Function at 0x10004e60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d700
mov eax, dword fs:[0]
push eax
sub esp, 0x2e8
mov eax, dword [0x100a9114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x1008e070]
cmp dword [0x100aa1b8], eax
je 0x10004eb3
call fcn.10004940
call fcn.10008760
movzx eax, byte [0x1008e070]
mov dword [0x100aa1b8], eax
mov eax, dword [0x100aa24c]
lea ecx, [ebp - 0x2e8]
add eax, 0x17ea030
push eax
call fcn.100030c0
mov eax, dword [ebp - 0x2e8]
push 1
mov al, byte [eax]
mov byte [ebp - 0x2e8], al
mov eax, dword [0x100aa24c]
add eax, 0x93b13c
cmp byte [0x1008e070], 0
je 0x100057ea
push dword [ebp - 0x2e8]
push ecx
mov ecx, esp
push eax
call fcn.100030c0
call fcn.10001750
mov eax, dword [0x100aa2ac]
add esp, 0xc
mov ebx, dword [eax + 0x60]
test ebx, ebx
jne 0x10004f59
cmp byte [0x100aa1b1], bl
je 0x100057fd
push 1
push 2
lea eax, [ebp - 0x14]
mov word [ebp - 0x14], 0x1a8
push eax
mov eax, dword [0x100aa24c]
push ecx
add eax, 0xa3a2e2
mov ecx, esp
push eax
call fcn.100030c0
call fcn.10007ac0
add esp, 0x10
mov byte [0x100aa1b1], bl
mov dword [0x100aa1b4], ebx
jmp 0x100057fd
mov eax, dword [0x100aa24c]
lea ecx, [ebx + 0xb98]
add eax, 0x681330
call eax
mov edx, dword [0x100aa24c]
mov ecx, eax
lea edx, [edx + 0x67c8a0]
call edx
cmp dword [ebx + 0x618], 0x61
mov edi, eax
mov dword [ebp - 0x2ec], edi
jne 0x10004fa2
mov eax, dword [0x100aa24c]
mov ecx, ebx
push 0
push 0
push 0
push 0x4f
add eax, 0x68caf0
call eax
cmp dword [ebx + 0x618], 0x53
jne 0x10004ff2
cmp dword [ebx + 0x61c], 1
jne 0x10004fca
mov eax, dword [0x100aa24c]
mov ecx, ebx
push 1
push 1
push 1
push 1
add eax, 0x11cd50
call eax
cmp dword [ebx + 0x618], 0x53
jne 0x10004ff2
cmp dword [ebx + 0x61c], 3
jne 0x10004ff2
mov eax, dword [0x100aa24c]
mov ecx, ebx
push 0
push 1
push 0
push 0
add eax, 0x11df70
call eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x34
call esi
bt ax, 0xf
jae 0x1000501d
mov eax, dword [0x100aa24c]
mov ecx, ebx
push 1
add eax, 0x12c250
call eax
mov dword [0x100aa1bc], 0
push 0x35
call esi
mov ecx, 0x8000
test cx, ax
je 0x10005045
mov eax, dword [0x100aa24c]
mov ecx, ebx
push dword [0x100aa1bc]
add eax, 0x11d700
call eax
inc dword [0x100aa1bc]
mov eax, dword [0x100aa2a0]
mov esi, dword [eax + 0x4c]
mov dword [ebp - 0x2e8], esi
cmp esi, dword [eax + 0x50]
je 0x100054e2
nop dword [eax]
mov esi, dword [esi]
test esi, esi
je 0x100054bf
mov eax, dword [0x100aa24c]
mov ecx, esi
add eax, 0x67c8a0
call eax
mov edi, eax
test edi, edi
je 0x100054bf
mov ecx, dword [esi + 0x24]
cmp ecx, 0x20144
je 0x10005115
cmp ecx, 0x20142
je 0x10005115
cmp ecx, 0x20140
je 0x10005115
cmp ecx, 0x20150
je 0x10005115
cmp ecx, 0x20152
je 0x10005115
cmp ecx, 0x20160
je 0x10005115
cmp ecx, 0x20170
je 0x10005115
cmp ecx, 0x20180
je 0x10005115
