Function at 0x100249f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x100fa00c]
xor eax, esp
mov dword [esp + 0x48], eax
cmp dword [0xb6fc58], 1
push ebx
push esi
push edi
jne 0x1002518b
cmp byte [0x100fff86], 1
jne 0x1002518b
push str.client.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1002518b
cmp byte [0x100fff85], 0
jne 0x10024a98
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push dword [0x10103fdc]
call esi
mov eax, dword [0x10103fdc]
lea ecx, [esp + 0x10]
push ecx
mov byte [eax], 0xeb
push dword [esp + 0x14]
push 1
push eax
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push dword [0x100fff8c]
call esi
mov eax, dword [0x100fff8c]
lea ecx, [esp + 0x10]
push ecx
mov byte [eax], 0xeb
push dword [esp + 0x14]
push 1
push eax
call esi
mov byte [0x100fff85], 1
cmp dword [0xb6fc58], 1
jne 0x1002518b
push 0xffffffffffffffff
mov eax, 0x56e210
call eax
mov edi, eax
add esp, 4
and dword [edi + 0x1c], 0xfffffffe
cmp dword [0xb6fc58], 1
jne 0x10024b1c
mov eax, dword [0x100fffa0]
test eax, eax
jne 0x10024b1a
movzx eax, word [0x100f041c]
movq xmm0, qword [0x100f0414]
mov word [esp + 0x50], ax
movzx eax, word [0x100f0428]
mov word [esp + 0x40], ax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x4c]
movq qword [esp + 0x4c], xmm0
movq xmm0, qword [str.x____xxxx]
push eax
push str.client.dll
movq qword [esp + 0x44], xmm0
call fcn.10004fc0
mov dword [0x100fffa0], eax
test eax, eax
je 0x10024b1c
call eax
mov eax, dword [edi + 0x14]
lea ecx, [edi + 4]
test eax, eax
lea edx, [eax + 0x30]
mov eax, 0x411b50
cmove edx, ecx
lea ecx, [esp + 0x14]
push edx
call eax
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x57
call esi
mov ebx, 0x420b10
test ax, ax
je 0x10024cab
mov eax, dword [0x10103fc0]
test eax, eax
jne 0x10024b74
push str.xxxxxxxx____x____x
push 0x100f04ec
push str.client.dll
call fcn.10004fc0
mov dword [0x10103fc0], eax
test eax, eax
je 0x10024b8d
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x2c]
push ecx
call eax
add esp, 0x10
movss xmm0, dword [esp + 0x48]
subss xmm0, dword [esp + 0x20]
movss xmm1, dword [esp + 0x4c]
subss xmm1, dword [esp + 0x24]
movss dword [esp + 0x38], xmm0
divss xmm0, xmm1
movss dword [esp + 0x10], xmm1
cvtps2pd xmm0, xmm0
call fcn.100857b0
movss xmm3, dword [esp + 0x38]
xorps xmm1, xmm1
movss xmm2, dword [esp + 0x10]
cvtsd2ss xmm1, xmm0
xorps xmm0, xmm0
comiss xmm3, xmm0
mulss xmm1, dword [0x100f1fe4]
jb 0x10024be5
comiss xmm0, xmm2
jae 0x10024bef
comiss xmm0, xmm3
jb 0x10024bf7
comiss xmm0, xmm2
jb 0x10024bf7
addss xmm1, dword [0x100f2008]
addss xmm1, xmm0
push ecx
mov dword [esp], 0
cvtps2pd xmm0, xmm1
mulsd xmm0, qword [0x100f1ed0]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x3c], xmm0
call fcn.10085aa0
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
push ecx
movsd xmm0, qword [esp + 0x40]
movss dword [esp], xmm1
call fcn.10086a40
cvtsd2ss xmm0, xmm0
push ecx
lea ecx, [esp + 0x38]
movss dword [esp], xmm0
call ebx
movss xmm1, dword [esp + 0x2c]
xorps xmm2, xmm2
cvtsi2sd xmm2, dword [0x100fae34]
movss xmm0, dword [esp + 0x14]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, qword [0x100f1f18]
mulsd xmm1, xmm2
