Function at 0x43f200
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Link many functions at runtime
Log keystrokes via polling
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x450040]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
push 1
call fcn.00440649
add esp, 4
call dword [sym.imp.steam_api.dll_SteamAPI_Init]
push 1
call fcn.00440649
add esp, 4
push 1
call fcn.00440649
add esp, 4
push 1
call fcn.00440649
add esp, 4
push 1
call fcn.00440649
add esp, 4
mov dword [esp + 0x20], eax
push 1
call fcn.00440649
add esp, 4
mov dword [esp + 0x1c], eax
push 0x5c
call fcn.00440649
add esp, 4
mov esi, eax
mov dword [esp + 0xc], esi
push 0x57
lea ecx, [esi + 5]
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
add esp, 0xc
mov dword [esi], 0
mov byte [esi + 4], 1
push 0x447ca4
push 0x67
push 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
push 0
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov esi, dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call esi
mov ecx, dword [esp + 0xc]
push 0x447ca4
push 0x68
push 0
mov dword [ecx + 0x10], eax
call ebx
mov ecx, dword [esp + 0xc]
push eax
push 0
mov dword [ecx + 0x14], eax
call edi
mov ecx, dword [esp + 0xc]
push eax
mov dword [ecx + 0x18], eax
call esi
mov ecx, dword [esp + 0xc]
push 0x447ca4
push 0x69
push 0
mov dword [ecx + 0x1c], eax
call ebx
mov ecx, dword [esp + 0xc]
push eax
push 0
mov dword [ecx + 0x20], eax
call edi
mov ecx, dword [esp + 0xc]
push eax
mov dword [ecx + 0x24], eax
call esi
mov ecx, dword [esp + 0xc]
push 0x447ca4
push 0x6a
push 0
mov dword [ecx + 0x28], eax
call ebx
mov ecx, dword [esp + 0xc]
push eax
push 0
mov dword [ecx + 0x2c], eax
call edi
mov ecx, dword [esp + 0xc]
push eax
mov dword [ecx + 0x30], eax
call esi
mov ecx, dword [esp + 0xc]
push 0x447ca4
push 0x6b
push 0
mov dword [ecx + 0x34], eax
call ebx
mov ecx, dword [esp + 0xc]
push eax
push 0
mov dword [ecx + 0x38], eax
call edi
mov ecx, dword [esp + 0xc]
push eax
mov dword [ecx + 0x3c], eax
call esi
mov ecx, dword [esp + 0xc]
push 0x447ca4
push 0x6c
push 0
mov dword [ecx + 0x40], eax
call ebx
mov ecx, dword [esp + 0xc]
push eax
push 0
mov dword [ecx + 0x44], eax
call edi
mov ecx, dword [esp + 0xc]
push eax
mov dword [ecx + 0x48], eax
call esi
mov ecx, dword [esp + 0xc]
push 0x447ca4
push 0x6d
push 0
mov dword [ecx + 0x4c], eax
call ebx
mov ebx, dword [esp + 0xc]
push eax
push 0
mov dword [ebx + 0x50], eax
call edi
push eax
mov dword [ebx + 0x54], eax
call esi
push 1
mov dword [ebx + 0x58], eax
call fcn.00440649
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 4
push 0
push 0
push 0
push 0x425cc0
push 0
push 0
call esi
call fcn.00418ad0
mov ecx, dword [esp + 0x20]
call fcn.004017f0
mov ecx, dword [esp + 0x1c]
call fcn.004047c0
push 0
push 0
push 0
push 0x402d10
push 0
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x23
call edi
test al, 1
jne 0x43f8e4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [esp + 0x60], 1
mov dword [esp + 0x64], 0
nop dword [eax]
push 0x2d
call edi
test al, 1
je 0x43f48b
movaps xmm0, xmmword [0x448010]
xor ecx, ecx
movups xmmword [esp + 0x80], xmm0
mov word [esp + 0x90], 0x5e40
mov byte [esp + 0x92], 0
nop dword [eax + eax]
mov al, byte [esp + 0x80]
xor byte [esp + ecx + 0x81], al
inc ecx
cmp ecx, 0x11
jb 0x43f450
push 0x4501b8
mov byte [esp + 0x96], 0
call dword [sym.imp.steam_api.dll_SteamInternal_ContextInit]
add esp, 4
lea edx, [esp + 0x81]
mov ecx, dword [eax]
push 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x78]
cmp byte [0x45010a], 0
je 0x43f5b7
cmp byte [0x450111], 0
je 0x43f4a8
mov ecx, ebx
call fcn.004023d0
cmp byte [0x450118], 0
je 0x43f5b2
mov ebx, dword [0x454f30]
add ebx, dword [0x4500c4]
mov edi, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [esp + 0x3c]
push ecx
push ebx
push edi
call eax
push 0
push 0
push 4
push ebx
push edi
call esi
mov ebx, dword [esp + 0x34]
mov edi, dword [0x4500e0]
add ebx, 0x103f8
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [esp + 0x40]
push ecx
push ebx
push edi
call eax
push 0
push 0
push 4
push ebx
push edi
call esi
mov edi, dword [esp + 0x38]
cmp edi, dword [0x455028]
