Function at 0x10041c90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x108
mov eax, dword [0x100d8054]
xor eax, esp
mov dword [esp + 0x104], eax
cmp byte [0x101dfe52], 0
movss xmm2, dword [0x100d049c]
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
je 0x10042766
cmp dword [0x101dfe7c], 0
jbe 0x10042766
push dword [0x101140ec]
call esi
test ax, ax
je 0x1004275e
push dword [0x101140ec]
call esi
test ax, ax
je 0x1004275e
mov cl, 0x11
mov byte [esp + 0x60], 0x7d
mov byte [esp + 0x1a], cl
mov al, 0x1e
xor al, byte [esp + 0x60]
mov ah, 0x18
mov byte [esp + 0x61], al
mov dl, 0x14
mov byte [esp + 0x1b], cl
mov ch, 0x13
xor cl, byte [esp + 0x60]
mov dh, 9
mov byte [esp + 0x62], cl
mov cl, byte [esp + 0x60]
mov byte [esp + 0x18], 0x53
xor ah, cl
mov al, byte [esp + 0x18]
xor dl, cl
xor al, cl
mov byte [esp + 0x19], 0x19
mov byte [esp + 0x67], al
xor ch, cl
mov al, byte [esp + 0x19]
xor dh, cl
xor al, cl
mov byte [esp + 0x64], ah
mov byte [esp + 0x68], al
mov al, byte [esp + 0x1a]
xor al, cl
mov byte [esp + 0x6b], 0
mov byte [esp + 0x69], al
mov al, byte [esp + 0x1b]
xor al, cl
mov byte [esp + 0x63], dl
mov byte [esp + 0x6a], al
lea eax, [esp + 0x61]
push eax
mov byte [esp + 0x69], ch
mov byte [esp + 0x6a], dh
mov byte [esp + 0x6f], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1004275e
cmp dword [0xb6fc58], 1
movd xmm0, dword [0xc9c040]
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x54], xmm0
movd xmm0, dword [0xc9c044]
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x58], xmm0
jne 0x1004275e
call fcn.1003bc90
movss xmm0, dword [0x100d061c]
xor esi, esi
mov dword [esp + 0x5c], eax
xor edi, edi
mov dword [esp + 0x14], esi
movss dword [esp + 0x34], xmm0
nop dword [eax + eax]
mov cl, 0x76
mov byte [esp + 0x74], 0x1a
mov byte [esp + 0x19], cl
mov al, 0x79
xor al, byte [esp + 0x74]
mov ah, 0x7f
mov byte [esp + 0x75], al
mov dl, 0x73
mov byte [esp + 0x18], cl
mov ch, 0x74
xor cl, byte [esp + 0x74]
mov dh, 0x6e
mov byte [esp + 0x76], cl
mov cl, byte [esp + 0x74]
mov byte [esp + 0x1b], 0x34
xor ah, cl
mov al, byte [esp + 0x1b]
xor dl, cl
xor al, cl
mov byte [esp + 0x1a], 0x7e
mov byte [esp + 0x7b], al
xor ch, cl
mov al, byte [esp + 0x1a]
xor dh, cl
xor al, cl
mov byte [esp + 0x78], ah
mov byte [esp + 0x7c], al
mov al, byte [esp + 0x19]
xor al, cl
mov byte [esp + 0x7f], 0
mov byte [esp + 0x7d], al
mov al, byte [esp + 0x18]
xor al, cl
mov byte [esp + 0x77], dl
mov byte [esp + 0x7e], al
lea eax, [esp + 0x75]
push eax
mov byte [esp + 0x7d], ch
mov byte [esp + 0x7e], dh
mov byte [esp + 0x83], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1004235b
mov eax, 0xb6fc58
cmp dword [eax], 1
jne 0x1004235b
mov eax, dword [0x101dfe54]
test eax, eax
jne 0x10041e95
mov esi, 0x101dfe84
jmp 0x10041ea5
cmp eax, 1
mov esi, 0x101dbe4c
mov eax, 0x101dfe84
cmovne esi, eax
mov esi, dword [esi + edi]
test esi, esi
je 0x10042357
mov ecx, esi
call fcn.1003c230
test al, al
je 0x10042342
