Function at 0x100078a0
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041158
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100571b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x101637a0]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [eax]
test eax, eax
je 0x100078f1
movsx ecx, word [eax + 0x13]
call fcn.100063f0
cmp byte [eax + 0x78], 0
je 0x100078f1
call esi
mov dword [0x1016379c], eax
cmp byte [0x10163746], 0
jne 0x10007b56
cmp dword [0x10163844], 0
jne 0x10007998
mov eax, str.lXRTQ_
lea ecx, [ebp - 0x18]
sub eax, 0x3b9f0e53
push eax
call fcn.10012140
push eax
push 0
push 3
push 0
push 0
push 1
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0x12
call dword [sym.imp.GDI32.dll_CreateFontA]
mov dword [0x10163844], eax
mov edx, 0xce
xor ecx, ecx
nop
mov al, byte [ecx + 0x1004efc0]
xor al, dl
mov byte [ebp + ecx - 0x40], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x27
jb 0x10007950
mov byte [ebp - 0x19], 0
push 0
push 1
push 0x2900
push 0x2601
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push 0xfffff
push eax
call dword [0x10057b58]
add esp, 0x18
jmp 0x10007b56
push dword [0x10157cdc]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x100079e6
cmp byte [0x10157ce0], 0
jne 0x100079ed
mov byte [0x10157ce0], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0xe8c578]
jne 0x100079ed
cmp byte [0x101637b8], 0
sete al
mov byte [0x101637b8], al
test al, al
jne 0x100079fa
mov dword [0xe8cb3c], 0
jmp 0x100079ed
mov byte [0x10157ce0], 0
cmp byte [0x101637b8], 0
je 0x10007b56
push 1
mov edi, 0x635fd0
mov dword [0xe8cb3c], 1
call edi
mov dword [esp], 0x3f800000
sub esp, 0xc
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call dword [sym.imp.OPENGL32.dll_glColor4f]
push ecx
mov dword [esp], 0
mov eax, 0x637c60
push 1
push 1
sub esp, 0x20
mov dword [esp + 0x1c], 0x3e5c0000
mov dword [esp + 0x18], 0x3e850000
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x3f22c000
mov dword [esp + 0xc], 0x42dc0000
mov dword [esp + 8], 0x43850000
mov dword [esp + 4], 0x42340000
mov dword [esp], 0x41f00000
push 0xfffff
call eax
lea eax, [edi - 0x80]
mov byte [0x101637b9], 0
call eax
push 0
call edi
movss xmm0, dword [0x100516e0]
add esp, 0x34
mov edx, str.Xa_bng_monster
mov ecx, 0x101637ba
movaps xmm1, xmm0
call fcn.10007650
movss xmm1, dword [0x100516e4]
mov edx, str.Xo_hiu_ng_ng
movss xmm0, dword [0x100516e0]
mov ecx, 0x101637bc
call fcn.10007650
movss xmm1, dword [0x100516e8]
mov edx, str.Xo_hiu_ng_tnh
movss xmm0, dword [0x100516e0]
mov ecx, 0x101637bd
call fcn.10007650
movss xmm1, dword [0x100516ec]
mov edx, str.Xa_hiu_ng_k_nng
movss xmm0, dword [0x100516e0]
mov ecx, 0x101637bb
call fcn.10007650
movss xmm1, dword [0x100516e0]
mov edx, str.Kp_chut_phi
movss xmm0, dword [0x100516f0]
mov ecx, 0x101637be
call fcn.10007650
movss xmm1, dword [0x100516e4]
mov edx, str.Kp_phm_CTRL
movss xmm0, dword [0x100516f0]
mov ecx, 0x101637bf
call fcn.10007650
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10162fac]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10564590]
cmp eax, dword [ecx + 4]
jle 0x10007b9c
push 0x10564590
call fcn.10026b86
add esp, 4
cmp dword [0x10564590], 0xffffffff
jne 0x10007b9c
call esi
push 0x10564590
mov dword [0x10564594], eax
call fcn.10026b47
add esp, 4
call esi
sub eax, dword [0x10564594]
cmp eax, 0xea60
jb 0x10007c79
call esi
cmp byte [0x101639e5], 0
mov dword [0x10564594], eax
jne 0x10007bd6
push 0x10163b8c
push ecx
push 0
push 0x1000af60
call fcn.100208a0
mov dword [0x1016370c], eax
cmp byte [0x101639e6], 0
jne 0x10007bf6
push 0x10163b90
push ecx
push 0
push 0x1000abd0
call fcn.100208a0
mov dword [0x10163710], eax
cmp byte [0x101639e7], 0
jne 0x10007c16
push 0x10163b94
push ecx
push 0
push 0x1000aad0
call fcn.100208a0
mov dword [0x10163714], eax
cmp byte [0x10163bc0], 0
jne 0x10007c36
push 0x10163b9c
push ecx
push 0
push 0x1000aa90
call fcn.100208a0
mov dword [0x10163718], eax
cmp byte [0x10163bc1], 0
jne 0x10007c56
push 0x10163ba4
push ecx
push 0
push 0x100092e0
call fcn.100208a0
mov dword [0x10163720], eax
mov byte [0x101639e5], 0
mov byte [0x101639e6], 0
mov byte [0x101639e7], 0
mov byte [0x10163bc0], 0
mov byte [0x10163bc1], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100266c8
mov esp, ebp
pop ebp
ret