Function at 0x10099f20
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Get file size
Log keystrokes via application hook
Read .ini file
Read file on windows
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x1010b040]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.10004da0
push ecx
push 0x10512fb8
push str.main.premium
lea ecx, [esp + 0x1c]
call fcn.10004ed0
test al, al
je 0x1009ae15
push 0
push 0x20
push 3
push 0
push 1
push connect
push str.main.premium
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1009ae15
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x232b94
jne 0x1009ae0e
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x232b94
push 0x102e0424
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009ae0e
xor ecx, ecx
mov eax, ecx
shr eax, 8
xor al, 0x15
add al, byte [ecx + 0x102e0424]
xor al, cl
xor al, 0xda
mov byte [ecx + 0x102e0424], al
inc ecx
cmp ecx, 0x232b94
jb 0x10099fc4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10016120
call fcn.10016a60
call fcn.10097e50
call fcn.10018220
push 0x10073520
push 0x5b96e8
push 0xe8
call fcn.100d0480
add esp, 0xc
mov eax, 0x11329b29
nop dword [eax + eax]
mov byte [eax - 1], 0
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0xf], 0
add eax, 0x14
cmp eax, 0x1132e949
jl 0x1009a020
call fcn.10073030
call fcn.10080800
push 0x100c7db0
push 0x5b545b
push 0xe9
call fcn.100d0480
push fcn.100c7de0
push 0x59a8b0
push 0xe9
call fcn.100d0480
push 0x100c8340
push 0x59afb0
push 0xe9
call fcn.100d0480
push 0x100c8680
push 0x59b3c0
push 0xe9
call fcn.100d0480
add esp, 0x30
cmp dword [0x102e07f4], 1
jne 0x1009a16d
push 0x100c88c0
push 0x5b6427
push 0xe8
call fcn.100d0480
push 0x100c88c0
push 0x5b646f
push 0xe8
call fcn.100d0480
push 0x100c88c0
push 0x5b6e65
push 0xe8
call fcn.100d0480
push 0x100c88c0
push 0x5b6ea2
push 0xe8
call fcn.100d0480
push 0x100c88c0
push 0x5b703a
push 0xe8
call fcn.100d0480
push 0x100c88c0
push 0x5b7214
push 0xe8
call fcn.100d0480
add esp, 0x48
push 0x100c88c0
push 0x5b727c
push 0xe8
call fcn.100d0480
push 0x100c88c0
push 0x5b72e4
push 0xe8
call fcn.100d0480
push 0x100c88c0
push 0x5b73b1
push 0xe8
call fcn.100d0480
add esp, 0x24
push 0x100827d0
push 0x58e650
push 0xe9
call fcn.100d0480
push 0x10082820
push 0x8386b5
push 0xe9
call fcn.100d0480
push 0x10082880
push 0x7dc068
push 0xe9
call fcn.100d0480
push 0x100828f0
push 0x5c4025
push 0xe9
call fcn.100d0480
push 0x10082920
push 0x5f7c3b
push 0xe9
call fcn.100d0480
push 0x10082950
push 0x64b701
push 0xe9
call fcn.100d0480
add esp, 0x48
push 0x10082980
push 0x8383a0
push 0xe9
call fcn.100d0480
push 0x10082a00
push 0x5f3f7e
push 0xe9
call fcn.100d0480
push 0x10082a40
push 0x5f4a60
push 0xe9
call fcn.100d0480
add esp, 0x24
call fcn.100be1e0
cmp dword [0x102e0640], 0
je 0x1009a2df
push 0x100c7680
push 0x40b903
push 0xe9
call fcn.100d0480
push 0x100c76c0
push 0x4da416
push 0xe9
call fcn.100d0480
push 0x100c76e0
push 0x63a192
push 0xe9
call fcn.100d0480
push 0x100c7720
push 0x7a89eb
push 0xe9
call fcn.100d0480
push fcn.100c75e0
push 0x40bc24
push 0xe8
call fcn.100d0480
push fcn.100c75e0
push 0x4d762c
push 0xe8
call fcn.100d0480
add esp, 0x48
push fcn.100c75e0
push 0x4ef622
push 0xe8
call fcn.100d0480
push fcn.100c75e0
push 0x63cd3a
push 0xe8
call fcn.100d0480
add esp, 0x18
push 0x100c7750
push 0x4d13c2
push 0xe9