cmp esi, dword [esp + 0x5c]
je 0x10042342
lea edx, [esp + 0x18]
mov byte [esp + 0x18], 0
mov ecx, esi
call fcn.1003c500
cmp byte [esp + 0x18], 0
je 0x10042342
call fcn.1003bc90
lea edx, [esp + 0x48]
mov ecx, eax
call fcn.1003bdf0
lea eax, [esp + 0x38]
mov ecx, esi
push eax
call fcn.1003c630
movss xmm7, dword [esp + 0x44]
mov eax, 0xb6fa2c
movaps xmm6, xmm7
movss dword [esp + 0x28], xmm7
add esp, 4
movups xmm3, xmmword [eax + 0x20]
movups xmm2, xmmword [eax + 0x10]
movups xmm5, xmmword [eax]
movups xmm4, xmmword [eax + 0x30]
mov eax, dword [0xc17044]
movaps xmm0, xmm3
mulss xmm7, xmm3
shufps xmm0, xmm3, 0xaa
mulss xmm6, xmm0
movss xmm0, dword [esp + 0x3c]
movaps xmm1, xmm0
movss dword [esp + 0x28], xmm0
movaps xmm0, xmm2
shufps xmm3, xmm3, 0x55
shufps xmm0, xmm2, 0xaa
mulss xmm1, xmm0
movss xmm0, dword [esp + 0x38]
movss dword [esp + 0x20], xmm0
addss xmm6, xmm1
movaps xmm1, xmm0
movaps xmm0, xmm5
shufps xmm0, xmm5, 0xaa
mulss xmm1, xmm0
movaps xmm0, xmm4
shufps xmm0, xmm4, 0xaa
addss xmm6, xmm1
movss xmm1, dword [0x100d04d4]
addss xmm6, xmm0
movss xmm0, dword [esp + 0x3c]
mulss xmm0, xmm2
shufps xmm2, xmm2, 0x55
addss xmm7, xmm0
movss xmm0, dword [esp + 0x20]
mulss xmm0, xmm5
divss xmm1, xmm6
addss xmm7, xmm0
shufps xmm5, xmm5, 0x55
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addss xmm7, xmm4
shufps xmm4, xmm4, 0x55
addsd xmm0, qword [eax*8 + 0x100d0d00]
mov eax, dword [0xc17048]
cvtpd2ps xmm0, xmm0
mulss xmm0, xmm1
mulss xmm7, xmm0
movss xmm0, dword [esp + 0x3c]
mulss xmm0, xmm2
movss dword [esp + 0x1c], xmm0
movss xmm0, dword [esp + 0x24]
movss xmm2, dword [esp + 0x1c]
mulss xmm0, xmm3
addss xmm2, xmm0
movss xmm0, dword [esp + 0x20]
mulss xmm0, xmm5
movaps xmm5, xmm2
addss xmm5, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addss xmm5, xmm4
addsd xmm0, qword [eax*8 + 0x100d0d00]
cvtpd2ps xmm0, xmm0
mulss xmm0, xmm1
mulss xmm5, xmm0
xorps xmm0, xmm0
comiss xmm6, xmm0
jbe 0x10042342
mov eax, dword [0xbaa410]
cmp eax, 0x1e
je 0x1004220d
cmp eax, 0x1f
je 0x1004220d
cmp eax, 0x21
je 0x1004220d
cmp eax, 0x16
je 0x1004220d
cmp eax, 0x17
je 0x1004220d
cmp eax, 0x18
je 0x1004220d
cmp eax, 0x19
je 0x1004220d
cmp eax, 0x1a
je 0x1004220d
cmp eax, 0x1b
je 0x1004220d
cmp eax, 0x1c
je 0x1004220d
cmp eax, 0x1d
je 0x1004220d
cmp eax, 0x20
je 0x1004220d
movd xmm3, dword [0x101500bc]
movss xmm2, dword [esp + 0x54]
movss xmm4, dword [0x100d049c]
cvtdq2ps xmm3, xmm3
mulss xmm2, xmm4
movaps xmm0, xmm3
addss xmm0, xmm2
comiss xmm0, xmm7
jb 0x10042342
movss xmm1, dword [esp + 0x58]
mulss xmm1, xmm4
movaps xmm0, xmm1
addss xmm0, xmm3
comiss xmm0, xmm5
jb 0x10042342
subss xmm2, xmm3
comiss xmm7, xmm2
jb 0x10042342
subss xmm1, xmm3
comiss xmm5, xmm1
jb 0x10042342
movss xmm0, dword [esp + 0x48]
sub esp, 0x10
movss dword [esp + 0x2c], xmm0
movss xmm0, dword [esp + 0x60]
movss dword [esp + 0x70], xmm0
movsd xmm0, qword [0x100d0558]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x38]