jle case.default.0x43f550
mov eax, dword [0x4501b0]
dec eax
mov dword [0x455028], edi
cmp eax, 6
ja case.default.0x43f550
jmp dword [eax*4 + 0x43f8f4]
mov eax, dword [esp + 0xc]
push 5
push dword [eax + 0x10]
jmp 0x43f5a2
mov eax, dword [esp + 0xc]
push 5
push dword [eax + 0x1c]
jmp 0x43f5a2
mov eax, dword [esp + 0xc]
push 5
push dword [eax + 0x28]
jmp 0x43f5a2
mov eax, dword [esp + 0xc]
push 5
push dword [eax + 0x34]
jmp 0x43f5a2
mov eax, dword [esp + 0xc]
push 5
push dword [eax + 0x40]
jmp 0x43f5a2
mov eax, dword [esp + 0xc]
push 5
push dword [eax + 0x4c]
jmp 0x43f5a2
mov eax, dword [esp + 0xc]
push 5
push dword [eax + 0x58]
call dword [sym.imp.WINMM.dll_sndPlaySoundA]
test edi, edi
jne 0x43f5b2
mov dword [0x455028], edi
call fcn.00402b80
xor ecx, ecx
mov dword [esp + 0x20], ecx
nop dword [eax]
mov ebx, dword [0x454f34]
mov edi, dword [0x4500e0]
add ebx, ecx
add ebx, dword [0x4500c4]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [esp + 0x44]
push ecx
push ebx
push edi
call eax
push 0
push 0
push 4
push ebx
push edi
call esi
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x43f8ae
cmp byte [0x45010b], 0
je 0x43f621
push ebx
call fcn.0043fc50
cmp byte [0x450110], 0
je 0x43f770
sub esp, 0x18
mov ecx, esp
push 0x45014c
call fcn.0040c9f0
lea eax, [esp + 0x80]
push eax
call fcn.0043e590
sub esp, 0x18
mov ecx, esp
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
push 0x450164
movq qword [esp + 0x64], xmm0
mov dword [esp + 0x6c], eax
call fcn.0040c9f0
lea eax, [esp + 0x8c]
push eax
call fcn.0043e590
add ebx, dword [0x454fc8]
mov edi, dword [0x4500e0]
push str.NtReadVirtualMemory
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
push str.ntdll.dll
movq qword [esp + 0x5c], xmm0
mov dword [esp + 0x64], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [esp + 0x48]
push ecx
push ebx
push edi
call eax
push 0
push 0
push 4
push ebx
push edi
call esi
mov edi, dword [esp + 0x40]
call fcn.00401550
cmp eax, edi
je 0x43f6e4
movzx eax, byte [esp + 0x48]
mov cl, byte [esp + 0x50]
mov byte [0x454f2c], al
movzx eax, byte [esp + 0x4c]
jmp 0x43f6f7
movzx eax, byte [esp + 0x54]
mov cl, byte [esp + 0x5c]
mov byte [0x454f2c], al
movzx eax, byte [esp + 0x58]
mov ebx, dword [0x4500e0]
mov byte [0x454f2d], al
mov ax, word [0x454f2c]
mov word [esp + 0x24], ax
mov eax, dword [0x454f7c]
add eax, dword [esp + 0x18]
push str.NtWriteVirtualMemory
push str.ntdll.dll
mov byte [0x454f2e], cl
mov byte [esp + 0x2e], cl
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x2c]
push eax
push 0x40
push 3
push dword [esp + 0x1c]
push ebx
call esi
push 0
push 3
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x1c]
push ebx
call edi
push 0
push dword [esp + 0x30]
jmp 0x43f7e9
mov word [0x454f2c], 0xffff
or cl, 0xff
mov ax, word [0x454f2c]
mov word [esp + 0x28], ax
mov eax, dword [0x454f7c]
add eax, ebx
mov byte [0x454f2e], cl
mov ebx, dword [0x4500e0]
push str.NtWriteVirtualMemory
push str.ntdll.dll
mov byte [esp + 0x32], cl
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [esp + 0x30], 0
lea eax, [esp + 0x30]
push eax
push 0x40
push 3
push dword [esp + 0x1c]
push ebx
call esi
push 0
push 3
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x1c]
push ebx
call edi
push 0
push dword [esp + 0x34]
push 3
push dword [esp + 0x1c]
push ebx
call esi
cmp byte [0x45010f], 0
je 0x43f8ae
mov ebx, dword [0x454fc8]
add ebx, dword [esp + 0x18]
mov edi, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [esp + 0x4c]
push ecx
push ebx
push edi
call eax
push 0
push 0
push 4
push ebx
push edi
call esi
mov edi, dword [esp + 0x44]
call fcn.00401550
cmp eax, edi
je 0x43f8ae
mov eax, dword [0x454fa8]
add dword [esp + 0x18], eax
mov ebx, dword [0x4500e0]
push str.NtWriteVirtualMemory
push str.ntdll.dll
mov byte [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
push 0x40
push 1
push dword [esp + 0x24]
push ebx
call esi
push 0
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24]
push ebx
call edi
push 0
push dword [esp + 0x20]
push 1
push dword [esp + 0x24]
push ebx
call esi
mov ecx, dword [esp + 0x20]
add ecx, 0x10
mov dword [esp + 0x20], ecx
cmp ecx, 0x400
jl 0x43f5c0
