2, xmmword [0x100623a0]
divps xmm7, xmm1
cmpneqps xmm0, xmm1
andps xmm7, xmm0
andps xmm7, xmm2
andnps xmm2, xmmword [0x100623b0]
orps xmm7, xmm2
movaps xmmword [ebp - 0x70], xmm7
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10041cd5
movss xmm0, dword [0x1006e128]
mov eax, dword [0x1006ef64]
movaps xmm1, xmmword [ebp - 0x60]
shufps xmm0, xmm0, 0
mulps xmm0, xmmword [ebp - 0x70]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
addps xmm1, xmm0
add esi, 0x1d0
push esi
movaps xmm0, xmm1
movaps xmmword [ebp - 0x60], xmm1
shufps xmm0, xmm1, 0xaa
movss dword [ebp - 0x24], xmm0
call edi
movaps xmm0, xmmword [ebp - 0x60]
mov eax, dword [ebp - 0x24]
movq qword [esi], xmm0
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xc
push esi
call edi
push 1
push 0x1f
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10041d45
movss xmm0, dword [0x1006e128]
mov eax, dword [0x1006ef64]
movaps xmm1, xmmword [ebp - 0x60]
shufps xmm0, xmm0, 0
mulps xmm0, xmmword [ebp - 0x70]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
subps xmm1, xmm0
add esi, 0x1d0
push esi
movaps xmm0, xmm1
movaps xmmword [ebp - 0x60], xmm1
shufps xmm0, xmm1, 0xaa
movss dword [ebp - 0x30], xmm0
call edi
movaps xmm0, xmmword [ebp - 0x60]
mov eax, dword [ebp - 0x30]
movq qword [esi], xmm0
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xc
push esi
call edi
push 1
push 0x20
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10041e28
movaps xmm1, xmmword [ebp - 0x70]
shufps xmm1, xmmword [ebp - 0x70], 0xc9
movaps xmm3, xmmword [0x100630f0]
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xc9
mulps xmm0, xmmword [0x100630a0]
mov eax, dword [0x1006ef64]
mulps xmm3, xmm1
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
subps xmm3, xmm0
add esi, 0x1d0
push 0x40
push 0xc
push esi
andps xmm3, xmmword [0x100623c0]
movaps xmm2, xmm3
mulps xmm2, xmm3
movaps xmm1, xmm2
shufps xmm1, xmm2, 0x99
addss xmm2, xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
addss xmm2, xmm0
xorps xmm0, xmm0
shufps xmm2, xmm2, 0
sqrtps xmm1, xmm2
cmpneqps xmm2, xmmword [0x100623a0]
divps xmm3, xmm1
cmpneqps xmm0, xmm1
movaps xmm1, xmmword [ebp - 0x60]
andps xmm3, xmm0
movss xmm0, dword [0x1006e128]
andps xmm3, xmm2
shufps xmm0, xmm0, 0
andnps xmm2, xmmword [0x100623b0]
orps xmm3, xmm2
mulps xmm3, xmm0
addps xmm1, xmm3
movaps xmm0, xmm1
movaps xmmword [ebp - 0x60], xmm1
shufps xmm0, xmm1, 0xaa
movss dword [ebp - 0x3c], xmm0
call edi
movaps xmm0, xmmword [ebp - 0x60]
mov eax, dword [ebp - 0x3c]
movq qword [esi], xmm0
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xc
push esi
call edi
push 1
push 0x1e
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10041f0d
movaps xmm3, xmmword [ebp - 0x70]
xorps xmm4, xmm4
movaps xmm2, xmmword [0x100630a0]
shufps xmm3, xmm3, 0xd2
movaps xmm0, xmm2
shufps xmm0, xmm2, 0xc9
movaps xmm1, xmm3
shufps xmm1, xmm3, 0xd2
mulps xmm1, xmm0
mov eax, dword [0x1006ef64]
mulps xmm3, xmm2
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
subps xmm3, xmm1
add esi, 0x1d0
push 0x40
push 0xc
push esi
andps xmm3, xmmword [0x100623c0]
movaps xmm2, xmm3
