Function at 0x100dd510
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f200f
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1f0
mov eax, dword [0x101040b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x101300e4], 0
je 0x100dddab
mov eax, dword [0x10140b64]
test al, 1
jne 0x100dd56f
or eax, 1
mov dword [0x10140b64], eax
test al, 2
jne 0x100dd57b
or eax, 2
mov dword [0x10140b64], eax
test al, 4
jne 0x100dd587
or eax, 4
mov dword [0x10140b64], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x189]
movq qword [ebp - 0x20], xmm0
mov byte [ebp - 0x189], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x1ec], 0
mov dword [ebp - 0x1e8], 0xf
mov byte [ebp - 0x1fc], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100dd5c1
sub ecx, edx
lea eax, [ebp - 0x189]
push ecx
push eax
lea ecx, [ebp - 0x1fc]
call fcn.10025140
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1e4]
push dword [ebp - 0x17d]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x1fc]
mov dword [ebp - 0x1c], 0
push eax
mov dword [ebp - 0x18], 0
call fcn.100b70c0
push fcn.100246b0
push 1
push 0x18
lea eax, [ebp - 0x1fc]
mov byte [ebp - 4], 2
push eax
call fcn.100e7876
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
movaps xmm0, xmmword [str._LVMWFQ]
xor eax, eax
movaps xmm2, xmmword [0x100f8660]
movups xmmword [ebp - 0x1e4], xmm0
mov byte [ebp - 0x1c4], 0x23
movaps xmm0, xmmword [0x100f88d0]
movups xmmword [ebp - 0x1d4], xmm0
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x1e4]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x1e4], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100dd670
cmp eax, 0x21
jae 0x100dd6a2
xor byte [ebp + eax - 0x1e4], 0x23
inc eax
cmp eax, 0x21
jb 0x100dd694
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x1e4]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [ebp - 0x184]
movd xmm1, dword [ebp - 0x180]
movss xmm5, dword [0x10140b6c]
movss xmm4, dword [0x10140b70]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [0x10140b6c], xmm0
movss xmm0, dword [0x100f80a0]
movss dword [0x10140b70], xmm1
movaps xmm3, xmm0
movss xmm1, dword [0x10140b74]
subss xmm3, xmm1
movss dword [0x10140b5c], xmm5
movss dword [0x10140b60], xmm4
comiss xmm5, xmm3
jbe 0x100dd7ae
movaps xmm2, xmm0
subss xmm2, dword [0x10140b78]
comiss xmm4, xmm2
jbe 0x100dd7ae
addss xmm3, dword [0x100f80e4]
comiss xmm3, xmm5
jbe 0x100dd7ae
addss xmm2, dword [0x100f8030]
comiss xmm2, xmm4
jbe 0x100dd7ae
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x100dd79e
movss xmm1, dword [0x10140b5c]
movss xmm0, dword [0x10140b60]
subss xmm1, dword [0x10140b6c]
subss xmm0, dword [0x10140b70]
addss xmm1, dword [0x10140b74]
addss xmm0, dword [0x10140b78]
movss dword [0x10140b74], xmm1
movss dword [0x10140b78], xmm0
jmp 0x100dd7a6
movss xmm1, dword [0x10140b74]
movss xmm0, dword [0x100f80a0]
mov ecx, dword [0x1013b4ac]
movaps xmm2, xmm0
subss xmm0, dword [0x10140b78]
subss xmm2, xmm1
mov eax, dword [ecx]
movss dword [ebp - 0x194], xmm0
movss dword [ebp - 0x190], xmm2
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100dd9de
mov eax, dword [0x1013b508]
mov edi, 1
cmp dword [eax + 0x18], edi
jl 0x100dd9de
mov ecx, dword [0x1013b4b0]
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov esi, eax
test esi, esi
je 0x100dd9cf
mov ecx, dword [0x1013b64c]
mov cl, byte [ecx + esi]
test cl, cl
jne 0x100dd9cf