subss xmm0, dword [esp + 0x5c]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10097d40
movsd xmm0, qword [0x100d0558]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x30]
subss xmm0, dword [esp + 0x2c]
fstp qword [esp + 0x38]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10097d40
movsd xmm0, qword [0x100d0558]
fadd qword [esp + 0x38]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x34]
subss xmm0, dword [esp + 0x70]
fstp qword [esp + 0x38]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10097d40
fadd qword [esp + 0x38]
add esp, 0x10
xorps xmm1, xmm1
fstp qword [esp + 0x60]
movsd xmm0, qword [esp + 0x60]
ucomisd xmm1, xmm0
ja 0x100421d5
sqrtsd xmm0, xmm0
jmp 0x100421da
call fcn.100b1880
movss xmm1, dword [esp + 0x34]
cvtsd2ss xmm0, xmm0
comiss xmm1, xmm0
jb 0x10042342
movss xmm1, dword [0x100d05e4]
comiss xmm1, xmm0
jb 0x10042342
movss dword [esp + 0x34], xmm0
mov dword [esp + 0x14], esi
jmp 0x10042346
movss xmm2, dword [esp + 0x54]
movd xmm3, dword [0x101500bc]
cvtps2pd xmm2, xmm2
cvtdq2pd xmm3, xmm3
mulsd xmm2, qword [0x100d0538]
cvtps2pd xmm6, xmm7
movaps xmm0, xmm3
addsd xmm0, xmm2
comisd xmm0, xmm6
jb 0x10042342
movss xmm1, dword [esp + 0x58]
cvtps2pd xmm1, xmm1
cvtps2pd xmm4, xmm5
mulsd xmm1, qword [0x100d0528]
movaps xmm0, xmm1
addsd xmm0, xmm3
comisd xmm0, xmm4
jb 0x10042342
subsd xmm2, xmm3
comisd xmm6, xmm2
jb 0x10042342
subsd xmm1, xmm3
comisd xmm4, xmm1
jb 0x10042342
movss xmm0, dword [esp + 0x48]
sub esp, 0x10
movss dword [esp + 0x70], xmm0
movss xmm0, dword [esp + 0x60]
movss dword [esp + 0x2c], xmm0
movsd xmm0, qword [0x100d0558]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x38]
subss xmm0, dword [esp + 0x5c]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10097d40
movsd xmm0, qword [0x100d0558]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x30]
subss xmm0, dword [esp + 0x70]
fstp qword [esp + 0x38]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10097d40
movsd xmm0, qword [0x100d0558]
fadd qword [esp + 0x38]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x34]
subss xmm0, dword [esp + 0x2c]
fstp qword [esp + 0x70]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10097d40
fadd qword [esp + 0x70]
add esp, 0x10
xorps xmm1, xmm1
fstp qword [esp + 0x60]
movsd xmm0, qword [esp + 0x60]
ucomisd xmm1, xmm0
ja 0x100421d5
sqrtsd xmm0, xmm0
jmp 0x100421da
mov esi, dword [esp + 0x14]
add edi, 4
cmp edi, 0x3ffc
jle 0x10041de0
jmp 0x1004235b
mov esi, dword [esp + 0x14]
test esi, esi
je 0x10042758
mov ecx, esi
call fcn.1003c230
test al, al
je 0x10042758
cmp byte [0x101e3e84], 0
jne 0x100423da
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push dword [0x101e3e88]
call esi
mov eax, dword [0x101e3e88]
lea ecx, [esp + 0x28]
push ecx
mov byte [eax], 0xeb
push dword [esp + 0x2c]
push 1
push eax
call esi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push dword [0x101dfe7c]
call esi
mov eax, dword [0x101dfe7c]
lea ecx, [esp + 0x28]