cmp ecx, 0x20182
je 0x10005115
cmp ecx, 0x20220
je 0x10005115
cmp ecx, 0x20310
je 0x10005115
cmp ecx, 0x2070a
je 0x10005115
cmp ecx, 0x20700
je 0x10005115
cmp ecx, 0x20020
je 0x10005115
cmp ecx, 0x20110
je 0x10005115
cmp ecx, 0xf00d1
je 0x10005115
cmp ecx, 0xf00d3
jne 0x100054bf
mov eax, dword [0x100aa224]
test dword [eax], 0x1000
jne 0x100054bf
cmp ecx, 0x20020
je 0x1000513d
cmp ecx, 0x20310
je 0x1000513d
mov eax, dword [0x100aa1c0]
jmp 0x10005144
mov eax, edi
mov dword [0x100aa1c0], eax
mov ecx, dword [esi + 0x24]
cmp ecx, 0xf00d1
je 0x1000515b
cmp ecx, 0xf00d3
jne 0x100052a1
test eax, eax
je 0x100052a1
cmp dword [edi + 0x618], 9
jne 0x100052a1
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 0x3c]
call eax
mov eax, dword [0x100aa1c0]
movss xmm1, dword [eax + 0x40]
mov eax, dword [edi + 0x61c]
movss dword [ebp - 0x14], xmm1
test eax, eax
je 0x1000519b
cmp eax, 1
jne 0x100051fe
jmp 0x100051c3
mov dword [edi + 0x61c], 1
mov dword [edi + 0x920], 0x42700000
mov dword [edi + 0x940], 0
mov dword [edi + 0x928], 0
movss xmm0, dword [edi + 0x920]
xorps xmm2, xmm2
subss xmm0, dword [edi + 0x910]
comiss xmm2, xmm0
movss dword [edi + 0x920], xmm0
jbe 0x100051fe
mov eax, dword [0x100aa24c]
mov ecx, edi
push 0
push 0
push 0
push 5
add eax, 0x68caf0
call eax
movss xmm1, dword [ebp - 0x14]
addss xmm1, dword [edi + 0x14b0]
lea esi, [edi + 0x10]
mov dword [ebp - 0x24], 0
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0
push eax
push eax
movss dword [ebp - 0x14], xmm1
mov dword [ebp - 0x1c], 0x3f800000
call sub.d3dx9_43.dll_D3DXVec3TransformNormal
push 0
sub esp, 8
lea eax, [ebp - 0x24]
mov ecx, edi
mov dword [esp + 4], 0x3e0efa35
mov dword [esp], 0x3dcccccd
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x100aa24c]
add eax, 0x11e4f0
call eax
movss xmm0, dword [edi + 0x910]
lea eax, [ebp - 0x74]
mulss xmm0, dword [edi + 0x928]
push ecx
movss dword [esp], xmm0
push eax
call sub.d3dx9_43.dll_D3DXMatrixRotationZ
push esi
lea eax, [ebp - 0x74]
push eax
push esi
call sub.d3dx9_43.dll_D3DXMatrixMultiply
movss xmm0, dword [edi + 0x928]
cvtps2pd xmm0, xmm0
addsd xmm0, qword [0x1006ffc8]
cvtpd2ps xmm0, xmm0
movss dword [edi + 0x928], xmm0
push dword [0x100aa220]
lea ecx, [ebp - 0x2e4]
call fcn.100025a0
mov eax, dword [0x100aa24c]
add eax, 0x532720
call eax
movss xmm0, dword [ebx + 0x44]
subss xmm0, dword [edi + 0x44]
movsd xmm1, qword [0x1006ffd0]
cvtps2pd xmm0, xmm0
call fcn.100513a0
movsd xmm1, qword [0x1006ffd0]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x2f0], xmm0
movss xmm0, dword [ebx + 0x40]
subss xmm0, dword [edi + 0x40]
cvtps2pd xmm0, xmm0
call fcn.100513a0
movss xmm1, dword [ebp - 0x2f0]
cvtsd2ss xmm0, xmm0
addss xmm1, xmm0
movss xmm0, dword [ebx + 0x48]
subss xmm0, dword [edi + 0x48]
movss dword [ebp - 0x2f0], xmm1
movsd xmm1, qword [0x1006ffd0]
cvtps2pd xmm0, xmm0
call fcn.100513a0
movss xmm1, dword [ebp - 0x2f0]
cvtsd2ss xmm0, xmm0
addss xmm1, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x10005352
sqrtsd xmm0, xmm0
jmp 0x10005357
call fcn.10051ef0
cmp dword [ebx + 0x618], 0x7a
mov ecx, 1
movzx eax, byte [0x1008e001]
cmovne eax, ecx
mov byte [0x1008e001], al
mov eax, dword [ebx + 0x618]
cvtsd2ss xmm0, xmm0
cmp eax, 0x7a
jne 0x100053c2
cmp dword [edi + 0x618], 0x12d
je 0x100054b8
movss xmm1, dword [0x1006ffd8]
comiss xmm1, xmm0
jb 0x100054b8
cmp dword [edi + 0x870], 0
jle 0x100054b8
mov eax, dword [ebx + 0xe24]
test dword [ebx + 0xcfc], eax
jne 0x1000540a
jmp 0x100054b8
movss xmm1, dword [0x1006ffdc]
cmp eax, 0xff
jne 0x100053e6
comiss xmm1, xmm0
jb 0x100054bf
cmp dword [edi + 0x618], 0xb0007
je 0x1000540a
cmp eax, 0xfd
jne 0x100054bf
comiss xmm1, xmm0
jb 0x100054bf
cmp dword [edi + 0x618], 0xb0005
jne 0x100054bf
cmp dword [edi + 0x4b0], 0x20020
je 0x10005420
mov dword [edi + 0x4b0], 0x20020
mov eax, dword [0x100aa200]
lea ecx, [ebp - 0x2f4]
or dword [eax + 4], 0x10000000
mov dword [0x100aa1c0], edi
mov eax, dword [ebx + 0x4f0]
mov eax, dword [eax + 0x2c]
mov dword [edi + 0x91c], eax
mov eax, dword [edi + 0x4f0]
mov eax, dword [eax + 0x2c]
mov dword [ebx + 0x91c], eax
mov eax, dword [0x100aa24c]
add eax, 0xa3a2e2
push eax
call fcn.100030c0
mov esi, dword [ebp - 0x2f4]
lea eax, [ebp - 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x34], esi
call edi
test eax, eax
mov eax, 0x90909090
setne byte [ebp - 0x28]
mov word [esi], ax
cmp byte [ebp - 0x28], 0
je 0x100054ae
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x34]
call edi
mov dword [0x100aa1d8], 0
mov byte [0x1008e001], 0
mov esi, dword [ebp - 0x2e8]
mov eax, dword [0x100aa2a0]
mov esi, dword [esi + 8]
mov dword [ebp - 0x2e8], esi
cmp esi, dword [eax + 0x50]
jne 0x10005060
mov edi, dword [ebp - 0x2ec]
cmp byte [0x100aa1b1], 0
jne 0x1000558f
push 1
push 2
lea eax, [ebp - 0x14]
mov word [ebp - 0x14], 0x1a8
push eax
mov eax, dword [0x100aa24c]
push ecx
add eax, 0xa3a2e2
mov ecx, esp
push eax
call fcn.100030c0
call fcn.10007ac0
mov eax, dword [0x100aa2b0]
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [ecx]
mov eax, dword [eax + 0x98]
call eax
mov ecx, dword [ebx + 0x1e40]
imul ecx, eax
mov eax, dword [0x100aa24c]
push 1
push 5
add eax, 0x7e6f97
add ecx, dword [ebx + 0x874]
push ecx
mov dword [0x100aa1c4], ecx
mov ecx, esp
push eax
call fcn.100030c0
call fcn.10001750
mov eax, dword [0x100aa24c]
add esp, 0xc
add eax, 0x7e7041
push 1
push 5
push ecx
mov ecx, esp
push eax
call fcn.100030c0
call fcn.10001750
mov eax, dword [0x100aa200]
add esp, 0xc
mov byte [0x100aa1b1], 1
and dword [eax + 4], 0xefffffff
mov eax, dword [0x100aa224]
mov ecx, dword [ebx + 0x618]
test dword [eax], 0x2000000
jne 0x100055a7
cmp ecx, 0x45
jne 0x1000560a
cmp dword [ebx + 0xb9c], 0
jle 0x1000560a
cmp ecx, 0x12d
je 0x1000560a
cmp ecx, 0x12df
je 0x1000560a
cmp ecx, 0x12dff
je 0x1000560a
cmp ecx, 0x12dfff
je 0x1000560a
cmp ecx, 0x1111
je 0x1000560a
cmp ecx, 0x12db
je 0x1000560a
cmp ecx, 0x12da
je 0x1000560a
cmp ecx, 0x2222
je 0x1000560a
cmp ecx, 0x9020
je 0x1000560a
cmp ecx, 0x9000
jae 0x1000560a
mov dword [ebx + 0xb9c], 0
cmp dword [ebx + 0x2644], 0
jle 0x1000561d
mov dword [ebx + 0x2644], 0
cmp dword [ebx + 0x2648], 0
jle 0x10005630
mov dword [ebx + 0x2648], 0
cmp dword [ebx + 0x870], 0x131
mov ecx, ebx
mov dword [ebx + 0x2844], 0
mov dword [ebx + 0x3860], 0
mov eax, dword [0x100aa24c]
push str.damage
jge 0x10005663
add eax, 0x6c9420
jmp 0x10005668
add eax, 0x6c94e0
call eax
cmp dword [ebx + 0x618], 0x75
jne 0x10005699
mov eax, dword [0x100aa24c]
mov ecx, edi
push str.ex_Head
add eax, 0x6c9420
call eax
mov eax, dword [0x100aa24c]
mov ecx, ebx
push str.ex_Full
add eax, 0x6c9420
call eax
mov eax, dword [ebx + 0x618]
cmp eax, 0x70009
je 0x100056d8
cmp eax, 0x9999
je 0x100056d8
cmp eax, 0x75
je 0x100056d8
mov eax, dword [0x100aa24c]
mov ecx, ebx
push str.ex_Full
add eax, 0x6c94e0
call eax
mov eax, dword [0x100aa24c]
mov ecx, edi
push str.ex_Head
add eax, 0x6c94e0
call eax
mov eax, dword [ebx + 0x618]
cmp eax, 0x4f
je 0x1000575e
cmp eax, 0x51
je 0x1000575e
cmp eax, 0x74
je 0x1000575e
cmp eax, 0x61
je 0x1000575e
cmp eax, 0x6f
je 0x1000573b
cmp eax, 0xb7
je 0x1000573b
cmp eax, 0xb8
je 0x1000573b
cmp eax, 0xb9
je 0x1000573b
cmp eax, 0xba
je 0x1000573b
cmp eax, 0xbb
je 0x1000573b
cmp eax, 0xbc
je 0x1000573b
cmp eax, 0x70009
je 0x1000573b
mov eax, dword [0x100aa24c]
mov ecx, ebx
push str.ex_Lhand
add eax, 0x6c94e0
call eax
mov eax, dword [ebx + 0x618]
cmp eax, 0x69
je 0x10005784
cmp eax, 0x77
je 0x10005784
cmp eax, 0x70009
je 0x10005784
mov eax, dword [0x100aa24c]
add eax, 0x6c94e0
jmp 0x1000577b
mov eax, dword [0x100aa24c]
mov ecx, ebx
push str.ex_Lhand
add eax, 0x6c9420
call eax
mov eax, dword [0x100aa24c]
add eax, 0x6c9420
push str.ex_Rhand
mov ecx, ebx
call eax
cmp dword [ebx + 0x618], 0x69
jne 0x100057a0
mov eax, dword [0x100aa24c]
mov ecx, ebx
push str.ex_Rhand
add eax, 0x6c9420
call eax
mov eax, dword [ebx + 0x618]
cmp eax, 0x6f
je 0x100057d5
cmp eax, 0xb7
je 0x100057d5
cmp eax, 0xb8
je 0x100057d5
cmp eax, 0xb9
je 0x100057d5
cmp eax, 0xba
je 0x100057d5
cmp eax, 0xbb
je 0x100057d5
cmp eax, 0xbc
jne 0x100057fd
mov eax, dword [0x100aa24c]
mov ecx, ebx
push str.ex_Lhand
add eax, 0x6c9420
call eax
jmp 0x100057fd
push 8
push ecx
mov ecx, esp
push eax
call fcn.100030c0
call fcn.10001750
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10040e3d
mov esp, ebp
pop ebp
ret