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
mov eax, dword [eax + 0x24]
call eax
test al, al
jne 0x100dd9cf
mov eax, dword [0x1013b6c8]
add eax, 0xffffffc7
xor eax, 0xee847b80
cmp dword [eax + esi], 0
je 0x100dd9cf
mov ecx, dword [0x1013b4b0]
mov eax, dword [0x1013b764]
add eax, 0xffffffa0
xor eax, 0xee847ba7
mov edx, dword [ecx]
push ecx
mov eax, dword [eax + esi]
mov esi, dword [edx + 0x10]
mov edx, esp
mov dword [edx], eax
call esi
cmp eax, dword [0x10122b60]
jne 0x100dd9cf
mov ecx, dword [0x1013b4ac]
lea edx, [ebp - 0x178]
push edx
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
test al, al
je 0x100dd9cf
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a0], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x1b4], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100dd8b7
sub ecx, edx
lea eax, [ebp - 0x168]
push ecx
push eax
lea ecx, [ebp - 0x1b4]
call fcn.10025140
push 0x18
push 0
lea eax, [ebp - 0x1dc]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1b4]
call fcn.1003efa0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], ecx
je 0x100dd92e
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
add dword [ebp - 0x1c], 0x18
jmp 0x100dd938
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.100e6f00
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1c8]
cmp edx, 0x10
jb 0x100dd976
mov ecx, dword [ebp - 0x1dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100dd96c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100ddcc3
push edx
push ecx
call fcn.100e7cba
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1a0]
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1c8], 0xf
mov byte [ebp - 0x1dc], 0
cmp edx, 0x10
jb 0x100dd9cf
mov ecx, dword [ebp - 0x1b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100dd9c5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100ddcc3
push edx
push ecx
call fcn.100e7cba
add esp, 8
mov eax, dword [0x1013b508]
inc edi
cmp edi, dword [eax + 0x18]
jle 0x100dd7f5
mov ecx, dword [ebp - 0x1c]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x20]
movss xmm0, dword [ebp - 0x194]
addss xmm0, dword [0x100f8004]
imul ecx
cvttss2si esi, dword [ebp - 0x190]
mov ecx, dword [0x1013b4b8]
sar edx, 2
mov eax, edx
mov dword [ebp - 0x188], 0xa01a1a1a
shr eax, 0x1f
push dword [ebp - 0x188]
add eax, edx
lea edi, [eax + eax*8]
cvttss2si eax, xmm0
add edi, edi
mov dword [ebp - 0x198], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
call eax
mov ecx, dword [0x1013b4b8]
add esi, 0xc8
mov eax, dword [ecx]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 0x198]
add eax, edi
mov edi, dword [ebp - 0x198]
push eax
cvttss2si eax, dword [ebp - 0x190]
push esi
push edi
push eax
call edx
mov ecx, dword [0x1013b4b8]
mov dword [ebp - 0x188], 0xc81a1a1a
push dword [ebp - 0x188]
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
call eax
mov ecx, dword [0x1013b4b8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x40]
lea eax, [edi + 0x12]
push eax
push esi
cvttss2si esi, dword [ebp - 0x190]
push edi
push esi
call edx
movzx eax, byte [0x100f7a33]
movss xmm0, dword [ebp - 0x194]
addss xmm0, dword [0x100f8000]
movd xmm5, esi
movd xmm1, eax
movzx eax, byte [0x100f7a32]
cvtdq2ps xmm1, xmm1
movd xmm2, eax
mov eax, dword [0x100f7a30]
movzx ecx, ah
movzx eax, al
cvtdq2ps xmm2, xmm2
movd xmm3, ecx
movd xmm4, eax
cvtdq2ps xmm3, xmm3
cvtdq2ps xmm4, xmm4
cvtdq2ps xmm5, xmm5
