Function at 0x438b30
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
sub esp, 0x28
mov eax, dword [0x628218]
push ebx
push esi
mov esi, dword [0x628214]
sub eax, esi
mov dword [esp + 0xc], 0x6297e0
push edi
cmp eax, 0xffffffff
jne 0x438b5c
mov ecx, 0x6297e0
call fcn.00436b40
jmp 0x438b67
inc eax
lea ecx, [esp + 0x10]
push eax
call fcn.00436af0
add eax, esi
mov byte [esp + 0x2f], 0
xor edx, edx
mov edi, 0x7e
div edi
mov dh, dl
inc dh
mov al, dh
mov byte [esp + 0x18], dh
xor al, 0x53
mov cl, dh
mov byte [esp + 0x19], al
xor cl, 0x74
mov al, dh
mov byte [esp + 0x1f], cl
xor al, 0x75
mov byte [esp + 0x26], cl
mov byte [esp + 0x1a], al
mov bl, dh
mov al, dh
xor bl, 0x6f
xor al, 0x70
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1b], al
mov ah, dh
mov byte [esp + 0x1c], al
xor ah, 0x72
mov al, dh
mov byte [esp + 0x1e], ah
xor al, 0x64
mov byte [esp + 0x24], bl
mov byte [esp + 0x21], al
mov dl, dh
mov al, dh
mov byte [esp + 0x27], ah
xor al, 0x20
mov byte [esp + 0x28], bl
mov byte [esp + 0x22], al
xor dl, 0x65
mov al, dh
mov byte [esp + 0x20], dl
xor al, 0x63
mov byte [esp + 0x2b], dl
mov byte [esp + 0x23], al
mov al, dh
xor al, 0x6e
mov byte [esp + 0x2c], ah
mov byte [esp + 0x25], al
mov al, dh
xor al, 0x6c
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], al
mov al, dh
xor al, 0x73
mov byte [esp + 0x2d], al
mov al, dh
xor al, 0x3a
xor ecx, ecx
mov byte [esp + 0x2e], al
nop word [eax + eax]
mov al, byte [esp + ecx + 0x19]
xor al, dh
mov byte [ecx + 0x62bf78], al
inc ecx
cmp ecx, 0x16
jb 0x438c20
mov ecx, 0x62bf78
mov byte [0x62bf8e], 0
call fcn.00484560
call fcn.00423160
cmp byte [0x6296b9], 0
mov dword [esp + 0x10], 0x42be0000
mov dword [esp + 0x14], 0x41e00000
jne 0x438c97
cmp dword [0x628174], 0xffffffff
jne 0x438c71
mov ecx, str.Set_HotKey
jmp 0x438c7d
mov eax, dword [0x627ba8]
mov ecx, dword [eax*4 + 0x4a4c50]
push ecx
lea edx, [esp + 0x14]
call fcn.00482400
add esp, 4
test al, al
je 0x438d05
mov byte [0x6296b9], 1
jmp 0x438d05
push ecx
lea edx, [esp + 0x14]
mov ecx, 0x4a45e4
call fcn.00482400
add esp, 4
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.00433a40
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
push dword [esi*4 + 0x4a4978]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x438ced
inc esi
cmp esi, 0xb6
jb 0x438cd0
jmp 0x438d05
mov eax, dword [esi*4 + 0x4a4978]
mov dword [0x627ba8], eax
mov dword [0x628174], eax
mov byte [0x6296b9], 0
call fcn.004617e0
mov eax, dword [0x628218]
mov esi, dword [0x628214]
sub eax, esi
mov dword [esp + 0x10], 0x6297e0
cmp eax, 0xffffffff
jne 0x438d30
mov ecx, 0x6297e0
call fcn.00436b40
jmp 0x438d3b
inc eax
lea ecx, [esp + 0x10]
push eax
call fcn.00436af0
add eax, esi
mov byte [esp + 0x2b], 0
xor edx, edx
div edi
lea ebx, [edx + 1]
mov al, bl
mov byte [esp + 0x18], bl
xor al, 0x4d
mov dl, bl
mov byte [esp + 0x19], al
xor dl, 0x6e
mov al, bl
mov byte [esp + 0x1e], dl
xor al, 0x61
mov byte [esp + 0x23], dl
mov byte [esp + 0x1a], al
mov cl, bl
mov al, bl
xor cl, 0x6f
xor al, 0x70
mov byte [esp + 0x22], cl
mov byte [esp + 0x1b], al
mov dl, bl
mov byte [esp + 0x1c], al
xor dl, 0x72
mov al, bl
mov byte [esp + 0x26], cl
xor al, 0x69
mov byte [esp + 0x25], dl
mov byte [esp + 0x1d], al
mov al, bl
xor al, 0x67
mov byte [esp + 0x2a], dl
mov byte [esp + 0x1f], al
mov al, bl
xor al, 0x20
mov byte [esp + 0x20], al
mov al, bl
xor al, 0x43
mov byte [esp + 0x21], al
mov al, bl
xor al, 0x74
mov byte [esp + 0x24], al
mov al, bl
xor al, 0x6c
mov byte [esp + 0x27], al
mov byte [esp + 0x28], al
mov al, bl
xor al, 0x65
xor ecx, ecx
mov byte [esp + 0x29], al
nop
mov al, byte [esp + ecx + 0x19]
xor al, bl
mov byte [ecx + 0x62c004], al
inc ecx
cmp ecx, 0x12
jb 0x438dd0
push 0x6293f1
push 0x62c004
mov byte [0x62c016], 0
call fcn.00496ec0
mov esi, dword [0x629148]
mov edx, dword [esi + 0x46a0]
dec dword [esi + 0x4788]
dec word [esi + 0x5a04]
mov ecx, dword [esi + 0x4788]
mov eax, dword [esi + 0x4790]
shr edx, 2
mov eax, dword [eax + ecx*4 - 4]
mov dword [esi + 0x46a0], eax
test dl, 1
je 0x438e3f
test al, 4
jne 0x438e3f
mov eax, dword [esi + 0x5a00]
mov dword [esi + 0x3788], eax
mov ecx, 0x49fedb
call fcn.00484560
mov ecx, dword [0x629148]
pop edi
pop esi
pop ebx
mov eax, dword [ecx + 0x3e48]
mov byte [eax + 0xac], 1
mov eax, dword [ecx + 0x3e48]
movss xmm0, dword [eax + 0x134]
subss xmm0, dword [ecx + 0x37f4]
movss dword [eax + 0x134], xmm0
addss xmm0, dword [eax + 0x14]
addss xmm0, dword [eax + 0x138]
movss dword [eax + 0xf0], xmm0
add esp, 0x28
ret