call fcn.100d0480
push 0x100c78d0
push 0x4d2782
push 0xe9
call fcn.100d0480
push 0x100c79a0
push 0x830c3a
push 0xe9
call fcn.100d0480
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x30]
add esp, 0x24
push eax
push 0x40
push 4
push 0x7e0ed0
call esi
lea eax, [esp + 0xc]
mov dword [0x7e0ed0], 0x73
push eax
push dword [esp + 0x10]
push 4
push 0x7e0ed0
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x7e0ed7
call esi
lea eax, [esp + 0xc]
mov dword [0x7e0ed7], 0x20
push eax
push dword [esp + 0x10]
push 4
push 0x7e0ed7
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x7e0ede
call esi
lea eax, [esp + 0xc]
mov dword [0x7e0ede], 0x2a
push eax
push dword [esp + 0x10]
push 4
push 0x7e0ede
call esi
cmp dword [0x102e0870], 1
jne 0x1009a447
push 0x10013eb0
push 0x82d1c3
push 0xe8
call fcn.100d0480
push 0x10013eb0
push 0x82d2e6
push 0xe8
call fcn.100d0480
push 0x10013eb0
push 0x82d325
push 0xe8
call fcn.100d0480
push 0x10013eb0
push 0x82d361
push 0xe8
call fcn.100d0480
push 0x10013eb0
push 0x82d39d
push 0xe8
call fcn.100d0480
push 0x10013ed0
push 0x82d4a2
push 0xe8
call fcn.100d0480
add esp, 0x48
push 0x10013ed0
push 0x82d4d1
push 0xe8
call fcn.100d0480
add esp, 0xc
cmp dword [0x102e0720], 5
jne 0x1009a59e
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x813bf4
call esi
lea eax, [esp + 0xc]
mov byte [0x813bf4], 1
push eax
push dword [esp + 0x10]
push 1
push 0x813bf4
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x4ebd07
call esi
lea eax, [esp + 0xc]
mov byte [0x4ebd07], 1
push eax
push dword [esp + 0x10]
push 1
push 0x4ebd07
call esi
push 0x100122c0
push 0x4d5ec3
push 0xe8
call fcn.100d0480
push 0x10011f10
push 0x4d9d0e
push 0xe8
call fcn.100d0480
add esp, 0x18
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x59788f
call esi
lea eax, [esp + 0xc]
mov byte [0x59788f], 0x14
push eax
push dword [esp + 0x10]
push 1
push 0x59788f
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x597897
call esi
lea eax, [esp + 0xc]
mov byte [0x597897], 0xa
push eax
push dword [esp + 0x10]
push 1
push 0x597897
call esi
push 0x10012210
push 0x588277
push 0xe9
call fcn.100d0480
push 0x10012230
push 0x588460
push 0xe9
call fcn.100d0480
push 0x10012250
push 0x588560
push 0xe9
call fcn.100d0480
push 0x10012270
push 0x4f0356
push 0xe8
call fcn.100d0480
push 0x10012130
push 0x51cb60
push 0xe9
call fcn.100d0480
push 0x10012010
push 0x51e440
push 0xe9
call fcn.100d0480
add esp, 0x48
call fcn.1006fda0
cmp dword [0x1054aca8], 0
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
jne 0x1009a5cd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [0x1054aca4]
push 0x1001c070
push 7
call edi
mov dword [0x1054aca8], eax
cmp dword [0x1054acac], 0
jne 0x1009a5f1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [0x1054aca4]
push 0x1001d7a0
push 2
call edi
mov dword [0x1054acac], eax
call fcn.10080ad0
push 0x100cfc40
push 0x588511
push 0xe8
mov dword [0x11478478], 0
mov byte [0x11478464], 0
mov dword [0x1147846c], 0xffffffff
mov dword [0x11478474], 0xffffffff
mov dword [0x11478468], 0xffffffff
call fcn.100d0480
add esp, 0xc
mov ecx, 0x102bb6b0
call fcn.100754f0
call fcn.100b2720
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x511584
call esi
lea eax, [esp + 0xc]
mov byte [0x511584], 0x6f
push eax
push dword [esp + 0x10]
push 1
push 0x511584
call esi
push 0
mov ecx, 0x114f1450