cvttss2si edi, xmm0
xorps xmm0, xmm0
movss dword [ebp - 0x1b8], xmm1
movss dword [ebp - 0x198], xmm0
movss dword [ebp - 0x1bc], xmm2
movss dword [ebp - 0x1c0], xmm3
movss dword [ebp - 0x19c], xmm4
movss dword [ebp - 0x180], xmm5
cvttss2si eax, xmm4
cvttss2si ecx, xmm3
mov byte [ebp - 0x188], al
addss xmm0, xmm5
cvttss2si eax, xmm1
mov byte [ebp - 0x187], cl
mov ecx, dword [0x1013b4b8]
cvttss2si edx, xmm2
mov byte [ebp - 0x185], al
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
cvttss2si esi, xmm0
mov byte [ebp - 0x186], dl
push dword [ebp - 0x188]
call eax
mov ecx, dword [0x1013b4b8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x48]
lea eax, [edi + 2]
push eax
lea eax, [esi + 1]
push eax
push edi
push esi
call edx
movss xmm0, dword [ebp - 0x198]
addss xmm0, dword [0x100f7f64]
movss xmm1, dword [0x100f80e4]
movss xmm2, dword [ebp - 0x1bc]
movss xmm3, dword [ebp - 0x1c0]
movss xmm4, dword [ebp - 0x19c]
movss xmm5, dword [ebp - 0x180]
comiss xmm1, xmm0
movss xmm1, dword [ebp - 0x1b8]
movss dword [ebp - 0x198], xmm0
ja 0x100ddb22
mov dword [ebp - 0x184], 0x40465350
xor eax, eax
mov dword [ebp - 0x180], 0x4c574257
mov word [ebp - 0x17c], 0x5051
mov byte [ebp - 0x17a], 0x23
xor byte [ebp + eax - 0x184], 0x23
inc eax
cmp eax, 0xb
jb 0x100ddbf3
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a0], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x1b4], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100ddc25
sub ecx, edx
lea eax, [ebp - 0x184]
push ecx
push eax
lea ecx, [ebp - 0x1b4]
call fcn.10025140
movss xmm0, dword [ebp - 0x194]
lea eax, [ebp - 0x1b4]
push 1
push eax
push ecx
mov byte [ebp - 4], 5
mov eax, esp
addss xmm0, dword [0x100f800c]
mov ecx, 0x1013dbe0
mov dword [eax], 0xffffffff
cvttss2si eax, xmm0
movss dword [ebp - 0x194], xmm0
movss xmm0, dword [ebp - 0x190]
addss xmm0, dword [0x100f80bc]
push eax
cvttss2si eax, xmm0
push eax
call fcn.100d82a0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1a0]
cmp edx, 0x10
jb 0x100ddcd3
mov ecx, dword [ebp - 0x1b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100ddcc9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100ddcc9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100e7cba
add esp, 8
mov edi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
cmp edi, edx
je 0x100ddda3
sub edx, edi
mov eax, 0x2aaaaaab
imul edx
xor ecx, ecx
sar edx, 2
mov eax, edx
mov dword [ebp - 0x188], ecx
shr eax, 0x1f
add eax, edx
je 0x100ddda3
movss xmm0, dword [ebp - 0x190]
xor esi, esi
addss xmm0, dword [0x100f7ffc]
xor eax, eax
mov dword [ebp - 0x190], eax
cvttss2si ecx, xmm0
mov dword [ebp - 0x180], ecx
add eax, edi
movd xmm0, esi
push 0
push eax
push ecx
mov eax, esp
cvtdq2pd xmm0, xmm0
mov dword [eax], 0xffffffff
mov eax, esi
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100f87e0]
cvtpd2ps xmm0, xmm0
addss xmm0, dword [ebp - 0x194]
cvttss2si eax, xmm0
push eax
push ecx
mov ecx, 0x1013becc
call fcn.100d82a0
mov ecx, dword [ebp - 0x1c]
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x20]
add esi, 0x12
add dword [ebp - 0x190], 0x18
sub ecx, edi
inc dword [ebp - 0x188]
imul ecx
mov ecx, dword [ebp - 0x180]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x190]
jb 0x100ddd26
lea ecx, [ebp - 0x20]
call fcn.10043ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100e7827
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret