Function at 0x1000a100
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x108
mov eax, dword [0x100fa00c]
xor eax, esp
mov dword [esp + 0x104], eax
cmp dword [0x100fff8c], 0
movd xmm0, dword [0xc9c040]
cvtdq2ps xmm0, xmm0
push esi
push edi
movss dword [esp + 0x34], xmm0
movd xmm0, dword [0xc9c044]
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x38], xmm0
jbe 0x1000ac66
push dword [0x100fa940]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
test ax, ax
je 0x1000ac66
push dword [0x100fa940]
call esi
test ax, ax
je 0x1000ac66
push str.client.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1000ac66
cmp dword [0xb6fc58], 1
jne 0x1000ac66
mov eax, dword [0x100fffa0]
test eax, eax
jne 0x1000a208
movzx eax, word [0x100f041c]
movq xmm0, qword [0x100f0414]
mov word [esp + 0xd8], ax
movzx eax, word [0x100f0428]
mov word [esp + 0xe8], ax
lea eax, [esp + 0xe0]
push eax
lea eax, [esp + 0xd4]
movq qword [esp + 0xd4], xmm0
movq xmm0, qword [str.x____xxxx]
push eax
push str.client.dll
movq qword [esp + 0xec], xmm0
call fcn.10004fc0
mov dword [0x100fffa0], eax
test eax, eax
jne 0x1000a208
mov eax, dword [esp + 0xe0]
jmp 0x1000a20a
call eax
movss xmm0, dword [0x100f2068]
xor esi, esi
mov dword [esp + 0x20], eax
mov edi, 0x100fbf6c
mov dword [esp + 8], esi
movss dword [esp + 0x1c], xmm0
nop word [eax + eax]
push str.client.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1000a868
mov eax, 0xb6fc58
cmp dword [eax], 1
jne 0x1000a868
mov esi, dword [edi]
test esi, esi
je 0x1000a864
mov ecx, esi
call fcn.10005390
test al, al
je 0x1000a84f
cmp esi, dword [esp + 0x20]
je 0x1000a84f
mov ecx, esi
call fcn.10005390
test al, al
je 0x1000a84f
lea eax, [esp + 0x4c]
push eax
push 4
lea eax, [esp + 0x50]
push eax
lea eax, [esi + 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [esp + 0x48]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1000a84f
mov eax, dword [0x100fff9c]
mov byte [esp + 0xf], 0
test eax, eax
jne 0x1000a2e0
push str.xxxxxxx____xxxxxxxxxxxxxxxxxxxxxxxxx
push 0x100faf60
push str.client.dll
call fcn.10004fc0
mov dword [0x100fff9c], eax
test eax, eax
je 0x1000a2eb
lea ecx, [esp + 0xf]
push ecx
push esi
call eax
add esp, 8
cmp byte [esp + 0xf], 0
je 0x1000a84f
mov eax, 0xb6fc58
cmp dword [eax], 1
jne 0x1000a372
mov eax, dword [0x100fffa0]
test eax, eax
jne 0x1000a36c
movzx eax, word [0x100f041c]
movq xmm0, qword [0x100f0414]
mov word [esp + 0xfc], ax
movzx eax, word [0x100f0428]
mov word [esp + 0x108], ax
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 0xf8]
movq qword [esp + 0xf8], xmm0
movq xmm0, qword [str.x____xxxx]
push eax
push str.client.dll
movq qword [esp + 0x10c], xmm0
call fcn.10004fc0
mov dword [0x100fffa0], eax
test eax, eax
je 0x1000a372
call eax
mov dword [esp + 0x30], eax
mov eax, dword [0x100fff94]
test eax, eax
jne 0x1000a398
push 0x100f0500
push 0x100f0510
push str.client.dll
call fcn.10004fc0
mov dword [0x100fff94], eax
test eax, eax
je 0x1000a3a6
lea ecx, [esp + 0x24]
push ecx
push dword [esp + 0x34]
call eax
add esp, 8
mov eax, dword [0x100fff80]
test eax, eax
jne 0x1000a3cc
push str.xxxxxxxxxxxxx____x
push 0x100fb210
push str.client.dll
call fcn.10004fc0
mov dword [0x100fff80], eax
test eax, eax
je 0x1000a3d9
lea ecx, [esp + 0x3c]
push ecx
push 8
push esi
call eax
add esp, 0xc
movss xmm7, dword [esp + 0x40]
mov eax, 0xb6fa2c
