Function at 0x678bb3e0
Capabilities:
Encode data using xor
Hide graphical window
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x67ac4790]
push ebx
mov ebx, dword [0x67b6c82c]
push esi
mov esi, dword [sym.imp.user32.dll_LoadIconA]
push edi
push 0x7f00
push 0
movups xmmword [ebp - 0x64], xmm0
mov dword [ebp - 0x44], 0x30
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0x678ba670
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call esi
push 0x7f00
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.user32.dll_LoadCursorA]
push 0x7f00
push 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x67abd7ec
call esi
movups xmm0, xmmword [ebp - 0x44]
mov dword [ebp - 0x18], eax
lea eax, [ebx + 4]
push eax
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x34]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [eax + 0x20], xmm0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push 0
push 0
push 0
push 0x320
push 0x500
push 0x64
push 0x64
push 0x90000000
push 0
push dword [ebx + 0x2c]
push dword [0x67adb7fc]
call dword [sym.imp.user32.dll_CreateWindowExA]
lea ecx, [ebp - 0x64]
mov dword [ebx + 0x34], eax
push ecx
push eax
call dword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
push 0x80080
push 0xffffffffffffffec
push dword [ebx + 0x34]
call dword [sym.imp.user32.dll_SetWindowLongA]
push dword [ebx + 0x34]
mov ecx, ebx
call fcn.678bac40
test eax, eax
jne 0x678bb55a
movaps xmm0, xmmword [0x67ac58b0]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0xb7e1b5f0
mov dword [ebp - 0x20], 0xa1b3b1f4
mov dword [ebp - 0x1c], 0xfabfbab1
mov word [ebp - 0x18], 0x100
lea eax, [ecx - 0x40]
xor byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, 0x1c
jb 0x678bb515
push 0x10
push 0
lea eax, [ebp - 0x34]
mov byte [ebp - 0x17], 0
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
mov ecx, ebx
call fcn.678bafa0
push dword [ebx + 0x18]
push dword [ebx + 0x2c]
call dword [sym.imp.user32.dll_UnregisterClassA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.679343f5
mov esp, ebp
pop ebp
ret
push dword [ebx + 0x48]
mov ecx, ebx
call fcn.678bad00
push 0xa
push dword [ebx + 0x34]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [ebx + 0x34]
call dword [sym.imp.user32.dll_UpdateWindow]
call fcn.677e20c0
mov ecx, dword [ebx + 0x34]
call fcn.67838d00
mov edx, dword [ebx + 0x40]
mov ecx, dword [ebx + 0x3c]
call fcn.67837c30
call fcn.678ae2b0
call fcn.678ae490
cmp byte [0x67b38cbd], 0
jne 0x678bbb0b
lea eax, [ebp - 0x54]
push eax
push dword [ebx + 0x38]
call dword [sym.imp.user32.dll_GetWindowRect]
mov edi, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x48]
sub edi, dword [ebp - 0x54]
sub esi, dword [ebp - 0x50]
push 3
push dword [ebx + 0x34]
mov dword [0x67b72258], edi
mov dword [0x67b72254], esi
call dword [sym.imp.user32.dll_GetWindow]
push 3
push esi
push edi
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push eax
push dword [ebx + 0x34]
call dword [sym.imp.user32.dll_SetWindowPos]
push 1
push esi
push edi
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebx + 0x34]