push ecx
mov byte [eax], 0xeb
push dword [esp + 0x2c]
push 1
push eax
call esi
mov esi, dword [esp + 0x14]
mov byte [0x101e3e84], 1
lea eax, [esp + 0x38]
mov ecx, esi
push eax
call fcn.1003c630
movss xmm3, dword [esp + 0x40]
mov eax, 0xb6fa2c
movaps xmm2, xmm3
movss dword [esp + 0x20], xmm3
movss xmm3, dword [esp + 0x44]
add esp, 4
movaps xmm1, xmm3
movups xmm4, xmmword [eax + 0x10]
movups xmm5, xmmword [eax + 0x20]
movups xmm7, xmmword [eax]
movups xmm6, xmmword [eax + 0x30]
mov eax, dword [0xc17044]
movaps xmm0, xmm4
shufps xmm0, xmm4, 0xaa
mulss xmm2, xmm0
movaps xmm0, xmm5
shufps xmm0, xmm5, 0xaa
mulss xmm1, xmm0
movaps xmm0, xmm7
shufps xmm0, xmm7, 0xaa
addss xmm2, xmm1
movss dword [esp + 0x20], xmm2
movss xmm2, dword [esp + 0x38]
movaps xmm1, xmm2
mulss xmm1, xmm0
movss xmm0, dword [esp + 0x20]
addss xmm0, xmm1
movss dword [esp + 0x20], xmm0
movaps xmm0, xmm6
movss xmm1, dword [esp + 0x20]
shufps xmm0, xmm6, 0xaa
addss xmm1, xmm0
movss xmm0, dword [0x100d04d4]
divss xmm0, xmm1
movss dword [esp + 0x20], xmm1
movss xmm1, dword [esp + 0x1c]
movss dword [esp + 0x24], xmm0
movaps xmm0, xmm3
mulss xmm0, xmm5
mulss xmm1, xmm4
shufps xmm4, xmm4, 0x55
shufps xmm5, xmm5, 0x55
addss xmm1, xmm0
mulss xmm3, xmm5
movaps xmm0, xmm2
mulss xmm0, xmm7
shufps xmm7, xmm7, 0x55
mulss xmm2, xmm7
addss xmm1, xmm0
movaps xmm0, xmm1
addss xmm0, xmm6
shufps xmm6, xmm6, 0x55
movss dword [esp + 0x14], xmm0
movss xmm1, dword [esp + 0x14]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100d0d00]
mov eax, dword [0xc17048]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [esp + 0x24]
mulss xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movss dword [esp + 0x14], xmm1
movss xmm1, dword [esp + 0x1c]
addsd xmm0, qword [eax*8 + 0x100d0d00]
mulss xmm1, xmm4
addss xmm1, xmm3
cvtpd2ps xmm0, xmm0
addss xmm1, xmm2
mulss xmm0, dword [esp + 0x24]
addss xmm1, xmm6
mulss xmm1, xmm0
movss xmm0, dword [esp + 0x20]
movss dword [esp + 0x1c], xmm1
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x10042758
mov eax, 0xb6fa2c
push 0x40
push 0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0xc8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esp + 0xd8], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [esp + 0xe8], xmm0
movups xmm0, xmmword [eax + 0x30]
lea eax, [esp + 0x88]
push eax
movups xmmword [esp + 0xfc], xmm0
call fcn.10089ed0
add esp, 0xc
mov dword [esp + 0xfc], 0x3f800000
lea eax, [esp + 0xc0]
push eax
push 0
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.d3dx9_43.dll_D3DXMatrixInverse]
mov eax, dword [0xc17044]
mov esi, 0xb6f258
movss xmm5, dword [esp + 0x14]
movss xmm3, dword [esp + 0x1c]
movss xmm6, dword [esp + 0x20]
movd xmm0, eax
lea edi, [esi - 0x10]
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movss xmm4, dword [esp + 0xa0]
addsd xmm0, qword [eax*8 + 0x100d0d00]
mov eax, dword [0xc17048]
movss xmm2, dword [esp + 0xa4]
mulss xmm4, xmm6
cvtpd2ps xmm0, xmm0