movaps xmm6, xmm7
movss dword [esp + 0xd0], xmm7
movups xmm2, xmmword [eax + 0x10]
movups xmm3, xmmword [eax + 0x20]
movups xmm5, xmmword [eax]
movups xmm4, xmmword [eax + 0x30]
mov eax, dword [0xc17044]
movaps xmm0, xmm2
mulss xmm7, xmm2
shufps xmm0, xmm2, 0xaa
mulss xmm6, xmm0
movss xmm0, dword [esp + 0x44]
movaps xmm1, xmm0
movss dword [esp + 0x18], xmm0
movaps xmm0, xmm3
shufps xmm2, xmm2, 0x55
shufps xmm0, xmm3, 0xaa
mulss xmm1, xmm0
movss xmm0, dword [esp + 0x3c]
movss dword [esp + 0x10], xmm0
addss xmm6, xmm1
movaps xmm1, xmm0
movaps xmm0, xmm5
shufps xmm0, xmm5, 0xaa
mulss xmm1, xmm0
movaps xmm0, xmm4
shufps xmm0, xmm4, 0xaa
addss xmm6, xmm1
movss xmm1, dword [0x100f1ec4]
addss xmm6, xmm0
movss xmm0, dword [esp + 0x18]
mulss xmm0, xmm3
shufps xmm3, xmm3, 0x55
addss xmm7, xmm0
movss xmm0, dword [esp + 0x10]
mulss xmm0, xmm5
divss xmm1, xmm6
addss xmm7, xmm0
shufps xmm5, xmm5, 0x55
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
shr eax, 0x1f
addss xmm7, xmm4
shufps xmm4, xmm4, 0x55
addsd xmm0, qword [eax*8 + 0x100f26c0]
mov eax, dword [0xc17048]
cvtpd2ps xmm0, xmm0
mulss xmm0, xmm1
mulss xmm7, xmm0
movss xmm0, dword [esp + 0x40]
mulss xmm0, xmm2
movss dword [esp + 0x14], xmm0
movss xmm0, dword [esp + 0x18]
movss xmm2, dword [esp + 0x14]
mulss xmm0, xmm3
addss xmm2, xmm0
movss xmm0, dword [esp + 0x10]
mulss xmm0, xmm5
movaps xmm5, xmm2
addss xmm5, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
shr eax, 0x1f
addss xmm5, xmm4
addsd xmm0, qword [eax*8 + 0x100f26c0]
cvtpd2ps xmm0, xmm0
mulss xmm0, xmm1
mulss xmm5, xmm0
xorps xmm0, xmm0
comiss xmm6, xmm0
jbe 0x1000a84f
mov eax, dword [0xbaa410]
cmp eax, 0x1e
je 0x1000a6ff
cmp eax, 0x1f
je 0x1000a6ff
cmp eax, 0x21
je 0x1000a6ff
cmp eax, 0x16
je 0x1000a6ff
cmp eax, 0x17
je 0x1000a6ff
cmp eax, 0x18
je 0x1000a6ff
cmp eax, 0x19
je 0x1000a6ff
cmp eax, 0x1a
je 0x1000a6ff
cmp eax, 0x1b
je 0x1000a6ff
cmp eax, 0x1c
je 0x1000a6ff
cmp eax, 0x1d
je 0x1000a6ff
cmp eax, 0x20
je 0x1000a6ff
movd xmm3, dword [0x100fae7c]
movss xmm2, dword [esp + 0x34]
movss xmm4, dword [0x100f1e80]
cvtdq2ps xmm3, xmm3
mulss xmm2, xmm4
movaps xmm0, xmm3
addss xmm0, xmm2
comiss xmm0, xmm7
jb 0x1000a84f
movss xmm1, dword [esp + 0x38]
mulss xmm1, xmm4
movaps xmm0, xmm1
addss xmm0, xmm3
comiss xmm0, xmm5
jb 0x1000a84f
subss xmm2, xmm3
comiss xmm7, xmm2
jb 0x1000a84f
subss xmm1, xmm3
comiss xmm5, xmm1
jb 0x1000a84f
movss xmm0, dword [esp + 0x24]
sub esp, 0x10
movss dword [esp + 0x24], xmm0
movss xmm0, dword [esp + 0x3c]
movss dword [esp + 0xf0], xmm0
movsd xmm0, qword [0x100f1f68]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0xe0]
subss xmm0, dword [esp + 0x38]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006c960
movsd xmm0, qword [0x100f1f68]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x20]
subss xmm0, dword [esp + 0x24]
fstp qword [esp + 0xe0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006c960
movsd xmm0, qword [0x100f1f68]
fadd qword [esp + 0xe0]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x28]
subss xmm0, dword [esp + 0xf0]
fstp qword [esp + 0xe0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006c960
fadd qword [esp + 0xe0]
add esp, 0x10
xorps xmm1, xmm1
fstp qword [esp + 0xe0]
movsd xmm0, qword [esp + 0xe0]
ucomisd xmm1, xmm0
ja 0x1000a6c7
sqrtsd xmm0, xmm0
jmp 0x1000a6cc
call fcn.10086c10
movss xmm1, dword [esp + 0x1c]
cvtsd2ss xmm0, xmm0
comiss xmm1, xmm0
jb 0x1000a84f
movss xmm1, dword [0x100f200c]
comiss xmm1, xmm0
jb 0x1000a84f
movss dword [esp + 0x1c], xmm0
mov dword [esp + 8], esi
jmp 0x1000a853
movss xmm2, dword [esp + 0x34]
movd xmm3, dword [0x100fae7c]
cvtps2pd xmm2, xmm2
cvtdq2pd xmm3, xmm3
mulsd xmm2, qword [0x100f1f38]
cvtps2pd xmm6, xmm7
movaps xmm0, xmm3
addsd xmm0, xmm2
comisd xmm0, xmm6
jb 0x1000a84f
movss xmm1, dword [esp + 0x38]
cvtps2pd xmm1, xmm1
cvtps2pd xmm4, xmm5
mulsd xmm1, qword [0x100f1f28]
movaps xmm0, xmm1
addsd xmm0, xmm3
comisd xmm0, xmm4
jb 0x1000a84f
subsd xmm2, xmm3
comisd xmm6, xmm2
jb 0x1000a84f
subsd xmm1, xmm3
comisd xmm4, xmm1
jb 0x1000a84f
movss xmm0, dword [esp + 0x24]
sub esp, 0x10
movss dword [esp + 0xf0], xmm0
movss xmm0, dword [esp + 0x3c]
movss dword [esp + 0x24], xmm0
movsd xmm0, qword [0x100f1f68]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0xe0]
subss xmm0, dword [esp + 0x38]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006c960
movsd xmm0, qword [0x100f1f68]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x20]
subss xmm0, dword [esp + 0xf0]
fstp qword [esp + 0xe0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006c960
movsd xmm0, qword [0x100f1f68]
fadd qword [esp + 0xe0]
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x28]
subss xmm0, dword [esp + 0x24]
fstp qword [esp + 0xf0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006c960
fadd qword [esp + 0xf0]
add esp, 0x10
xorps xmm1, xmm1
fstp qword [esp + 0xe0]
movsd xmm0, qword [esp + 0xe0]
ucomisd xmm1, xmm0
ja 0x1000a6c7
sqrtsd xmm0, xmm0
jmp 0x1000a6cc
mov esi, dword [esp + 8]
add edi, 4
cmp edi, 0x100fff68
jle 0x1000a230
jmp 0x1000a868
mov esi, dword [esp + 8]
test esi, esi
je 0x1000ac66
mov ecx, esi
call fcn.10005390
test al, al
je 0x1000ac66
cmp byte [0x100fff85], 0
jne 0x1000a8f9
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xd0]
push eax
push 0x40
push 1
push dword [0x10103fdc]
call esi
mov eax, dword [0x10103fdc]
lea ecx, [esp + 0xd0]
push ecx
mov byte [eax], 0xeb
push dword [esp + 0xd4]
push 1
push eax
call esi
lea eax, [esp + 0xd0]
push eax
push 0x40
push 1
push dword [0x100fff8c]
call esi
mov eax, dword [0x100fff8c]
lea ecx, [esp + 0xd0]
push ecx
mov byte [eax], 0xeb
push dword [esp + 0xd4]
push 1
push eax
call esi
mov esi, dword [esp + 8]
mov byte [0x100fff85], 1
mov eax, dword [0x100fff80]
test eax, eax
jne 0x1000a91f
push str.xxxxxxxxxxxxx____x
push 0x100fb210
push str.client.dll
call fcn.10004fc0
mov dword [0x100fff80], eax
test eax, eax
je 0x1000a92c
lea ecx, [esp + 0x3c]
push ecx
push 8
push esi
call eax
add esp, 0xc
movss xmm3, dword [esp + 0x40]
mov eax, 0xb6fa2c
movaps xmm2, xmm3
movss dword [esp + 0x18], xmm3
movss xmm3, dword [esp + 0x44]
movaps xmm1, xmm3
movups xmm4, xmmword [eax + 0x10]
movups xmm5, xmmword [eax + 0x20]
movups xmm7, xmmword [eax]
movups xmm6, xmmword [eax + 0x30]
mov eax, dword [0xc17044]
movaps xmm0, xmm4
shufps xmm0, xmm4, 0xaa
mulss xmm2, xmm0
movaps xmm0, xmm5
shufps xmm0, xmm5, 0xaa
mulss xmm1, xmm0
movaps xmm0, xmm7
shufps xmm0, xmm7, 0xaa
addss xmm2, xmm1
movss dword [esp + 0x10], xmm2
movss xmm2, dword [esp + 0x3c]
movaps xmm1, xmm2
mulss xmm1, xmm0
movss xmm0, dword [esp + 0x10]
addss xmm0, xmm1
movss dword [esp + 0x10], xmm0
movaps xmm0, xmm6
