Function at 0x445910
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4a5080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x4ac6b0]
push esi
push edi
test ebx, ebx
je 0x445932
mov eax, dword [ebx + 0x7c]
jmp 0x445934
xor eax, eax
cmp dword [eax + 0xc], 0
jne 0x445955
test ebx, ebx
je 0x44595e
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x445955
cmp dword [eax], 0
je 0x445955
call fcn.0042cde0
mov ebx, dword [0x4ac6b0]
test ebx, ebx
je 0x44595e
mov esi, dword [ebx + 0x78]
jmp 0x445960
xor esi, esi
lea eax, [ebp - 0x30]
mov dword [ebp - 8], esi
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x30], xmm0
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
movd xmm1, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x18]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x18]
mov ecx, edi
sub ecx, dword [esi + 0x10]
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
mov edx, esi
sbb edx, dword [eax + 0x14]
call fcn.00482b80
mov eax, dword [ebp - 8]
cvtsd2ss xmm0, xmm0
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x18]
movss dword [ebp - 0xc], xmm0
call fcn.00482b80
movss xmm1, dword [ebp - 0xc]
cvtsd2ss xmm0, xmm0
mov eax, dword [ebp - 8]
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [eax + 0x10], edi
mov edi, eax
mov dword [edi + 0x14], esi
mov esi, dword [0x4ac6b0]
test esi, esi
je 0x445a0a
mov eax, dword [esi + 0x78]
mov dword [ebp - 8], eax
jmp 0x445a11
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
cmp eax, edx
jne 0x445aa9
cmp byte [esi + 0x9b], 0
je 0x445a6a
cvttss2si eax, dword [esi + 0xdc0]
mov dword [ebp - 0x20], eax
cvttss2si eax, dword [esi + 0xdc4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push edx
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x445a5e
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp byte [esi + 0x9b], 0
mov ecx, dword [ebp - 8]
jne 0x445aa9
cmp dword [ecx + 8], 0
jne 0x445aa9
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x445aa9
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push dword [eax]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x445aa9
movd xmm2, dword [ebp - 0x1c]
lea ecx, [esi + 8]
movd xmm1, dword [ebp - 0x20]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
call fcn.004069c0
call fcn.0042d0f0
cmp byte [ebx + 0x60], 0
je 0x445ab9
or eax, 0xffffffff
jmp 0x445ac4
mov eax, dword [0x4ac6b0]
mov eax, dword [eax + 0x4948]
cmp dword [edi + 0x20], eax
je 0x445ad1
mov dword [edi + 0x20], eax
call fcn.0042cfc0
call fcn.0042d2a0
call fcn.0040a4b0
cmp byte [0x4a5300], 0
je 0x445b04
cmp byte [0x4a5301], 0
je 0x445b22
push 0x11
push dword [0x4ac7f0]
call dword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov byte [0x4a5301], 0
jmp 0x445b22
cmp byte [0x4a5301], 0
jne 0x445b22
push 0
push dword [0x4ac7f0]
call dword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov byte [0x4a5301], 1
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x2d
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test al, 1
je 0x445b48
cmp byte [0x4a5302], 0
push 1
sete byte [0x4a5302]
call esi
push 0x70
call edi
test al, 1
je 0x445b62
cmp byte [0x4a5302], 0
push 1
sete byte [0x4a5302]
call esi
cmp byte [0x4a5302], 0
je 0x445b70
call fcn.00441e00
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0xc]
push 0
push 4
push eax
mov eax, dword [0x4ac894]
add eax, 0xf56d10
push eax
push dword [0x4ac7fc]
call ebx
push 0
push 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
add eax, 0xfe8
push eax
push dword [0x4ac7fc]
call ebx
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
push 0
push 4
push eax
lea eax, [esi + 0xe38]
push eax
push dword [0x4ac7fc]
call ebx
push 0
push 4
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0xe3c]
push eax
push dword [0x4ac7fc]
call ebx
push 0
push 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 0xe40]
push eax
push dword [0x4ac7fc]
call ebx
cmp byte [0x4ac816], 0
je 0x445de5
mov eax, dword [0x4a5c2c]
mov ecx, dword [0x4ac6b0]
mov dword [ebp - 8], eax
mov eax, dword [0x4ac89c]
cdq
mov ecx, dword [ecx + 0x47c4]
sub eax, edx
sar eax, 1
mov dword [ebp - 0xc], eax
mov dword [0x4ac7f8], eax
mov eax, dword [0x4ac898]
mov ecx, dword [ecx]
cdq
sub eax, edx
mov edx, 1
sar eax, 1
push str.Foreground
mov dword [ebp - 0x14], eax
mov dword [0x4ac6c0], eax
call fcn.00409e10
mov ecx, dword [0x4a6010]
mov ebx, eax
movsd xmm1, qword [0x4971d8]
xorps xmm2, xmm2
mov eax, dword [0x4a6014]
add esp, 4
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x4975d0]
divsd xmm0, xmm1
cvtpd2ps xmm3, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4975d0]
mov eax, dword [0x4a6018]
divsd xmm0, xmm1
cvtpd2ps xmm5, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4975d0]
mov eax, dword [0x4a601c]
divsd xmm0, xmm1
cvtpd2ps xmm6, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
comiss xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x4975d0]