call dword [sym.imp.user32.dll_MoveWindow]
mov esi, dword [sym.imp.user32.dll_PeekMessageA]
lea eax, [ebp - 0x30]
push 1
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x678bb63c
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.user32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.user32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
jne 0x678bb616
mov eax, dword [0x67b38b68]
test eax, eax
je 0x678bb64a
mov eax, dword [eax + 0x78]
jmp 0x678bb64c
xor eax, eax
cmp dword [eax + 0x24], 0
jne 0x678bb657
call fcn.67837610
call fcn.67839600
call fcn.677e3b10
call fcn.678bada0
mov eax, dword [ebx + 0x40]
lea esi, [ebx + 0x44]
push 0
xorps xmm0, xmm0
push esi
movups xmmword [ebp - 0x14], xmm0
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x84]
mov eax, dword [ebx + 0x40]
lea edx, [ebp - 0x14]
push edx
push dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc8]
call fcn.677e5c00
mov eax, dword [0x67b38b68]
xor ecx, ecx
mov eax, dword [eax + 0x47a4]
mov eax, dword [eax]
add eax, 0x38
cmp byte [eax], cl
cmovne ecx, eax
call fcn.67836d90
mov eax, dword [ebx + 0x48]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [0x67b38b68]
mov ecx, dword [0x67b723c8]
movss xmm0, dword [eax + 0x9c]
divss xmm0, dword [0x67ac46ac]
movd xmm1, ecx
mulss xmm0, dword [0x67ac4684]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x678bb6f7
inc ecx
mov dword [0x67b723c8], ecx
mov esi, dword [sym.imp.user32.dll_GetAsyncKeyState]
push 0x2d
call esi
test ax, ax
je 0x678bb76d
mov eax, dword [0x67b38b68]
movd xmm1, dword [0x67b723c8]
cvtdq2ps xmm1, xmm1
movss xmm0, dword [eax + 0x9c]
divss xmm0, dword [0x67ac46ac]
mulss xmm0, dword [0x67ac4684]
comiss xmm1, xmm0
jb 0x678bb76d
cmp byte [0x67b07244], 0
mov ecx, 0x80080
sete al
mov byte [0x67b07244], al
test al, al
mov eax, 0x800a0
cmove ecx, eax
push ecx
push 0xffffffffffffffec
push dword [ebx + 0x34]
mov dword [0x67adb7fc], ecx
call dword [sym.imp.user32.dll_SetWindowLongA]
mov dword [0x67b723c8], 0
push 0x74
call esi
test ax, ax
je 0x678bb900
mov eax, dword [0x67b38b68]
movd xmm1, dword [0x67b723c8]
cvtdq2ps xmm1, xmm1
movss xmm0, dword [eax + 0x9c]
divss xmm0, dword [0x67ac46ac]
mulss xmm0, dword [0x67ac4684]
comiss xmm1, xmm0
jb 0x678bb900
cmp byte [0x67b0711c], 0
jne 0x678bb860
cmp byte [0x67b070ab], 0
jne 0x678bb860
movaps xmm0, xmmword [0x67ac5710]
xor ecx, ecx
mov byte [0x67b0711c], 1
mov byte [0x67b070ab], 1
movups xmmword [ebp - 0xb0], xmm0
mov dword [ebp - 0xa0], 0xaaa4b69f
mov dword [ebp - 0x9c], 0xa3a9a7aa
mov word [ebp - 0x98], 0xb4
mov byte [ebp - 0x96], 1
nop word [eax + eax]
lea eax, [ecx - 0x51]
xor byte [ebp + ecx - 0xb0], al
inc ecx
cmp ecx, 0x19
jb 0x678bb810
mov byte [ebp - 0x96], 0
xor ecx, ecx
mov dword [ebp - 0x70], 0xf0f1e4c3
mov dword [ebp - 0x6c], 0xe5e6f1
mov byte [ebp - 0x68], 1
nop dword [eax + eax]
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0x70], al
inc ecx
cmp ecx, 7
jb 0x678bb840
lea eax, [ebp - 0xb0]
mov byte [ebp - 0x68], 0
push eax
lea eax, [ebp - 0x70]
jmp 0x678bb8eb
movaps xmm0, xmmword [0x67ac5720]
xor ecx, ecx
mov byte [0x67b0711c], 0
