Function at 0x10032f00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x10103040]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
mov ecx, 0x10175a17
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x14], eax
call fcn.100b6430
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10103e6c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10172a20]
cmp eax, dword [ecx + 4]
jg 0x100338db
push dword [ebp + 0x10]
movss xmm0, dword [ebp + 0xc]
xor edx, edx
push ecx
mov ecx, dword [0x1016a000]
movss dword [esp], xmm0
push esi
call dword [0x10172ba8]
mov eax, 0x1b4e81b5
mov byte [0x10103098], 1
imul esi
mov byte [0x10103fd8], 0
sar edx, 4
mov eax, edx
mov byte [0x10103ff0], 0
shr eax, 0x1f
add eax, edx
mov byte [0x10103ff8], 0
imul eax, eax, 0x96
sub esi, eax
mov eax, dword [0x101040ec]
imul edi, esi, 0x64
imul ecx, esi, 0x68
add edi, dword [eax + 0xf0]
add ecx, dword [eax + 0xf4]
mov eax, dword [0x1016ebd4]
mov dword [esp + 0x18], ecx
mov ebx, dword [eax]
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x1003387d
mov ecx, ebx
call fcn.100a4210
test al, al
je 0x1003387d
test edi, edi
je 0x1003387d
mov ecx, dword [0x10103ec8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1003387d
mov ecx, dword [0x10103ec8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003387d
mov byte [0x10103fda], 0
mov dword [0x10104084], 0
mov dword [0x10103ea8], edi
call fcn.10032ae0
mov eax, dword [0x10103ea8]
mov ecx, 0x101728e8
add eax, 0xc
movss dword [0x10103eac], xmm0
push eax
call fcn.100076d0
mov ecx, dword [0x10103ea8]
xorps xmm1, xmm1
movss xmm0, dword [ecx + 0x24]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003306c
movss xmm0, dword [ecx + 0x28]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003306c
xor al, al
jmp 0x1003306e
mov al, 1
mov ecx, dword [0x10103e6c]
mov byte [0x10104088], al
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10172bf4]
cmp eax, dword [ecx + 4]
jg 0x10033911
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x28]
push eax
push 0x40
push 4
push dword [0x10172b9c]
mov dword [esp + 0x38], 0
call esi
mov eax, dword [0x10172b9c]
lea ecx, [esp + 0x28]
push ecx
mov dword [eax], 0x3e
push dword [esp + 0x2c]
push 4
push eax
call esi
cmp dword [0x10103fd4], 0
jle 0x10033131
mov ecx, dword [esp + 0x14]
push 0x101728d0
mov byte [ecx], 1
mov ecx, dword [0x10103ea8]
lea ecx, [ecx + 0xc]
call fcn.100076d0
mov ecx, dword [0x10103ea8]
lea ecx, [ecx + 0xc]
call fcn.10032a40
movq xmm0, qword [0x101728e8]
sub esp, 0xc
mov eax, dword [0x101728f0]
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
call fcn.1001c9f0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100b3fd0
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x101707a4]
mov dword [0x10103fd4], 0
cmp byte [eax], 0
je 0x10033151
mov eax, dword [0x10103ea8]
or dword [eax + 0x30], 0x400000
call fcn.10027b10
xorps xmm1, xmm1
movss xmm0, dword [eax + 0x3bc]
comiss xmm0, xmm1
jbe 0x1003316f
mov eax, dword [0x10103ea8]
and dword [eax + 0x30], 0xfffffffe
mov eax, dword [0x1016ff84]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push dword [eax]
call esi
test ax, ax
je 0x100331a6
mov eax, dword [0x1016ff5c]
cmp byte [eax], 0
je 0x100331a6