lea ecx, [esp + 0x60]
call fcn.00401e30
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x23
call edi
mov ebx, dword [esp + 0xc]
test al, 1
je 0x43f420
call dword [sym.imp.steam_api.dll_SteamAPI_Shutdown]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
push edi
cmc
inc ebx
add byte [edx - 0xb], ah
inc ebx
add byte [ebp - 0xb], ch
inc ebx
add byte [eax - 0xb], bh
inc ebx
add byte [ebx - 0x71ffbc0b], al
cmc
inc ebx
add byte [ecx + 0x550043f5], bl
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x450040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
sub esp, 0x18
mov dword [ebp - 0x30], eax
mov ecx, esp
push 0x45011c
call fcn.0040c9f0
lea eax, [ebp - 0x14]
push eax
call fcn.0043e590
sub esp, 0x18
mov ecx, esp
movq xmm0, qword [eax]
mov ebx, dword [eax + 8]
push 0x450134
movq qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x24], ebx
call fcn.0040c9f0
lea eax, [ebp - 0x20]
push eax
call fcn.0043e590
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
movzx eax, byte [0x45010d]
movq qword [ebp - 0x14], xmm0
sub eax, 0
je 0x43fa84
sub eax, 1
jne 0x43fa7c
mov edi, dword [0x454fc8]
add edi, dword [ebp + 0x40]
mov esi, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0x2c]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [ebp - 0x2c]
call fcn.00401550
cmp eax, esi
je 0x43fa32
cmp byte [0x45010c], 0
je 0x43fa84
movd xmm0, dword [ebp - 0x3c]
movss xmm1, dword [0x447cc0]
cvtdq2ps xmm0, xmm0
mov dword [ebp + 0x20], 0x3f4ccccd
divss xmm0, xmm1
movss dword [ebp + 0x14], xmm0
movd xmm0, dword [ebp - 0x38]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [ebp + 0x18], xmm0
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
mov ebx, dword [0x450194]
divss xmm0, xmm1
movss dword [ebp + 0x1c], xmm0
jmp 0x43fa87
movd xmm0, dword [ebp - 0x14]
movss xmm1, dword [0x447cc0]
cvtdq2ps xmm0, xmm0
mov ebx, dword [0x450198]
mov dword [ebp + 0x20], 0x3f4ccccd
divss xmm0, xmm1
movss dword [ebp + 0x14], xmm0
movd xmm0, dword [ebp - 0x10]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [ebp + 0x18], xmm0
movd xmm0, dword [ebp - 0x28]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [ebp + 0x1c], xmm0
jmp 0x43fa87
mov ebx, dword [ebp + 0x3c]
jmp 0x43fc0e
mov ebx, dword [ebp + 0x3c]
mov edi, dword [0x454fc8]
add edi, dword [ebp + 0x40]
mov esi, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0x28]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [ebp - 0x28]
call fcn.00401550
cmp eax, esi
je 0x43fc0e
cmp byte [0x45010e], 0
jne 0x43fb2d
cmp byte [0x45010c], 0
je 0x43fc0e
movd xmm0, dword [ebp - 0x3c]
movss xmm1, dword [0x447cc0]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [ebp + 0x14], xmm0
movd xmm0, dword [ebp - 0x38]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [ebp + 0x18], xmm0
movd xmm0, dword [ebp - 0x24]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [ebp + 0x1c], xmm0
jmp 0x43fc01
cmp byte [0x45010c], 0
je 0x43fc0e
mov edi, dword [0x454fc4]
add edi, dword [ebp + 0x40]
mov esi, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0x24]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movd xmm1, dword [ebp - 0x24]
movsd xmm0, qword [0x447cb8]
mov edi, dword [0x454fc4]
add edi, dword [ebp + 0x40]
mov esi, dword [0x4500e0]
cvtdq2pd xmm1, xmm1
push str.NtReadVirtualMemory
push str.ntdll.dll
mulsd xmm1, qword [0x447cb0]
subsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
movss dword [ebp + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0x24]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movd xmm0, dword [ebp - 0x24]
cvtdq2pd xmm0, xmm0
mov dword [ebp + 0x1c], 0
mulsd xmm0, qword [0x447cb0]
cvtpd2ps xmm0, xmm0
movss dword [ebp + 0x18], xmm0
mov ebx, dword [0x450194]
mov dword [ebp + 0x20], 0x3f4ccccd
mov eax, dword [ebp - 0x30]
movups xmm0, xmmword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov word [ebp + 0x34], 1
xor ecx, ebp
movups xmmword [eax], xmm0
pop edi
movups xmm0, xmmword [ebp + 0x1c]
pop esi
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [ebp + 0x2c]
movups xmmword [eax + 0x20], xmm0
mov dword [eax + 0x30], ebx
pop ebx
call fcn.004403ea
mov esp, ebp
pop ebp
ret 0x3c