mov byte [0x67b070ab], 0
movups xmmword [ebp - 0xb0], xmm0
mov dword [ebp - 0xa0], 0xaaa4b69f
mov dword [ebp - 0x9c], 0xa3a9a7aa
mov word [ebp - 0x98], 0xb4
mov byte [ebp - 0x96], 1
lea eax, [ecx - 0x51]
xor byte [ebp + ecx - 0xb0], al
inc ecx
cmp ecx, 0x19
jb 0x678bb8a2
mov byte [ebp - 0x96], 0
xor ecx, ecx
mov dword [ebp - 0x7c], 0xf0f1e4c3
mov dword [ebp - 0x78], 0xe5e6f1
mov byte [ebp - 0x74], 1
nop dword [eax]
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0x7c], al
inc ecx
cmp ecx, 7
jb 0x678bb8d0
lea eax, [ebp - 0xb0]
mov byte [ebp - 0x74], 0
push eax
lea eax, [ebp - 0x7c]
push eax
push 1
call fcn.6789e4a0
add esp, 0xc
mov dword [0x67b723c8], 0
push 0x75
call esi
test ax, ax
je 0x678bba5d
mov eax, dword [0x67b38b68]
movd xmm1, dword [0x67b723c8]
cvtdq2ps xmm1, xmm1
movss xmm0, dword [eax + 0x9c]
divss xmm0, dword [0x67ac46ac]
mulss xmm0, dword [0x67ac4684]
comiss xmm1, xmm0
jb 0x678bba5d
cmp byte [0x67b38cb2], 0
sete al
xor ecx, ecx
mov byte [0x67b38cb2], al
test al, al
je 0x678bb9d4
mov dword [ebp - 0xc0], 0xf7eae2c2
mov dword [ebp - 0xbc], 0xbdf2f4ba
mov dword [ebp - 0xb8], 0xc3cdf6ff
mov dword [ebp - 0xb4], 0x100d7cd
nop
lea eax, [ecx - 0x6a]
xor byte [ebp + ecx - 0xc0], al
inc ecx
cmp ecx, 0xe
jb 0x678bb980
mov byte [ebp - 0xb1], 0
xor ecx, ecx
mov dword [ebp - 0x88], 0xf0f1e4c3
mov dword [ebp - 0x84], 0xe5e6f1
mov byte [ebp - 0x80], 1
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0x88], al
inc ecx
cmp ecx, 7
jb 0x678bb9b1
lea eax, [ebp - 0xc0]
mov byte [ebp - 0x80], 0
push eax
lea eax, [ebp - 0x88]
jmp 0x678bba48
movaps xmm0, xmmword [0x67ac4920]
movups xmmword [ebp - 0xa8], xmm0
mov byte [ebp - 0x98], 1
nop dword [eax]
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0xa8], al
inc ecx
cmp ecx, 0xf
jb 0x678bb9f0
mov byte [ebp - 0x98], 0
xor ecx, ecx
mov dword [ebp - 0x94], 0xf0f1e4c3
mov dword [ebp - 0x90], 0xe5e6f1
mov byte [ebp - 0x8c], 1
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0x94], al
inc ecx
cmp ecx, 7
jb 0x678bba24
lea eax, [ebp - 0xa8]
mov byte [ebp - 0x8c], 0
push eax
lea eax, [ebp - 0x94]
push eax
push 1
call fcn.6789e4a0
add esp, 0xc
mov dword [0x67b723c8], 0
cmp byte [0x67b38cb2], 0
je 0x678bbadc
mov eax, dword [0x67b723cc]
test eax, eax
jle 0x678bbadc
push eax
call esi
test ax, ax
je 0x678bbadc
mov eax, dword [0x67b38b68]
movd xmm1, dword [0x67b723c8]
cvtdq2ps xmm1, xmm1
movss xmm0, dword [eax + 0x9c]
divss xmm0, dword [0x67ac46ac]
mulss xmm0, dword [0x67ac4684]
comiss xmm1, xmm0
jb 0x678bbadc
mov eax, dword [0x67b38cb4]
xor ecx, ecx
inc eax
cmp eax, 3
cmovg eax, ecx
mov dword [0x67b38cb4], eax
push dword [eax*4 + 0x67abedb0]
push 0x67abee20
push 0x67abee44
push 1
call fcn.6789e4a0
add esp, 0x10
mov dword [0x67b723c8], 0
xor eax, eax
mov ecx, 0x11
cmp byte [0x67b723d0], al
cmovne eax, ecx
push eax
push dword [ebx + 0x34]
call dword [sym.imp.user32.dll_SetWindowDisplayAffinity]
push 0xa
call dword [sym.imp.kernel32.dll_Sleep]
cmp byte [0x67b38cbd], 0
je 0x678bb5a7
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.679343f5
mov esp, ebp
pop ebp
ret