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss xmm1, dword [esp + 0x30]
cvtps2pd xmm1, xmm1
movss dword [esp + 0x14], xmm0
mulsd xmm1, qword [0x100f1f18]
movss xmm0, dword [esp + 0x18]
cvtps2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x18], xmm0
push 0x53
call esi
test ax, ax
je 0x10024e31
mov eax, dword [0x10103fc0]
test eax, eax
jne 0x10024cde
push str.xxxxxxxx____x____x
push 0x100f04ec
push str.client.dll
call fcn.10004fc0
mov dword [0x10103fc0], eax
test eax, eax
je 0x10024cf7
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x2c]
push ecx
call eax
add esp, 0x10
movss xmm0, dword [esp + 0x2c]
subss xmm0, dword [esp + 0x20]
movss xmm1, dword [esp + 0x30]
subss xmm1, dword [esp + 0x24]
movss dword [esp + 0x38], xmm0
divss xmm0, xmm1
movss dword [esp + 0x10], xmm1
cvtps2pd xmm0, xmm0
call fcn.100857b0
movss xmm3, dword [esp + 0x38]
xorps xmm1, xmm1
movss xmm2, dword [esp + 0x10]
cvtsd2ss xmm1, xmm0
xorps xmm0, xmm0
comiss xmm3, xmm0
mulss xmm1, dword [0x100f1fe4]
jb 0x10024d5d
comiss xmm0, xmm2
jb 0x10024d5d
movss xmm0, dword [0x100f2008]
addss xmm1, xmm0
jmp 0x10024d7d
comiss xmm0, xmm3
jb 0x10024d75
comiss xmm0, xmm2
movss xmm0, dword [0x100f2008]
jb 0x10024d7d
addss xmm1, xmm0
jmp 0x10024d7d
movss xmm0, dword [0x100f2008]
addss xmm1, xmm0
push ecx
mov dword [esp], 0
cvtps2pd xmm0, xmm1
mulsd xmm0, qword [0x100f1ed0]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x3c], xmm0
call fcn.10085aa0
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
push ecx
movsd xmm0, qword [esp + 0x40]
movss dword [esp], xmm1
call fcn.10086a40
cvtsd2ss xmm0, xmm0
push ecx
lea ecx, [esp + 0x54]
movss dword [esp], xmm0
call ebx
movss xmm1, dword [esp + 0x48]
xorps xmm2, xmm2
cvtsi2sd xmm2, dword [0x100fae34]
movss xmm0, dword [esp + 0x14]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, qword [0x100f1f18]
mulsd xmm1, xmm2
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss xmm1, dword [esp + 0x4c]
cvtps2pd xmm1, xmm1
movss dword [esp + 0x14], xmm0
mulsd xmm1, qword [0x100f1f18]
movss xmm0, dword [esp + 0x18]
cvtps2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x18], xmm0
push 0x41
call esi
test ax, ax
je 0x10024f9f
mov eax, dword [0x10103fc0]
test eax, eax
jne 0x10024e64
push str.xxxxxxxx____x____x
push 0x100f04ec
push str.client.dll
call fcn.10004fc0
mov dword [0x10103fc0], eax
test eax, eax
je 0x10024e7d
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x2c]
push ecx
call eax
add esp, 0x10
movss xmm0, dword [esp + 0x2c]
subss xmm0, dword [esp + 0x20]
movss xmm1, dword [esp + 0x30]
subss xmm1, dword [esp + 0x24]
movss dword [esp + 0x38], xmm0
divss xmm0, xmm1
movss dword [esp + 0x10], xmm1
cvtps2pd xmm0, xmm0
call fcn.100857b0
movss xmm3, dword [esp + 0x38]
xorps xmm1, xmm1
movss xmm2, dword [esp + 0x10]
cvtsd2ss xmm1, xmm0
xorps xmm0, xmm0
comiss xmm3, xmm0
mulss xmm1, dword [0x100f1fe4]
jb 0x10024ed5
comiss xmm0, xmm2
jae 0x10024edf
comiss xmm0, xmm3
jb 0x10024ee7
comiss xmm0, xmm2
jb 0x10024ee7
addss xmm1, dword [0x100f2008]
subss xmm1, dword [0x100f1ff4]
push ecx
mov dword [esp], 0
cvtps2pd xmm0, xmm1
mulsd xmm0, qword [0x100f1ed0]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x3c], xmm0
