Function at 0x10004ea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
mov eax, dword [0x1010607c]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push esi
push edi
push str.vcmp_game.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x10128174]
xor edi, edi
mov dword [esp + 0x20], eax
mov eax, dword [ecx]
mov dword [esp + 0x2c], eax
mov ecx, dword [eax + 8]
test ecx, ecx
jle 0x10004eef
mov edx, dword [eax + 4]
cmp byte [edx + edi], 0
jge 0x10004f06
inc edi
cmp edi, ecx
jl 0x10004ee4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.100ab558
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
je 0x10004eef
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
imul esi, edi, 0x6d8
mov edx, 0x4bc120
add esi, dword [eax]
mov dword [esp + 0x10], esi
movss xmm0, dword [esi + 0x34]
movss dword [esp + 0x1c], xmm0
movss xmm0, dword [esi + 0x38]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [esi + 0x3c]
movss dword [esp + 0x24], xmm0
call edx
movss xmm3, dword [esi + 0x34]
push 0
movss dword [esp + 0x34], xmm3
movss xmm0, dword [eax + 0x34]
movss xmm1, dword [eax + 0x38]
movss xmm2, dword [eax + 0x3c]
lea eax, [esp + 0x118]
movss xmm3, dword [esi + 0x38]
push eax
lea eax, [esp + 0x120]
movss dword [esp + 0x30], xmm3
movss xmm3, dword [esi + 0x3c]
mov esi, 0x5778b0
push eax
lea eax, [esp + 0x18c]
movss dword [esp + 0x24], xmm3
push eax
lea eax, [esp + 0x16c]
movss dword [esp + 0x16c], xmm0
push eax
movss dword [esp + 0x174], xmm1
movss dword [esp + 0x178], xmm2
call esi
movss xmm0, dword [esp + 0x44]
lea eax, [esp + 0x130]
add esp, 0x14
movss dword [esp + 0x168], xmm0
movss xmm0, dword [esp + 0x28]
movss dword [esp + 0x16c], xmm0
movss xmm0, dword [esp + 0x18]
push 0
push eax
lea eax, [esp + 0x128]
movss dword [esp + 0x178], xmm0
push eax
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x178]
push eax
call esi
add esp, 0x14
mov ecx, 0xa0fd08
call fcn.1005f250
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x124]
push eax
call fcn.100108c0
mov dword [esp + 0xf8], 4
mov esi, dword [eax]
lea eax, [esp + 0xfc]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0x104], esi
call ebx
test eax, eax
setne byte [esp + 0x100]
mov esi, dword [esi]
test eax, eax
je 0x10005083
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esp + 0x100]
mov dword [esp + 0x24], eax
push dword [esp + 0x100]
call ebx
movd xmm0, esi
mov ecx, 0xa0fd04
cvtdq2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm0, qword [0x100fda90]
cvtpd2ps xmm0, xmm0
movss dword [esp + 0x28], xmm0
call fcn.1005f250
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x128]
push eax
call fcn.100108c0
mov dword [esp + 0x108], 4
mov esi, dword [eax]
lea eax, [esp + 0x10c]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0x114], esi
call ebx
test eax, eax
setne byte [esp + 0x110]
mov esi, dword [esi]
test eax, eax
je 0x10005112
mov eax, dword [esp + 0x10c]
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esp + 0x110]
mov dword [esp + 0x24], eax
push dword [esp + 0x110]
call ebx
xorps xmm0, xmm0
movss xmm2, dword [esp + 0x174]
cvtsi2ss xmm0, esi
movss xmm1, dword [esp + 0x17c]
xorps xmm3, xmm3
cvtps2pd xmm0, xmm0
subss xmm1, xmm3
divsd xmm0, qword [0x100fda68]
mulss xmm1, xmm1
cvtpd2ps xmm0, xmm0
subss xmm2, xmm0
movss xmm0, dword [esp + 0x178]
subss xmm0, dword [esp + 0x28]
mulss xmm2, xmm2
mulss xmm0, xmm0
addss xmm0, xmm2
addss xmm0, xmm1
call fcn.10003980
movss xmm1, dword [0x100fdb54]
comiss xmm1, xmm0
jb 0x100057ba
mov eax, 0x4bc120
call eax
mov ecx, dword [esp + 0x10]
cmp ecx, eax
je 0x100057ba
mov eax, dword [ecx + 0x244]
cmp eax, 0x36
je 0x100057ba
cmp eax, 0x37
je 0x100057ba
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x100057ba
mov ecx, 0x55741c
call fcn.1005f250
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x12c]
push eax
call fcn.100108c0
mov dword [esp + 0x58], 4
mov esi, dword [eax]
lea eax, [esp + 0x5c]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0x64], esi
call ebx
test eax, eax
setne byte [esp + 0x60]
mov dword [esi], 0x83661875
cmp byte [esp + 0x60], 0
je 0x10005221
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0x60]
mov dword [esp + 0x1c], eax
push dword [esp + 0x60]
call ebx
mov ecx, 0x55745a
call fcn.1005f250
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x130]
push eax
call fcn.100108c0
mov dword [esp + 0x68], 2
mov esi, dword [eax]
lea eax, [esp + 0x6c]
push eax
push 0x40
push 2
push esi
mov dword [esp + 0x74], esi
call ebx
test eax, eax
mov eax, 0x90909090
setne byte [esp + 0x70]
mov word [esi], ax
cmp byte [esp + 0x70], 0
je 0x10005288
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0x70]
mov dword [esp + 0x1c], eax
push dword [esp + 0x70]
call ebx
mov ecx, 0x47c4c3
call fcn.1005f250
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x134]
push eax
call fcn.100108c0
mov dword [esp + 0x78], 6
mov esi, dword [eax]
lea eax, [esp + 0x7c]
push eax
push 0x40
push 6
push esi
mov dword [esp + 0x84], esi
call ebx
test eax, eax
mov eax, 0x90909090
setne byte [esp + 0x80]
mov dword [esi], eax
mov word [esi + 4], ax
cmp byte [esp + 0x80], 0
je 0x10005301
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0x80]
mov dword [esp + 0x1c], eax
push dword [esp + 0x80]
call ebx
mov ecx, 0x47c4c9
call fcn.1005f250
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x138]
push eax
call fcn.100108c0
mov dword [esp + 0x88], 2
mov esi, dword [eax]
lea eax, [esp + 0x8c]
push eax
push 0x40
push 2
push esi
mov dword [esp + 0x94], esi
call ebx
test eax, eax
mov eax, 0x90909090
setne byte [esp + 0x90]
mov word [esi], ax
cmp byte [esp + 0x90], 0
je 0x10005380
mov eax, dword [esp + 0x8c]
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0x90]
mov dword [esp + 0x1c], eax
push dword [esp + 0x90]
call ebx
mov ecx, 0x47c4cb
call fcn.1005f250
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x13c]
push eax
call fcn.100108c0
mov dword [esp + 0x98], 6
mov esi, dword [eax]
lea eax, [esp + 0x9c]
push eax
push 0x40
push 6
push esi
mov dword [esp + 0xa4], esi
call ebx
test eax, eax
mov eax, 0x90909090
setne byte [esp + 0xa0]
mov dword [esi], eax
mov word [esi + 4], ax
cmp byte [esp + 0xa0], 0
je 0x10005402
mov eax, dword [esp + 0x9c]
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0xa0]
mov dword [esp + 0x1c], eax
push dword [esp + 0xa0]
call ebx
mov ecx, 0x47c4d1
call fcn.1005f250
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x140]
push eax
call fcn.100108c0
mov dword [esp + 0xa8], 2
mov esi, dword [eax]
lea eax, [esp + 0xac]
push eax
push 0x40
push 2
push esi
mov dword [esp + 0xb4], esi
call ebx
test eax, eax
mov eax, 0x90909090
setne byte [esp + 0xb0]
mov word [esi], ax
cmp byte [esp + 0xb0], 0
je 0x10005481
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
push dword [esp + 0xb0]
call ebx
mov ecx, 0x47c4d3
call fcn.1005f250
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x144]
push eax
call fcn.100108c0
mov dword [esp + 0xb8], 6
mov esi, dword [eax]
lea eax, [esp + 0xbc]
push eax
push 0x40
push 6
push esi
mov dword [esp + 0xc4], esi
call ebx
test eax, eax
mov eax, 0x90909090
setne byte [esp + 0xc0]
mov dword [esi], eax
mov word [esi + 4], ax
cmp byte [esp + 0xc0], 0
je 0x10005503
mov eax, dword [esp + 0xbc]
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0xc0]
mov dword [esp + 0x1c], eax
push dword [esp + 0xc0]
call ebx
mov ecx, 0x47c4d9
call fcn.1005f250
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x14c]
push eax
call fcn.100108c0
mov dword [esp + 0xc8], 4
mov esi, dword [eax]
lea eax, [esp + 0xcc]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0xd4], esi
call ebx
test eax, eax
setne byte [esp + 0xd0]
mov dword [esi], 0x90909090
cmp byte [esp + 0xd0], 0
je 0x10005580
mov eax, dword [esp + 0xcc]
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0xd0]
mov dword [esp + 0x1c], eax
push dword [esp + 0xd0]
call ebx
mov ecx, dword [esp + 0x20]
add ecx, 0x3726a4
call fcn.1005f250
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x150]
push eax
call fcn.100108c0
mov dword [esp + 0x48], 4
mov esi, dword [eax]
lea eax, [esp + 0x4c]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0x54], esi
call ebx
movss xmm0, dword [esp + 0x1c]
test eax, eax
setne byte [esp + 0x50]
movss dword [esi], xmm0
cmp byte [esp + 0x50], 0
je 0x100055ee
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x1c]
push ecx
push eax
push dword [esp + 0x50]
mov dword [esp + 0x28], eax
push dword [esp + 0x50]
call ebx
mov ecx, dword [esp + 0x20]
lea ecx, [ecx + 0x3726a8]
call fcn.1005f250
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x154]
push eax
call fcn.100108c0
mov dword [esp + 0xd8], 4
mov esi, dword [eax]
lea eax, [esp + 0xdc]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0xe4], esi
call ebx
movss xmm0, dword [esp + 0x14]
test eax, eax
setne byte [esp + 0xe0]
movss dword [esi], xmm0
cmp byte [esp + 0xe0], 0
je 0x10005674
mov eax, dword [esp + 0xdc]
lea ecx, [esp + 0x14]
push ecx
push eax
push dword [esp + 0xe0]
mov dword [esp + 0x20], eax
push dword [esp + 0xe0]
call ebx
mov ecx, dword [esp + 0x20]
lea ecx, [ecx + 0x3726ac]
call fcn.1005f250
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
lea eax, [esp + 0x158]
push eax
call fcn.100108c0
movss xmm0, dword [esp + 0x24]
addss xmm0, dword [0x100fdafc]
mov dword [esp + 0xe8], 4
mov esi, dword [eax]
lea eax, [esp + 0xec]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x34], xmm0
mov dword [esp + 0xf4], esi
call ebx
movss xmm0, dword [esp + 0x24]
test eax, eax
setne byte [esp + 0xf0]
movss dword [esi], xmm0
cmp byte [esp + 0xf0], 0
je 0x1000570e
mov eax, dword [esp + 0xec]
lea ecx, [esp + 0x14]
push ecx
push eax
push dword [esp + 0xf0]
mov dword [esp + 0x20], eax
push dword [esp + 0xf0]
call ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x100057ba
mov ecx, dword [esp + 0x20]
lea ecx, [ecx + 0xce901]
call fcn.1005f250
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
lea eax, [esp + 0x148]
push eax
call fcn.100108c0
mov dword [esp + 0x38], 4
mov esi, dword [eax]
lea eax, [esp + 0x3c]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0x44], esi
call ebx
test eax, eax
setne byte [esp + 0x40]
mov dword [esi], 0x83662b75
cmp byte [esp + 0x40], 0
je 0x1000578b
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x14]
push ecx
push eax
push dword [esp + 0x40]
mov dword [esp + 0x20], eax
push dword [esp + 0x40]
call ebx
mov esi, 0x4bc120
call esi
push 1
push 0
mov ecx, eax
mov eax, 0x4ffa30
push 0x1c
call eax
call esi
mov esi, eax
mov eax, 0x4bc120
call eax
push eax
lea ecx, [esi + 0x4c8]
mov eax, 0x5cc730
call eax
mov ecx, dword [esp + 0x2c]
inc edi
mov eax, dword [ecx + 8]
cmp edi, eax
jge 0x10004eef
mov ecx, dword [ecx + 4]
nop dword [eax]
cmp byte [ecx + edi], 0
jge 0x100057f2
inc edi
cmp edi, eax
jl 0x100057d0
mov ecx, dword [esp + 0x18c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100ab558
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
je 0x10004eef
mov eax, dword [esp + 0x2c]
jmp 0x10004f11