call fcn.100a8f50
call fcn.100abcb0
call fcn.1003a6a0
xor eax, eax
mov ecx, 0x36b0
mov edi, 0x1010cff4
rep stosd dword es:[edi], eax
cmp dword [0x102e07bc], eax
je 0x1009a6e0
push 0x10014730
push 0x5bafab
push 0xe8
call fcn.100d0480
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x842862
call esi
lea eax, [esp + 0xc]
mov byte [0x842862], 0
push eax
push dword [esp + 0x10]
push 1
push 0x842862
call esi
call fcn.100b4290
call fcn.10002180
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10002660
push 0x10029d40
push 0x114d8a94
call fcn.10001c30
push 0x10029f60
push 0x114e895c
call fcn.10001c30
call fcn.100021f0
call fcn.10044280
cmp dword [0x102e070c], 0
je 0x1009a73e
push 0x1002a130
push 0x50d905
push 0xe8
call fcn.100d0480
add esp, 0xc
call fcn.1004aa20
cmp dword [0x102e0714], 0
je 0x1009a8b0
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x94a
push 0x749c90
call esi
push 0x94a
push 0x90
push 0x749c90
call fcn.100d44a0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 0x94a
push 0x749c90
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 6
push 0x56595e
call esi
mov eax, 0x56595e
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 6
push 0x56595e
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 7
push 0x566178
call esi
mov eax, 0x566178
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 7
push 0x566178
call esi
push 0x10021380
push 0x749c90
push 0xe9
call fcn.100d0480
push 0x10021300
push 0x56595e
push 0xe9
call fcn.100d0480
push 0x100212b0
push 0x566178
push 0xe9
call fcn.100d0480
push 0x10021a10
push 0x5914ab
push 0xe8
call fcn.100d0480
push 0x10021a10
push 0x5914c7
push 0xe8
call fcn.100d0480
push 0x10021a10
push 0x5a0652
push 0xe8
call fcn.100d0480
add esp, 0x48
push 0x10021a10
push 0x5a0775
push 0xe8
call fcn.100d0480
push 0x10021a10
push 0x5b6cf4
push 0xe8
call fcn.100d0480
push 0x10021a10
push 0x7e05a8
push 0xe8
call fcn.100d0480
add esp, 0x24
call fcn.10023880
cmp dword [0x102e0728], 0
je 0x1009a8d5
push 0x10033c70
push 0x7dd0d9
push 0xe8
call fcn.100d0480
add esp, 0xc
cmp dword [0x102e0928], 0
je 0x1009a91d
push 0x1008b5b0
push 0x8353d0
push 0xe9
call fcn.100d0480
push 0x1008b810
push 0x7dd4a0
push 0xe9
call fcn.100d0480
push 0x1008b940
push 0x7d9680
push 0xe9
call fcn.100d0480
add esp, 0x24
push fcn.1008caf0
push 0x5d0b94
push 0xe8
call fcn.100d0480
push 0x100933b0
push 0x7dd5e0
push 0xe9
call fcn.100d0480
push 0x100934a0
push 0x7dd0c9
push 0xe8
call fcn.100d0480
push 0x100932d0
push 0x508501
push 0xe9
call fcn.100d0480
add esp, 0x30
cmp dword [0x102e0760], 0
je 0x1009a990
push 0x1004d880
push 0x7dcfd0
push 0xe9
call fcn.100d0480
add esp, 0xc
cmp dword [0x102e072c], 0
je 0x1009aa00
push 0x10092100
push 0x4e8990
push 0xe9
call fcn.100d0480
push 0x10092210
push 0x4e8b80
push 0xe9
call fcn.100d0480
push 0x10092490
push 0x4e9210
push 0xe9
call fcn.100d0480
push 0x10092520
push 0x4ec410
push 0xe9
call fcn.100d0480
push 0x100928b0
push 0x4eb910
push 0xe9
call fcn.100d0480
add esp, 0x3c
call fcn.10054920
call fcn.100c03a0
call fcn.1003a140
call fcn.1005ecc0
push fcn.100330c0
push 0x58b77e
push 0xe8
call fcn.100d0480
push fcn.100330c0
push 0x5c7833
push 0xe8
call fcn.100d0480
push fcn.100330c0
push 0x5c7d71
push 0xe8
call fcn.100d0480
push fcn.100330c0
push 0x5c7f1b
push 0xe8
call fcn.100d0480
push fcn.100330c0
push 0x5c80be
push 0xe8
call fcn.100d0480
push fcn.100330c0
push 0x7e22ba
push 0xe8
call fcn.100d0480
add esp, 0x48
cmp dword [0x102e06c4], 0
je 0x1009ab65
mov eax, 0x102dd128
nop dword [eax]
nop word [eax + eax]
mov dword [eax - 4], 0xffffffff
mov dword [eax], 0xffffffff
add eax, 8
cmp eax, 0x102dd228
jl 0x1009aab0
mov eax, 0x102cd724
nop dword [eax]
mov dword [eax], 0xffffffff
add eax, 0x20
cmp eax, 0x102dd124
jl 0x1009aad0
push fcn.10092e40
push 0x7e44d3
push 0xff
mov dword [0x102dd224], 0
mov dword [0x102dd22c], 0
mov dword [0x102dd228], 0
call fcn.100d0480
push fcn.10092f70
push 0x7e452f
push 0xff
call fcn.100d0480
push 0x100930c0
push 0x7e4497
push 0xe8
call fcn.100d0480
push 0x100930c0
push 0x7e44ec
push 0xe8
call fcn.100d0480
push 0x10093120
push 0x841b5a
push 0xe8
call fcn.100d0480
add esp, 0x3c
push 0x100b1e90
push 0x82a980
push 0xe9
call fcn.100d0480
push 0x1003a640
push 0x82b772
push 0xe8
call fcn.100d0480
add esp, 0x18
cmp dword [0x11472374], 2
jne 0x1009ac13
push 0x100b1db0
push 0x4d6c36
push 0xe8
call fcn.100d0480
push 0x100b1db0
push 0x4d75fa
push 0xe8
call fcn.100d0480
push 0x100b1db0
push 0x63e195
push 0xe8
call fcn.100d0480
push 0x100b1db0
push 0x63ecca
push 0xe8
call fcn.100d0480
push 0x100b1db0
push 0x640c33
push 0xe8
call fcn.100d0480
mov eax, dword [0x102df968]
add esp, 0x3c
mov ecx, dword [0x11478280]
lea eax, [eax + ecx*2]
mov dword [0x102df968], eax
call fcn.10013f40
cmp dword [0x102e0820], 0
je 0x1009ac83
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push 0x777c90
call esi
mov eax, 0x777c90
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 5
push 0x777c90
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push 0x777c9a
call esi
mov eax, 0x777c9a
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 5
push 0x777c9a
call esi
push 0x100b60d0
push 0x84bdb0
push 0xe9
call fcn.100d0480
add esp, 0xc
cmp dword [0x102e0838], 0
je 0x1009acce
push 0x100b6960
push 0x84bc0f
push 0xe8
call fcn.100d0480
push 0x100b6980
push 0x84bd1d
push 0xe8
call fcn.100d0480
add esp, 0x18
cmp dword [0x102e0848], 0
jne 0x1009ace0
cmp dword [0x102e0844], 0
je 0x1009ad5a
push 0x10098370
push 0x40b306
push 0xe8
call fcn.100d0480
push 0x10098440
push 0x40b5a9
push 0xe8
call fcn.100d0480
add esp, 0x18
cmp dword [0x102e0844], 1
jne 0x1009ad2f
push 0x10098990
push 0x40b400
push 0xe8
call fcn.100d0480
push 0x10098990
jmp 0x1009ad48
push 0x10098af0
push 0x40b400
push 0xe8
call fcn.100d0480
push 0x10098af0
push 0x40b44f
push 0xe8
call fcn.100d0480
add esp, 0x18
call fcn.100b6de0
push 0x100687e0
push 0x4d75b9
push 0xe8
call fcn.100d0480
push 0x100687e0
push 0x4d9b77
push 0xe8
call fcn.100d0480
push 0x100687e0
push 0x4d9c26
push 0xe8
call fcn.100d0480
push 0x10068890
push 0x4d958d
push 0xe8
call fcn.100d0480
add esp, 0x30
push str.._Settings.ini
push 0
push str.DiscordShowPresence
push str.Discord
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x106d74d0], eax
test eax, eax
je 0x1009adfa
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10068000
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10067fc0
push 0
push 0
call esi
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
call fcn.100d22e0
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push str.Error
push str.Main.premium_not_found_or_invalid_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]