mov eax, dword [0x1016fee4]
cmp byte [eax], 0
je 0x100331a6
mov eax, dword [0x10103ea8]
test byte [eax + 0x30], 4
jne 0x100331a6
mov cl, 1
jmp 0x100331a8
xor cl, cl
mov eax, dword [0x1016ffac]
mov byte [eax], cl
mov eax, dword [0x1016f0d4]
push dword [eax]
call esi
test ax, ax
je 0x100331d4
call fcn.1002fad0
test al, al
je 0x100331d4
mov eax, dword [0x1016faac]
cmp byte [eax], 0
je 0x100331d4
mov cl, 1
jmp 0x100331d6
xor cl, cl
mov eax, dword [0x1016f0ac]
mov byte [eax], cl
mov eax, dword [0x10170024]
push dword [eax]
call esi
test ax, ax
je 0x100331f9
mov eax, dword [0x1016fffc]
cmp byte [eax], 0
je 0x100331f9
mov cl, 1
jmp 0x100331fb
xor cl, cl
mov eax, dword [0x1017004c]
mov byte [eax], cl
mov eax, dword [0x1016fd54]
push dword [eax]
call esi
test ax, ax
je 0x1003321e
mov eax, dword [0x1016fd2c]
cmp byte [eax], 0
je 0x1003321e
mov cl, 1
jmp 0x10033220
xor cl, cl
mov eax, dword [0x1016fdcc]
mov byte [eax], cl
mov eax, dword [0x101706dc]
cmp byte [eax], 0
je 0x10033246
mov ecx, ebx
call fcn.10016ec0
test byte [eax], 1
jne 0x10033246
mov eax, dword [0x10103ea8]
and dword [eax + 0x30], 0xfffffffd
mov eax, dword [0x10170984]
cmp byte [eax], 0
je 0x1003328d
mov eax, dword [0x101709d4]
push dword [eax]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1003328d
movss xmm0, dword [edi + 0x24]
mulss xmm0, dword [0x100fab74]
or dword [edi + 0x30], 0x20000
movss dword [edi + 0x24], xmm0
movss xmm0, dword [edi + 0x28]
mulss xmm0, dword [0x100fab74]
movss dword [edi + 0x28], xmm0
mov ecx, dword [0x10103ec8]
mov eax, dword [ecx]
call dword [eax + 0x138]
mov esi, eax
test esi, esi
je 0x100332cf
mov ecx, dword [esi]
push 1
mov ecx, dword [ecx + 0x24]
mov dword [esp + 0x2c], ecx
mov ecx, esi
call dword [esp + 0x2c]
mov eax, dword [esi]
mov ecx, esi
fstp dword [0x10103ea4]
push 0
mov eax, dword [eax + 0x24]
mov dword [esp + 0x2c], eax
call dword [esp + 0x2c]
fstp dword [0x10103e98]
mov cl, 1
call fcn.1002fe50
call fcn.10034f20
mov esi, dword [0x101040b0]
test esi, esi
je 0x10033310
mov edi, dword [esi + 0x174]
test edi, edi
jle 0x10033310
mov eax, dword [esi + 0x4d30]
add eax, dword [esi + 0x4d2c]
mov ecx, dword [0x101040ac]
push eax
push dword [esi + 0x4d34]
mov edx, dword [ecx]
push 1
push edi
call dword [edx + 0xc]
call fcn.10034f20
push dword [0x10103ea8]
mov ecx, eax
push ebx
call fcn.1001c540
mov ecx, ebx
call fcn.10008080
cmp byte [0x10103fdb], 0
mov ecx, dword [eax]
mov dword [0x1010407c], ecx
mov dword [0x10103e9c], ecx
jne 0x10033353
mov eax, dword [0x1017004c]
cmp byte [eax], 0
je 0x10033353
lea eax, [ecx - 0xe]
mov dword [0x10103e9c], eax
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.100a4110
push eax
mov ecx, 0x101725ac
call fcn.100076d0
mov ecx, ebx
call fcn.1000dfa0
push eax
mov ecx, 0x101728f4
call fcn.100076d0
mov ecx, ebx
call fcn.10016ec0
mov ecx, ebx
mov eax, dword [eax]
mov dword [0x10104080], eax
call fcn.100081c0
mov ecx, eax
call fcn.1000e610
mov esi, dword [esp + 0x10]
mov ebx, eax
mov ecx, esi
call fcn.100173f0
mov ecx, esi
and dword [eax], 0xffffefff
call fcn.1000dfa0
push eax
mov ecx, esi
call fcn.100085e0
mov ecx, eax
call fcn.100076d0
test ebx, ebx
je 0x10033431
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x790]
