Function at 0x100906d0
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dc19e
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x1010502c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x48], esi
mov byte [0x1010638d], 0
test edi, edi
je 0x10090b93
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10106354]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10106390]
cmp eax, dword [ecx + 4]
jle 0x1009076e
push 0x10106390
call fcn.100d8ed3
add esp, 4
cmp dword [0x10106390], 0xffffffff
jne 0x1009076e
push str.client.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0x151a0
push 0x10106390
mov dword [0x10106394], eax
call fcn.100d8e89
add esp, 4
mov eax, dword [0x10106394]
mov ecx, edi
call eax
push str.weapon_jockey_claw
lea ecx, [ebp - 0x60]
lea edi, [eax + 6]
call fcn.10007b20
mov dword [ebp - 4], 0
mov ebx, 1
mov edx, edi
mov dword [ebp - 0x14], ebx
mov ecx, eax
call fcn.10007000
test al, al
jne 0x100907c6
push str.weapon_charger_claw
lea ecx, [ebp - 0x2c]
call fcn.10007b20
mov edx, edi
mov ecx, eax
mov ebx, 3
call fcn.10007000
mov byte [ebp - 0xd], 1
test al, al
je 0x100907ca
mov byte [ebp - 0xd], 0
test bl, 2
je 0x10090814
mov ecx, dword [ebp - 0x18]
and ebx, 0xfffffffd
cmp ecx, 0x10
jb 0x10090802
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100907f8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10090849
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x10090859
mov ecx, dword [ebp - 0x4c]
and ebx, 0xfffffffe
cmp ecx, 0x10
jb 0x10090859
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1009084f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1009084f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d8ffc
add esp, 8
cmp byte [ebp - 0xd], 0
jne 0x10090b93
mov ecx, dword [ebp - 0x30]
mov eax, dword [0x100f4628]
movss xmm2, dword [0x100ff594]
movss xmm1, dword [0x100ff328]
mov ecx, dword [ecx]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100ecac4]
movq xmm0, qword [ecx + eax]
mov eax, dword [ecx + eax + 8]
movq qword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0x20]
comiss xmm0, xmm2
mov dword [ebp - 0x18], eax
jbe 0x100908a8
comiss xmm1, xmm0
ja 0x100908b7
movss xmm0, dword [ebp - 0x1c]
comiss xmm0, xmm2
jbe 0x1009092e
comiss xmm1, xmm0
jbe 0x1009092e
cmp byte [0x101077f4], 0
je 0x10090b93
mov eax, dword [0x10107740]
xor edx, edx
movaps xmm0, xmmword [0x10100490]
mov ecx, dword [eax + 4]
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x5c
mov byte [ebp - 0x16], 0
mov al, byte [ebp - 0x28]
xor byte [ebp + edx - 0x27], al
inc edx
cmp edx, 0x10
jb 0x100908e3
mov word [ebp - 0x17], 0x100
lea edx, [ebp - 0x27]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x19c]
call eax
mov eax, dword [ebp - 0x14]
mov dword [0x101077f0], eax
mov byte [0x101077ec], 0
mov byte [0x101077f4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [0x10105630], 0
je 0x10090b0b
push str.weapon_jockey_claw
lea ecx, [ebp - 0x60]
call fcn.10007b20
mov edx, edi
mov ecx, eax
or ebx, 4
call fcn.10007000
test al, al
je 0x1009096c
mov eax, dword [ebp - 0x30]
mov byte [ebp - 0xd], 1
mov ecx, dword [eax]
mov eax, dword [0x100edbd0]
cmp dword [eax + ecx], 8
je 0x10090970
mov byte [ebp - 0xd], 0
test bl, 4
je 0x100909ae
mov ecx, dword [ebp - 0x4c]
and ebx, 0xfffffffb
cmp ecx, 0x10
jb 0x100909ae
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100909a4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100909a4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d8ffc
add esp, 8
cmp byte [ebp - 0xd], 0
je 0x100909ed
cmp byte [0x101077ec], 0
sete al
mov byte [0x101077ec], al
test al, al
je 0x100909ed
mov eax, dword [0x1010562c]
mov byte [0x1010638d], 1
cmp eax, 1
jne 0x100909e1
mov dword [esi + 0x18], 0x7fc00000
jmp 0x100909ed
cmp eax, 2
jne 0x100909ed
mov dword [esi + 0x18], 0x7f800000
push str.weapon_charger_claw
lea ecx, [ebp - 0x60]
call fcn.10007b20
mov edx, edi
mov ecx, eax
or ebx, 8
call fcn.10007000
test al, al
je 0x10090a19
mov eax, dword [ebp - 0x14]
mov byte [ebp - 0xd], 1
cmp eax, dword [0x101077f0]
jg 0x10090a1d
mov byte [ebp - 0xd], 0
test bl, 8
je 0x10090a58
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0x10
jb 0x10090a58
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10090a4e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10090a4e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d8ffc
add esp, 8
cmp byte [ebp - 0xd], 0
je 0x10090b0b
cmp byte [0x101077f4], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
jne 0x10090a84
call edi
add eax, 0x1f4
mov byte [0x101077f4], 1
mov dword [0x101077e8], eax
cmp byte [0x101077ec], 0
sete al
mov byte [0x101077ec], al
test al, al
je 0x10090aa5
mov byte [0x1010638d], 1
mov dword [esi + 0xc], 0x7cf0bdc2
call edi
test edx, edx
jb 0x10090b0b
ja 0x10090ab5
cmp eax, dword [0x101077e8]
jbe 0x10090b0b
mov eax, dword [0x10107740]
xor edx, edx
movaps xmm0, xmmword [str.0So__ECUUQRU]
mov ecx, dword [eax + 4]
movups xmmword [ebp - 0x44], xmm0
mov word [ebp - 0x34], 1
mov byte [ebp - 0x32], 0
mov al, byte [ebp - 0x44]
xor byte [ebp + edx - 0x43], al
inc edx
cmp edx, 0x10
jb 0x10090ad4
mov word [ebp - 0x33], 0x100
lea edx, [ebp - 0x43]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x19c]
call eax
mov eax, dword [ebp - 0x14]
mov byte [0x101077f4], 0
mov byte [0x101077ec], 0
mov dword [0x101077f0], eax
mov eax, dword [0x10107740]
mov edi, dword [0x1010557c]
push edi
mov ecx, dword [eax + 0x60]
mov eax, dword [ecx]
mov eax, dword [eax + 0x80]
call eax
push edi
test eax, eax
jne 0x10090b36
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10090b93
jmp 0x10090b5b
mov eax, dword [0x10107740]
mov esi, dword [eax + 0x60]
mov ecx, esi
mov eax, dword [esi]
mov eax, dword [eax + 0x80]
call eax
mov ecx, dword [esi]
push eax
mov edx, dword [ecx + 0x2c]
mov ecx, esi
call edx
test al, al
je 0x10090b93
mov esi, dword [ebp - 0x48]
mov eax, dword [0x1010562c]
mov byte [0x1010638d], 1
cmp eax, 1
jne 0x10090b87
mov dword [esi + 0x18], 0x7fc00000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp eax, 2
jne 0x10090b93
mov dword [esi + 0x18], 0x7f800000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8