movss xmm1, dword [esp + 0x10]
shufps xmm0, xmm6, 0xaa
addss xmm1, xmm0
movss xmm0, dword [0x100f1ec4]
divss xmm0, xmm1
movss dword [esp + 0x10], xmm1
movss xmm1, dword [esp + 0x18]
movss dword [esp + 0x14], xmm0
movaps xmm0, xmm3
mulss xmm0, xmm5
mulss xmm1, xmm4
shufps xmm4, xmm4, 0x55
shufps xmm5, xmm5, 0x55
addss xmm1, xmm0
mulss xmm3, xmm5
movaps xmm0, xmm2
mulss xmm0, xmm7
shufps xmm7, xmm7, 0x55
mulss xmm2, xmm7
addss xmm1, xmm0
movaps xmm0, xmm1
addss xmm0, xmm6
shufps xmm6, xmm6, 0x55
movss dword [esp + 8], xmm0
movss xmm1, dword [esp + 8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100f26c0]
mov eax, dword [0xc17048]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [esp + 0x14]
mulss xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movss dword [esp + 8], xmm1
movss xmm1, dword [esp + 0x18]
addsd xmm0, qword [eax*8 + 0x100f26c0]
mulss xmm1, xmm4
addss xmm1, xmm3
cvtpd2ps xmm0, xmm0
addss xmm1, xmm2
mulss xmm0, dword [esp + 0x14]
addss xmm1, xmm6
mulss xmm1, xmm0
movss xmm0, dword [esp + 0x10]
movss dword [esp + 0x18], xmm1
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1000ac66
mov eax, 0xb6fa2c
push 0x40
push 0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x98], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esp + 0xa8], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [esp + 0xb8], xmm0
movups xmm0, xmmword [eax + 0x30]
lea eax, [esp + 0x58]
push eax
movups xmmword [esp + 0xcc], xmm0
call fcn.1006a800
add esp, 0xc
mov dword [esp + 0xcc], 0x3f800000
lea eax, [esp + 0x90]
push eax
push 0
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.d3dx9_42.dll_D3DXMatrixInverse]
mov eax, dword [0xc17044]
lea edx, [esp + 0xf4]
movss xmm5, dword [esp + 8]
lea ecx, [esp + 0x100]
movss xmm3, dword [esp + 0x18]
movss xmm6, dword [esp + 0x10]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movss xmm4, dword [esp + 0x60]
addsd xmm0, qword [eax*8 + 0x100f26c0]
mov eax, dword [0xc17048]
movss xmm2, dword [esp + 0x64]
movss xmm1, dword [esp + 0x68]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [esp + 0x14]
divss xmm5, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100f26c0]
lea eax, [esp + 0x24]
push eax
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [esp + 0x18]
divss xmm3, xmm0
movaps xmm0, xmm6
mulss xmm0, dword [esp + 0x74]
mulss xmm4, xmm3
mulss xmm2, xmm3
addss xmm4, xmm0
mulss xmm1, xmm3
movss xmm0, dword [esp + 0x54]
mulss xmm0, xmm5
movss xmm3, dword [esp + 0x20]
addss xmm4, xmm0
movaps xmm0, xmm6
mulss xmm0, dword [esp + 0x78]
mulss xmm6, dword [esp + 0x7c]
addss xmm4, dword [esp + 0x84]
addss xmm2, xmm0
movss xmm0, dword [esp + 0x58]
mulss xmm0, xmm5
addss xmm1, xmm6
movss dword [esp + 0x28], xmm4
addss xmm2, xmm0
movss xmm0, dword [esp + 0x5c]
mulss xmm0, xmm5
addss xmm2, dword [esp + 0x88]
addss xmm1, xmm0
movss xmm0, dword [0xb6f338]
movss dword [esp + 0xf8], xmm0
movss xmm0, dword [0xb6f33c]
movss dword [esp + 0xfc], xmm0
movss xmm0, dword [0xb6f340]
addss xmm1, dword [esp + 0x8c]
movss dword [esp + 0x100], xmm0
movss dword [esp + 0x2c], xmm2
movss dword [esp + 0x30], xmm1
call fcn.100050a0
movss xmm0, dword [esp + 0x108]
add esp, 4
movss dword [0xb6f258], xmm0
movss xmm0, dword [esp + 0x100]
movss dword [0xb6f248], xmm0
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.10068c51
mov esp, ebp
pop ebp
ret