call eax
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x714]
mov dword [esp + 0x28], eax
call dword [esp + 0x28]
mov ecx, ebx
fstp dword [0x10104000]
call fcn.100a3730
mov ecx, ebx
movss dword [0x10103ffc], xmm0
call fcn.1000f270
test al, al
je 0x1003340f
mov dword [0x10103ea0], 0
jmp 0x10033431
mov ecx, ebx
call fcn.100a3660
test eax, eax
je 0x10033431
mov ecx, ebx
call fcn.100a3660
movss xmm0, dword [eax + 0x10c]
movss dword [0x10103ea0], xmm0
mov eax, dword [0x1016fee4]
cmp byte [eax], 0
je 0x1003344a
mov eax, dword [0x1016ff34]
mov ecx, dword [eax]
mov dword [0x10104084], ecx
jmp 0x10033450
mov ecx, dword [0x10104084]
mov eax, dword [0x1017004c]
cmp byte [eax], 0
je 0x1003346a
cmp ecx, 1
jle 0x1003346a
mov ecx, 1
mov dword [0x10104084], ecx
mov eax, dword [0x1016fc64]
cmp byte [eax], 0
je 0x10033484
cmp ecx, 1
jge 0x10033484
mov ecx, 1
mov dword [0x10104084], ecx
mov eax, dword [0x1016ffac]
cmp byte [eax], 0
je 0x100334a4
mov ecx, 0xe
cmp dword [0x10169fa8], ecx
mov dword [0x10104084], ecx
setge al
jmp 0x100334b5
test ecx, ecx
jle 0x100334b3
cmp dword [0x10169fa8], ecx
setge al
jmp 0x100334b5
mov al, 1
cmp byte [0x10103fdc], 0
mov byte [0x10103098], al
je 0x100334ca
mov byte [0x10103098], 1
call fcn.1000e140
call fcn.10010890
mov eax, dword [0x1016ebd4]
mov byte [0x10103fdc], 0
mov dword [0x10103090], 0xe
mov ecx, dword [eax]
call fcn.100081c0
mov edi, dword [0x10103efc]
mov eax, dword [eax]
mov ecx, dword [edi]
push ecx
mov edx, esp
mov esi, dword [ecx + 0x10]
mov ecx, edi
mov dword [edx], eax
call esi
mov esi, eax
test esi, esi
je 0x10033604
mov ecx, esi
call fcn.1000ddd0
cmp word [eax], 0x2e
je 0x10033604
mov ecx, esi
call fcn.1000ddd0
cmp word [eax], 0x51
je 0x10033604
mov ecx, esi
call fcn.1000ddd0
cmp word [eax], 0x53
je 0x10033604
mov ecx, esi
call fcn.1000ddd0
cmp word [eax], 0x2c
je 0x10033604
mov ecx, esi
call fcn.1000ddd0
cmp word [eax], 0x2f
je 0x10033604
mov ecx, esi
call fcn.1000ddd0
cmp word [eax], 0x2b
je 0x10033604
mov eax, dword [0x1017004c]
cmp byte [eax], 0
je 0x100335dc
mov eax, dword [0x1016ffac]
cmp byte [eax], 0
jne 0x100335dc
mov eax, dword [0x10103ea8]
test byte [eax + 0x30], 1
je 0x100335a4
mov byte [0x10103fd9], 0
call fcn.1000e0e0
jmp 0x1003360b
mov ecx, esi
call fcn.1000ddd0
mov eax, dword [0x10103ec0]
movd xmm0, dword [0x10103094]
cvtdq2ps xmm0, xmm0
movd xmm1, dword [eax + 0x1c]
mulss xmm0, dword [eax + 0x20]
cvtdq2ps xmm1, xmm1
subss xmm1, xmm0
comiss xmm1, dword [0x100facd4]
seta byte [0x10103fd9]
jmp 0x1003360b
cmp byte [0x10103fdb], 0
jne 0x10033604
mov dword [0x10103fd4], 0xe
mov byte [0x10103fdb], 1
mov byte [0x10103098], 1
mov byte [0x10103fdc], 1
mov byte [0x10103fd9], 0
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x25c]
cmp eax, 4
je 0x10033624
cmp eax, 9
je 0x10033624
call fcn.10019a90
mov ecx, dword [0x10103ea8]
mov edi, dword [ecx + 0x30]
mov edx, edi
and edx, 1
je 0x10033645
mov eax, dword [0x1016ffac]
cmp byte [eax], 0
jne 0x10033645
mov byte [0x10103098], 1
test ebx, ebx
je 0x100336ba
test edx, edx
jne 0x10033660
test edi, 0x800
je 0x100336ba
mov ecx, ebx
call fcn.1000f270
test al, al
je 0x100336b4
mov eax, dword [0x10103ec0]
push ecx
mov ecx, esi
mov byte [0x10103fda], 0
movss xmm0, dword [eax + 0x20]
addss xmm0, dword [eax + 0x10]
cvttss2si eax, xmm0
mov dword [0x10103094], eax
call fcn.10008690
test al, al
je 0x100336b4
mov eax, dword [0x10103ec0]
movss xmm0, dword [0x10103eac]
mov ecx, dword [0x10103ea8]
divss xmm0, dword [eax + 0x20]
addss xmm0, dword [0x100fabb8]
cvttss2si eax, xmm0
add dword [ecx + 8], eax
jmp 0x100336ba
mov ecx, dword [0x10103ea8]
mov eax, dword [0x1016ffac]
cmp byte [eax], 0
je 0x100336da
mov eax, dword [ecx + 0x30]
test al, 4
jne 0x100336da
cmp dword [0x10169fa8], 7
jle 0x100336da
or eax, 4
mov dword [ecx + 0x30], eax
xor cl, cl
call fcn.1002fe50
call fcn.10034f20
mov edx, dword [0x10103ec0]
mov ecx, dword [eax + 0xc]
mov dword [ecx], 0xffffffff
mov ecx, dword [eax + 8]
mov dword [ecx], 0
mov ecx, dword [eax]
mov dword [edx + 0x10], ecx
mov ecx, dword [0x10103ea8]
mov eax, dword [eax + 4]
mov dword [edx + 0x14], eax
lea ecx, [ecx + 0xc]
call fcn.10032a40
mov eax, dword [0x10103ea8]
mov ecx, 0x101728dc
add eax, 0xc
push eax
call fcn.100076d0
mov al, byte [0x10103098]
test al, al
je 0x10033753
push 0x101728dc
mov ecx, 0x101728d0
mov dword [0x10169fa8], 0
call fcn.100076d0
mov al, byte [0x10103098]
jmp 0x10033759
inc dword [0x10169fa8]
mov ecx, dword [esp + 0x14]
mov byte [0x1010308c], al
mov byte [ecx], al
mov eax, dword [0x10170704]
cmp byte [eax], 0
je 0x100337a8
cmp byte [0x10104088], 0
jne 0x100337a8
movss xmm0, dword [0x101728f4]
movss xmm1, dword [0x101728f8]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm1
call fcn.1000edd0
comiss xmm0, dword [0x100facb8]
jbe 0x100337a8
mov byte [0x10103ff0], 1
movq xmm0, qword [0x101728e8]
sub esp, 0xc
mov eax, dword [0x101728f0]
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
call fcn.1001c9f0
mov esi, dword [0x10103ea8]
add esp, 0xc
mov ebx, dword [esp + 0x18]
mov edx, 0x18
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
lea ecx, [ebx + 0x49]
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov al, byte [esi + 0x34]
mov byte [ebx + 0x34], al
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
movzx eax, word [esi + 0x44]
mov word [ebx + 0x44], ax
movzx eax, word [esi + 0x46]
mov word [ebx + 0x46], ax
mov al, byte [esi + 0x48]
sub esi, ebx
mov byte [ebx + 0x48], al
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10033853
call fcn.1002e3b0
mov dword [ebx + 0x64], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100b3fd0
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x101040a0], 0
mov dword [0x10169fac], 0
mov dword [0x10103fd4], 0
mov dword [0x10169fa8], 0
mov byte [0x10103fdb], 1
mov byte [0x10103fd9], 0
mov dword [0x10103eac], 0
mov dword [0x10103094], 0
call fcn.100b3fd0
mov esp, ebp
pop ebp
ret 0x10
push 0x10172a20
call fcn.100b4050
add esp, 4
cmp dword [0x10172a20], 0xffffffff
jne 0x10032f4b
mov eax, dword [0x1016a00c]
push 0x10172a20
mov dword [0x10172ba8], eax
call fcn.100b4000
add esp, 4
jmp 0x10032f4b
push 0x10172bf4
call fcn.100b4050
add esp, 4
cmp dword [0x10172bf4], 0xffffffff
jne 0x10033093
mov edx, str.B8_________3B_F0_0F_4F_F0_89_5D_FC
mov ecx, str.engine.dll
call fcn.1002b810
inc eax
push 0x10172bf4
mov dword [0x10172b9c], eax
call fcn.100b4000
add esp, 4
jmp 0x10033093