mulps xmm2, xmm3
movaps xmm1, xmm2
shufps xmm1, xmm2, 0x99
addss xmm2, xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
addss xmm2, xmm0
shufps xmm2, xmm2, 0
sqrtps xmm0, xmm2
cmpneqps xmm2, xmmword [0x100623a0]
divps xmm3, xmm0
movaps xmm1, xmm0
movss xmm0, dword [0x1006e128]
cmpneqps xmm1, xmm4
shufps xmm0, xmm0, 0
andps xmm1, xmm3
andps xmm1, xmm2
andnps xmm2, xmmword [0x100623b0]
orps xmm1, xmm2
mulps xmm1, xmm0
addps xmm1, xmmword [ebp - 0x60]
movaps xmm0, xmm1
movaps xmmword [ebp - 0x70], xmm1
shufps xmm0, xmm1, 0xaa
movss dword [ebp - 0x48], xmm0
call edi
movaps xmm0, xmmword [ebp - 0x70]
mov eax, dword [ebp - 0x48]
movq qword [esi], xmm0
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xc
push esi
call edi
push 1
push 0x39
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10041fda
mov eax, dword [0x1006ef64]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
call edi
movq xmm0, qword [esi + 0x1d0]
movq qword [ebp - 0x5c], xmm0
mov eax, dword [esi + 0x1d8]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x5c]
push 0xc
push eax
call edi
movq xmm0, qword [ebp - 0x5c]
mov eax, dword [ebp - 0x54]
movq qword [0x1006eeb0], xmm0
movss xmm0, dword [ebp - 0x58]
addss xmm0, dword [0x1006e128]
mov dword [0x1006eeb8], eax
mov eax, dword [0x1006ef64]
movss dword [0x1006eeb4], xmm0
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
add esi, 0x1d0
push esi
call edi
movq xmm0, qword [0x1006eeb0]
movq qword [esi], xmm0
mov eax, dword [0x1006eeb8]
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xc
push esi
call edi
push 1
push 0x2a
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x100420a7
mov eax, dword [0x1006ef64]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
call edi
movq xmm0, qword [esi + 0x1d0]
movq qword [ebp - 0x5c], xmm0
mov eax, dword [esi + 0x1d8]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x5c]
push 0xc
push eax
call edi
movq xmm0, qword [ebp - 0x5c]
mov eax, dword [ebp - 0x54]
movq qword [0x1006eeb0], xmm0
movss xmm0, dword [ebp - 0x58]
subss xmm0, dword [0x1006e128]
mov dword [0x1006eeb8], eax
mov eax, dword [0x1006ef64]
movss dword [0x1006eeb4], xmm0
mov esi, dword [eax + 0x10]
lea eax, [ebp - 8]
push eax
push 0x40
push 0xc
add esi, 0x1d0
push esi
call edi
movq xmm0, qword [0x1006eeb0]
movq qword [esi], xmm0
mov eax, dword [0x1006eeb8]
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xc
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 1
push 0x4e
call edi
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x100420ec
movss xmm1, dword [0x1006e128]
movsd xmm0, qword [0x10062fb8]
cvtps2pd xmm1, xmm1
addsd xmm1, qword [0x10062f68]
comisd xmm0, xmm1
jbe 0x100420ec
cvtpd2ps xmm0, xmm1
movss dword [0x1006e128], xmm0
push 1
push 0x4a
call edi
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10042127
movss xmm0, dword [0x1006e128]
cvtps2pd xmm0, xmm0
subsd xmm0, qword [0x10062f68]
comisd xmm0, xmmword [0x10062ec8]
jbe 0x10042127
cvtpd2ps xmm0, xmm0
movss dword [0x1006e128], xmm0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005465b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret