Function at 0x100247b0
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f42a1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x198
mov eax, dword [0x1011f00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x10158374], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x9c], eax
je case.0x100253b7.4
push dword [0x10158378]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je case.0x100253b7.4
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je case.0x100253b7.4
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je case.0x100253b7.4
mov edi, dword [0x101227d4]
test edi, edi
je case.0x100253b7.4
mov eax, edi
mov dword [ebp - 0x8c], eax
test eax, eax
je case.0x100253b7.4
mov eax, dword [0x101226d4]
test eax, eax
jne 0x100248a4
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov edi, dword [0x101227d4]
mov dword [0x101226d4], eax
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + eax], 0
jle case.0x100253b7.4
mov eax, dword [0x10122670]
test eax, eax
jne 0x100248ee
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100d1
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122670], eax
cmp byte [edi + eax], 0
jne case.0x100253b7.4
call fcn.100034a0
cmp byte [eax], 0
jne case.0x100253b7.4
movups xmm0, xmmword [0x1011f27c]
mov edi, dword [0x101227d4]
movups xmmword [ebp - 0x30], xmm0
movq xmm0, qword [0x1011f28c]
movq qword [ebp - 0xe8], xmm0
movups xmm0, xmmword [0x1011f24c]
movups xmmword [ebp - 0x150], xmm0
movq xmm0, qword [0x1011f25c]
movq qword [ebp - 0x98], xmm0
movups xmm0, xmmword [0x1011f294]
movups xmmword [ebp - 0x160], xmm0
movq xmm0, qword [0x1011f2a4]
movq qword [ebp - 0xc8], xmm0
movups xmm0, xmmword [0x1011f264]
movups xmmword [ebp - 0x170], xmm0
movq xmm0, qword [0x1011f274]
movq qword [ebp - 0xd0], xmm0
movups xmm0, xmmword [0x1011f2ac]
movups xmmword [ebp - 0x180], xmm0
movq xmm0, qword [0x1011f2bc]
movq qword [ebp - 0xc0], xmm0
movups xmm0, xmmword [0x1011f2dc]
movups xmmword [ebp - 0x190], xmm0
movq xmm0, qword [0x1011f2ec]
movq qword [ebp - 0x90], xmm0
movups xmm0, xmmword [0x1011f2c4]
movups xmmword [ebp - 0xb0], xmm0
movq xmm0, qword [0x1011f2d4]
movq qword [ebp - 0xd8], xmm0
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x1011011d
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov ecx, dword [0x101226c0]
mov edx, dword [eax + edi]
mov eax, dword [ecx]
and edx, 0xfff
push edx
mov eax, dword [eax + 0xc]
call eax
test eax, eax
je 0x10024b28
mov ecx, eax
call fcn.100019a0
test eax, eax
je 0x10024b28
cmp eax, 2
jne 0x10024a61
movups xmm0, xmmword [ebp - 0x150]
movd eax, xmm0
test al, al
je 0x10024b28
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [ebp - 0x98]
jmp 0x10024b3b
cmp eax, 3
jne 0x10024a8d
movups xmm0, xmmword [ebp - 0x160]
movd eax, xmm0
test al, al
je 0x10024b28
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [ebp - 0xc8]
jmp 0x10024b3b
cmp eax, 6
jne 0x10024ab9
movups xmm0, xmmword [ebp - 0x170]
movd eax, xmm0
test al, al
je 0x10024b28
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [ebp - 0xd0]
jmp 0x10024b3b
cmp eax, 5
jne 0x10024ade
movups xmm0, xmmword [ebp - 0x180]
movd eax, xmm0
test al, al
je 0x10024b28
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [ebp - 0xc0]
jmp 0x10024b3b
cmp eax, 7
jne 0x10024b03
movups xmm0, xmmword [ebp - 0x190]
movd eax, xmm0
test al, al
je 0x10024b28
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [ebp - 0x90]
jmp 0x10024b3b
cmp eax, 9
jne 0x10024b28
movups xmm0, xmmword [ebp - 0xb0]
movd eax, xmm0
test al, al
je 0x10024b28
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [ebp - 0xd8]
jmp 0x10024b3b
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [ebp - 0xe8]
mov ecx, dword [0x101226bc]
xor edx, edx
movq qword [ebp - 0xa8], xmm0
movaps xmm0, xmmword [0x10118c10]
movups xmmword [ebp - 0x30], xmm0
mov eax, dword [ecx]
mov dword [ebp - 0x20], 0x565f5250
mov byte [ebp - 0x1c], 0
mov esi, dword [eax + 0x44]
mov al, byte [ebp - 0x30]
xor byte [ebp + edx - 0x2f], al
inc edx
cmp edx, 0x13
jb 0x10024b66
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x1c], 0
push eax
call esi
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x30]
call eax
mov edi, dword [0x101227d4]
fstp dword [ebp - 0xbc]
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x1011011d
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov ecx, dword [0x101226c0]
mov edx, dword [eax + edi]
mov eax, dword [ecx]
and edx, 0xfff
push edx
mov eax, dword [eax + 0xc]
call eax
mov edi, eax
test edi, edi
je case.0x100253b7.4
mov ecx, dword [edi]
mov edx, dword [ecx + 0x734]
mov ecx, edi
call edx
mov eax, dword [eax + 0xc8]
cmp eax, 0x1f
ja case.0x10024bfd.1
movzx eax, byte [eax + 0x10025414]
jmp dword [eax*4 + 0x1002540c]
mov eax, dword [0x101226c8]
test eax, eax
jne 0x10024c3e
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100b1
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011006d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226c8], eax
cmp dword [eax + edi], 0
je case.0x100253b7.4
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x734]
call eax
test eax, eax
je case.0x100253b7.4
mov eax, dword [0x101226a8]
mov ecx, dword [0x101227d4]
mov dword [ebp - 0x80], 0x7f800000
mov dword [ebp - 0x84], 0x7f800000
mov dword [ebp - 0x88], 0x7f800000
mov dword [ebp - 0x74], 0x7f800000
mov dword [ebp - 0x78], 0x7f800000
mov dword [ebp - 0x7c], 0x7f800000
mov dword [ebp - 0x68], 0x7f800000
mov dword [ebp - 0x6c], 0x7f800000
mov dword [ebp - 0x70], 0x7f800000
mov dword [ebp - 0xf0], vtable.CTraceFilter.0
mov dword [ebp - 0x8c], ecx
test eax, eax
jne 0x10024cf7
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110101
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x10110025
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov ecx, dword [ebp - 0x8c]
mov dword [0x101226a8], eax
movss xmm0, dword [ebp - 0xbc]
movaps xmm1, xmm0
mulss xmm0, dword [ecx + eax + 4]
mulss xmm1, dword [ecx + eax]
mov eax, dword [ebp - 0x9c]
addss xmm0, dword [eax + 0x10]
addss xmm1, dword [eax + 0xc]
mulss xmm0, dword [0x10117e38]
movss dword [ebp - 0x8c], xmm1
movss dword [ebp - 0xbc], xmm0
call fcn.1000ff60
movss dword [ebp - 0xc4], xmm0
movss xmm0, dword [ebp - 0xbc]
call fcn.1000ff40
movss dword [ebp - 0xcc], xmm0
movss xmm0, dword [ebp - 0x8c]
mulss xmm0, dword [0x10117e38]
movss dword [ebp - 0x8c], xmm0
call fcn.1000ff60
movss dword [ebp - 0x94], xmm0
movss xmm0, dword [ebp - 0x8c]
call fcn.1000ff40
mov eax, dword [edi]
mov ecx, edi
movss dword [ebp - 0xbc], xmm0
mov eax, dword [eax + 0x734]
call eax
mov ecx, dword [0x101227d4]
movss xmm1, dword [eax + 0x10c]
lea eax, [ebp - 0xe8]
push eax
movss dword [ebp - 0x8c], xmm1
mov dword [ebp - 0xec], ecx
call fcn.10001b60
movss xmm3, dword [ebp - 0xbc]
movss xmm0, dword [ebp - 0x8c]
movaps xmm1, xmm3
mulss xmm1, dword [ebp - 0xcc]
mulss xmm3, dword [ebp - 0xc4]
movss xmm4, dword [eax]
movss xmm5, dword [eax + 4]
movss xmm6, dword [eax + 8]
movss xmm2, dword [ebp - 0x94]
mulss xmm1, xmm0
mov byte [ebp - 0xfb], 1
mulss xmm3, xmm0
addss xmm1, xmm4
mulss xmm2, xmm0
addss xmm3, xmm5
movaps xmm0, xmm6
subss xmm0, xmm2
subss xmm1, xmm4
subss xmm3, xmm5
subss xmm0, xmm6
movss dword [ebp - 0x130], xmm1
mulss xmm1, xmm1
movss dword [ebp - 0x12c], xmm3
mulss xmm3, xmm3
movss dword [ebp - 0x128], xmm0
mulss xmm0, xmm0
addss xmm1, xmm3
addss xmm1, xmm0
xorps xmm0, xmm0
ucomiss xmm1, xmm0
lahf
test ah, 0x44
jp 0x10024e6b
mov byte [ebp - 0xfb], 0
mov ecx, dword [0x101226c4]
lea edx, [ebp - 0x88]
push edx
lea edx, [ebp - 0xf0]
mov dword [ebp - 0x110], 0
push edx
mov dword [ebp - 0x10c], 0
lea edx, [ebp - 0x140]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x100], 0
mov byte [ebp - 0xfc], 1
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
movss dword [ebp - 0x140], xmm4
movss dword [ebp - 0x13c], xmm5
movss dword [ebp - 0x138], xmm6
mov eax, dword [ecx]
push 0x46004003
push edx
call dword [eax + 0x14]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x8c], esi
test esi, esi
je case.0x100253b7.4
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10024f46
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov esi, dword [ebp - 0x8c]
mov dword [0x101226d4], eax
cmp dword [eax + esi], 0
jle case.0x100253b7.4
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x278]
call eax
test al, al
je case.0x100253b7.4
cmp esi, dword [0x101227d4]
je case.0x100253b7.4
mov eax, dword [0x10122684]
test eax, eax
jne 0x10024fb0
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100bd
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov esi, dword [ebp - 0x8c]
mov dword [0x10122684], eax
cmp byte [eax + esi], 0
jne case.0x100253b7.4
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
mov eax, dword [eax + 0x24]
call eax
test al, al
jne case.0x100253b7.4
mov ecx, dword [0x10122694]
test ecx, ecx
jne 0x10025011
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110049
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov esi, dword [ebp - 0x8c]
mov ecx, eax
mov dword [0x10122694], ecx
mov edx, dword [0x101227d4]
lea eax, [ecx + esi]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xc4], edx
test ecx, ecx
jne 0x1002506a
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110049
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov edx, dword [ebp - 0xc4]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [0x10122694], ecx
mov eax, dword [eax]
cmp eax, dword [ecx + edx]
jne 0x1002507e
cmp byte [ebp - 0xb7], 0
je case.0x100253b7.4
mov eax, dword [0x10122680]
test eax, eax
jne 0x100250b8
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
mov ecx, dword [ebp - 0x8c]
test byte [eax + ecx], 1
jne 0x100250d1
cmp byte [ebp - 0xb3], 0
jne case.0x100253b7.4
mov ecx, dword [0x101227d4]
mov dword [ebp - 0x94], ecx
test eax, eax
jne 0x10025118
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov ecx, dword [ebp - 0x94]
mov dword [0x10122680], eax
test byte [eax + ecx], 1
jne 0x1002512b
cmp byte [ebp - 0xb4], 0
jne case.0x100253b7.4
movq xmm0, qword [ebp - 0x7c]
lea eax, [ebp - 0x19c]
mov ecx, dword [0x101227d4]
mov esi, dword [ebp - 0x74]
push eax
movq qword [ebp - 0xe8], xmm0
call fcn.10001b60
mov ecx, dword [0x10122660]
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x94], eax
mov eax, dword fs:[0x2c]
movq qword [ebp - 0xd8], xmm0
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101584c8]
cmp eax, dword [ecx + 4]
jle 0x100251c3
push 0x101584c8
call fcn.100f18de
add esp, 4
cmp dword [0x101584c8], 0xffffffff
jne 0x100251c3
mov edx, str.55_8B_EC_83_EC_08_8B_15_________0F_57_C0
mov dword [ebp - 4], 0
mov ecx, 0x1010fff4
call fcn.10066ae0
push 0x101584c8
mov dword [0x101584cc], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100f188d
add esp, 4
movq xmm0, qword [ebp - 0xe8]
sub esp, 0xc
mov ecx, dword [ebp - 0x94]
mov eax, esp
sub esp, 0xc
movq qword [eax], xmm0
movq xmm0, qword [ebp - 0xd8]
mov dword [eax + 8], esi
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], ecx
call dword [0x101584cc]
add esp, 0x18
test al, al
je 0x1002520b
cmp byte [ebp - 0xb5], 0
jne case.0x100253b7.4
mov eax, dword [0x101227d4]
mov dword [ebp - 0x94], eax
mov eax, dword [0x101226cc]
test eax, eax
jne 0x10025250
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100e1
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226cc], eax
mov ecx, dword [ebp - 0x94]
movss xmm0, dword [eax + ecx]
comiss xmm0, dword [0x10117ec0]
jbe 0x10025271
cmp byte [ebp - 0xb6], 0
jne case.0x100253b7.4
cmp byte [ebp - 0xa3], 0
je 0x100253a8
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x734]
call eax
cmp dword [eax + 0xc8], 1
jne 0x100253a8
mov eax, dword [0x101227d4]
mov dword [ebp - 0x94], eax
mov eax, dword [0x101226d8]
test eax, eax
jne 0x100252dc
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110111
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d8], eax
mov ecx, dword [ebp - 0x94]
movd xmm0, dword [eax + ecx]
mov eax, dword [0x1012268c]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [eax + 0x20]
mov eax, dword [0x101226b0]
movss dword [ebp - 0x94], xmm0
test eax, eax
jne 0x10025336
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110099
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011006d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226b0], eax
movss xmm0, dword [eax + edi]
xorps xmm1, xmm1
subss xmm0, dword [ebp - 0x94]
comiss xmm0, xmm1
jbe 0x100253a8
mov eax, dword [0x10122674]
test eax, eax
jne 0x10025385
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110081
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x10110055
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122674], eax
cmp word [eax + edi], 0x40
mov edx, dword [ebp - 0x9c]
mov ecx, dword [edx + 0x30]
jne 0x100253a0
and ecx, 0xfffff7ff
mov dword [edx + 0x30], ecx
jmp 0x100253ae
and ecx, 0xfffffffe
mov dword [edx + 0x30], ecx
jmp 0x100253ae
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x44]
dec eax
cmp eax, 7
ja case.0x100253b7.4
jmp dword [eax*4 + 0x10025434]
mov al, byte [ebp - 0xa8]
jmp 0x100253e4
mov al, byte [ebp - 0xa7]
jmp 0x100253e4
mov al, byte [ebp - 0xa6]
jmp 0x100253e4
mov al, byte [ebp - 0xa5]
jmp 0x100253e4
mov al, byte [ebp - 0xa4]
test al, al
je case.0x100253b7.4
or dword [edx + 0x30], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100f1854
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4