movss xmm1, dword [esp + 0xa8]
mulss xmm0, dword [esp + 0x24]
mulss xmm2, xmm6
divss xmm5, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mulss xmm1, xmm6
addsd xmm0, qword [eax*8 + 0x100d0d00]
lea eax, [esp + 0x48]
push eax
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [esp + 0x28]
divss xmm3, xmm0
movss xmm0, dword [esp + 0x94]
mulss xmm0, xmm3
addss xmm4, xmm0
movss xmm0, dword [esp + 0x84]
mulss xmm0, xmm5
addss xmm4, xmm0
movss xmm0, dword [esp + 0x98]
mulss xmm0, xmm3
addss xmm2, xmm0
movss xmm0, dword [esp + 0x88]
mulss xmm0, xmm5
addss xmm4, dword [esp + 0xb4]
addss xmm2, xmm0
movss xmm0, dword [esp + 0x9c]
mulss xmm0, xmm3
movss dword [esp + 0x4c], xmm4
addss xmm2, dword [esp + 0xb8]
addss xmm1, xmm0
movss xmm0, dword [esp + 0x8c]
mulss xmm0, xmm5
movss dword [esp + 0x50], xmm2
addss xmm1, xmm0
movss xmm0, dword [0xb6f338]
movss dword [esp + 0x78], xmm0
movss xmm0, dword [0xb6f33c]
movss dword [esp + 0x7c], xmm0
movss xmm0, dword [0xb6f340]
addss xmm1, dword [esp + 0xbc]
movss dword [esp + 0x80], xmm0
movss dword [esp + 0x54], xmm1
movss xmm3, dword [esp + 0x38]
lea edx, [esp + 0x78]
lea ecx, [esp + 0x64]
call fcn.1003b8a0
movss xmm0, dword [esp + 0x68]
add esp, 4
subss xmm0, dword [esi]
mulss xmm0, dword [0x100d04c0]
addss xmm0, dword [esi]
movss dword [esi], xmm0
movss xmm0, dword [esp + 0x60]
subss xmm0, dword [edi]
mulss xmm0, dword [0x100d04c0]
addss xmm0, dword [edi]
movss dword [edi], xmm0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
movss xmm2, dword [0x100d049c]
cmp byte [0x100d8afc], 0
je 0x10042851
cmp byte [0x101dfe52], 0
je 0x10042851
movd xmm1, dword [0xc9c040]
movd xmm0, dword [0xc9c044]
mov eax, dword [0xbaa410]
mov dword [esp + 0x38], 0xff
mov dword [esp + 0x3c], 0xff
mov dword [esp + 0x40], 0xff
mov dword [esp + 0x44], 0xff
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm0, xmm0
cmp eax, 0x1e
je 0x10042824
cmp eax, 0x1f
je 0x10042824
cmp eax, 0x21
je 0x10042824
cmp eax, 0x16
je 0x10042824
cmp eax, 0x17
je 0x10042824
cmp eax, 0x18
je 0x10042824
cmp eax, 0x19
je 0x10042824
cmp eax, 0x1a
je 0x10042824
cmp eax, 0x1b
je 0x10042824
cmp eax, 0x1c
je 0x10042824
cmp eax, 0x1d
je 0x10042824
cmp eax, 0x20
je 0x10042824
cmp eax, 0x25
je 0x10042824
cmp eax, 0x26
je 0x10042824
cmp eax, 0x2a
je 0x10042824
cmp eax, 0x29
je 0x10042824
push ecx
lea eax, [esp + 0x3c]
mulss xmm0, xmm2
push eax
mulss xmm1, xmm2
push ecx
cvttss2si edx, xmm0
cvttss2si ecx, xmm1
jmp 0x10042849
cvtps2pd xmm0, xmm0
push ecx
lea eax, [esp + 0x3c]
push eax
push ecx
mulsd xmm0, qword [0x100d0528]
cvttsd2si edx, xmm0
cvtps2pd xmm0, xmm1
mulsd xmm0, qword [0x100d0538]
cvttsd2si ecx, xmm0
call fcn.1003c8f0
add esp, 0xc
cmp byte [0x101dbe24], 0
je 0x1004287e
push 0x23
call esi
bt ax, 0xf
jae 0x1004287e
push 0xbe
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x101dfe52], 0
sete byte [0x101dfe52]
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.10046dd3
mov esp, ebp
pop ebp
ret