call fcn.10085aa0
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
push ecx
movsd xmm0, qword [esp + 0x40]
movss dword [esp], xmm1
call fcn.10086a40
cvtsd2ss xmm0, xmm0
push ecx
lea ecx, [esp + 0x54]
movss dword [esp], xmm0
call ebx
movss xmm1, dword [esp + 0x48]
xorps xmm2, xmm2
cvtsi2sd xmm2, dword [0x100fae34]
movss xmm0, dword [esp + 0x14]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, qword [0x100f1f18]
mulsd xmm1, xmm2
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss xmm1, dword [esp + 0x4c]
cvtps2pd xmm1, xmm1
movss dword [esp + 0x14], xmm0
mulsd xmm1, qword [0x100f1f18]
movss xmm0, dword [esp + 0x18]
cvtps2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x18], xmm0
push 0x44
call esi
test ax, ax
je 0x1002510d
mov eax, dword [0x10103fc0]
test eax, eax
jne 0x10024fd2
push str.xxxxxxxx____x____x
push 0x100f04ec
push str.client.dll
call fcn.10004fc0
mov dword [0x10103fc0], eax
test eax, eax
je 0x10024feb
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x2c]
push ecx
call eax
add esp, 0x10
movss xmm0, dword [esp + 0x2c]
subss xmm0, dword [esp + 0x20]
movss xmm1, dword [esp + 0x30]
subss xmm1, dword [esp + 0x24]
movss dword [esp + 0x38], xmm0
divss xmm0, xmm1
movss dword [esp + 0x10], xmm1
cvtps2pd xmm0, xmm0
call fcn.100857b0
movss xmm3, dword [esp + 0x38]
xorps xmm1, xmm1
movss xmm2, dword [esp + 0x10]
cvtsd2ss xmm1, xmm0
xorps xmm0, xmm0
comiss xmm3, xmm0
mulss xmm1, dword [0x100f1fe4]
jb 0x10025043
comiss xmm0, xmm2
jae 0x1002504d
comiss xmm0, xmm3
jb 0x10025055
comiss xmm0, xmm2
jb 0x10025055
addss xmm1, dword [0x100f2008]
addss xmm1, dword [0x100f1ff4]
push ecx
mov dword [esp], 0
cvtps2pd xmm0, xmm1
mulsd xmm0, qword [0x100f1ed0]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x3c], xmm0
call fcn.10085aa0
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
push ecx
movsd xmm0, qword [esp + 0x40]
movss dword [esp], xmm1
call fcn.10086a40
cvtsd2ss xmm0, xmm0
push ecx
lea ecx, [esp + 0x54]
movss dword [esp], xmm0
call ebx
movss xmm1, dword [esp + 0x48]
xorps xmm2, xmm2
cvtsi2sd xmm2, dword [0x100fae34]
movss xmm0, dword [esp + 0x14]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, qword [0x100f1f18]
mulsd xmm1, xmm2
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss xmm1, dword [esp + 0x4c]
cvtps2pd xmm1, xmm1
movss dword [esp + 0x14], xmm0
mulsd xmm1, qword [0x100f1f18]
movss xmm0, dword [esp + 0x18]
cvtps2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x18], xmm0
push 0x20
call esi
test ax, ax
je 0x10025141
movd xmm1, dword [0x100fae34]
movss xmm0, dword [esp + 0x1c]
cvtdq2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, qword [0x100f1f18]
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x1c], xmm0
push 0x11
call esi
test ax, ax
je 0x10025175
movd xmm0, dword [0x100fae34]
movss xmm1, dword [esp + 0x1c]
cvtdq2pd xmm0, xmm0
cvtps2pd xmm1, xmm1
mulsd xmm0, qword [0x100f1f18]
subsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x1c], xmm0
lea eax, [esp + 0x14]
mov ecx, edi
push eax
mov eax, 0x4241c0
call eax
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10068c51
mov esp, ebp
pop ebp
ret