divsd xmm0, xmm1
cvtpd2ps xmm7, xmm0
movss xmm0, dword [0x497110]
jbe 0x445cef
xorps xmm1, xmm1
jmp 0x445cf6
movaps xmm1, xmm0
minss xmm1, xmm3
comiss xmm2, xmm5
movss xmm4, dword [0x497334]
movss xmm3, dword [0x4970e4]
mulss xmm1, xmm4
addss xmm1, xmm3
cvttss2si ecx, xmm1
jbe 0x445d1c
xorps xmm1, xmm1
jmp 0x445d23
movaps xmm1, xmm0
minss xmm1, xmm5
mulss xmm1, xmm4
addss xmm1, xmm3
cvttss2si eax, xmm1
shl eax, 8
or ecx, eax
comiss xmm2, xmm6
jbe 0x445d3e
xorps xmm1, xmm1
jmp 0x445d45
movaps xmm1, xmm0
minss xmm1, xmm6
mulss xmm1, xmm4
addss xmm1, xmm3
cvttss2si eax, xmm1
shl eax, 0x10
or ecx, eax
comiss xmm2, xmm7
jbe 0x445d60
xorps xmm0, xmm0
jmp 0x445d64
minss xmm0, xmm7
mulss xmm0, xmm4
addss xmm0, xmm3
cvttss2si esi, xmm0
movd xmm0, dword [ebp - 0xc]
cvtdq2ps xmm0, xmm0
shl esi, 0x18
or esi, ecx
movss dword [ebp - 0x20], xmm0
movd xmm0, dword [ebp - 0x14]
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x1c], xmm0
movd xmm0, dword [ebp - 8]
cvtdq2ps xmm0, xmm0
test esi, 0xff000000
je 0x445de5
comiss xmm3, xmm0
ja 0x445de5
subss xmm0, xmm3
xorps xmm3, xmm3
push 0xfe
push ecx
lea eax, [ebp - 0x20]
mov dword [esp], 0x40c84601
push eax
movaps xmm2, xmm0
mov ecx, ebx
call fcn.00426880
push ecx
mov dword [esp], 0x3f800000
mov ecx, ebx
push 1
push esi
push dword [ebx + 0x54]
push dword [ebx + 0x5c]
call fcn.00425300
mov dword [ebx + 0x54], 0
call fcn.0043cf30
cmp byte [0x4ac80d], 0
je 0x445e0d
push 0x56
call edi
test ax, ax
je 0x445e0d
call fcn.00437490
mov dword [ebp - 8], 0x90909090
lea ecx, [ebp - 8]
jmp 0x445e1c
call fcn.00437490
mov dword [ebp - 0x14], 0xe1580ff3
lea ecx, [ebp - 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add eax, 0x17121
push 0
push 4
push ecx
push eax
push dword [0x4ac7fc]
call ebx
push 0
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x4ac894]
add eax, 0xf56d10
push eax
push dword [0x4ac7fc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x4ac87a], 0
je 0x445e6a
push 0x47
call edi
mov byte [ebp - 0x10], 0
test ax, ax
jne 0x445e6e
mov byte [ebp - 0x10], 1
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add esi, 0xd3ff4
push eax
push 0x40
push 1
push esi
push dword [0x4ac7fc]
call edi
push 0
push 1
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 1
push esi
push dword [0x4ac7fc]
call edi
call fcn.0043c170
mov esi, dword [0x4ac888]
lea eax, [ebp - 0xc]
push eax
push 0x40
add esi, 0xd0e0
mov dword [ebp - 0x14], 0xc2220000
cmp byte [0x4ac864], 0
push 4
push esi
push dword [0x4ac7fc]
jne 0x445ee8
mov dword [ebp - 0x14], 0
call edi
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 4
push esi
push dword [0x4ac7fc]
call edi
cmp byte [0x4ac817], 0
je 0x445f6a
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x445f6a
mov esi, dword [0x4ac888]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
add esi, 0xdd90
mov dword [ebp - 0x14], 0x41880000
push esi
push dword [0x4ac7fc]
call edi
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 4
push esi
push dword [0x4ac7fc]
call edi
call fcn.0040c060
mov eax, dword [0x4ac87c]
push 0
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4ac87c]
push 0
push 0x1b
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4ac87c]
push 0
push 0xae
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4ac87c]
push 0
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push 0
push 1
push 0
push 0
push eax
call dword [ecx + 0xac]
mov eax, dword [0x4ac87c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x446009
call fcn.0040c400
mov eax, dword [0x4ac6b0]
mov eax, dword [eax + 0x47c4]
mov ecx, dword [eax]
xor eax, eax
add ecx, 0x38
cmp byte [ecx], al
cmove ecx, eax
call fcn.0042c800
mov eax, dword [0x4ac87c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov ecx, dword [0x4ac87c]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x44]
cmp eax, 0x88760868
jne 0x4460c9
mov eax, dword [0x4ac87c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x4460c9
mov esi, dword [0x4ac6b0]
test esi, esi
je 0x44609f
mov esi, dword [esi + 0x7c]
test esi, esi
je 0x44609f
cmp dword [esi], 0
je 0x44609f
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x446068
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 4], 0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44607c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 8], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x44609f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [0x4ac6b0]
mov dword [esi + 0xc], 0
mov eax, dword [eax + 0x48]
mov dword [eax + 4], 0
mov eax, dword [0x4ac87c]
push 0x4ac82c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [0x4ac6b0]
test eax, eax
je 0x4460c9
mov eax, dword [eax + 0x7c]
test eax, eax
je 0x4460c9
cmp dword [eax], 0
je 0x4460c9
call fcn.0042cde0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00481c53
mov esp, ebp
pop ebp
ret