Function at 0x10092030
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword [0x10105658]
sub esp, 0x18
push esi
push edi
cmp eax, 1
jne 0x100920e1
cmp byte [0x101077dd], 0
je 0x1009227c
mov eax, dword [ebx + 8]
movss xmm0, dword [0x101058d0]
movss xmm2, dword [eax + 0x18]
comiss xmm2, xmm0
jbe 0x1009208b
movss dword [eax + 0x18], xmm0
movss xmm0, dword [0x101058d0]
movaps xmm2, xmm0
movss xmm3, dword [0x10100890]
movaps xmm1, xmm0
xorps xmm1, xmm3
comiss xmm1, xmm2
jbe 0x100920ab
movss dword [eax + 0x18], xmm1
movss xmm0, dword [0x101058d0]
movss xmm1, dword [eax + 0x1c]
comiss xmm1, xmm0
jbe 0x100920c5
movss dword [eax + 0x1c], xmm0
movss xmm0, dword [0x101058d0]
movaps xmm1, xmm0
xorps xmm0, xmm3
comiss xmm0, xmm1
jbe 0x1009227c
movss dword [eax + 0x1c], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
cmp eax, 2
jne 0x1009227c
mov eax, dword [0x10107740]
mov edi, dword [0x10105530]
push edi
mov ecx, dword [eax + 0x60]
mov eax, dword [ecx]
mov eax, dword [eax + 0x80]
call eax
push edi
test eax, eax
jne 0x10092113
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jmp 0x10092133
mov eax, dword [0x10107740]
mov esi, dword [eax + 0x60]
mov ecx, esi
mov eax, dword [esi]
mov eax, dword [eax + 0x80]
call eax
mov ecx, dword [esi]
push eax
mov edx, dword [ecx + 0x2c]
mov ecx, esi
call edx
test al, al
je 0x100921e4
cmp byte [0x101077dc], 0
jne 0x1009227c
mov eax, dword [0x10107740]
xor edx, edx
movaps xmm0, xmmword [0x100ffa10]
mov ecx, dword [eax + 4]
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0xb0a0c11
mov dword [ebp - 4], 0x5545
nop dword [eax]
mov al, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], al
inc edx
cmp edx, 0x15
jb 0x10092170
mov word [ebp - 2], 0x100
lea edx, [ebp - 0x17]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x19c]
call eax
mov eax, dword [0x10107740]
xor edx, edx
movaps xmm0, xmmword [0x101003f0]
mov ecx, dword [eax + 4]
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x534857
mov byte [ebp - 4], 0
mov al, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], al
inc edx
cmp edx, 0x12
jb 0x100921b1
mov word [ebp - 5], 0x100
lea edx, [ebp - 0x17]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x19c]
call eax
mov byte [0x101077dc], 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
cmp byte [0x101077dc], 0
je 0x1009227c
mov eax, dword [0x10107740]
xor edx, edx
movaps xmm0, xmmword [0x100ff9b0]
mov ecx, dword [eax + 4]
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0xf0e0815
mov dword [ebp - 4], 0x5041
mov al, byte [ebp - 0x18]
xor byte [ebp + edx - 0x17], al
inc edx
cmp edx, 0x15
jb 0x10092214
mov word [ebp - 2], 0x100
lea edx, [ebp - 0x17]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x19c]
call eax
mov eax, dword [0x10107740]
xor edx, edx
movaps xmm0, xmmword [0x101006e0]
mov ecx, dword [eax + 4]
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x7b
mov byte [ebp - 2], 0
mov al, byte [ebp - 0x14]
xor byte [ebp + edx - 0x13], al
inc edx
cmp edx, 0x10
jb 0x10092254
mov word [ebp - 3], 0x100
lea edx, [ebp - 0x13]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x19c]
call eax
mov byte [0x101077dc], 0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4