Function at 0x103700a
Capabilities:
Create process on windows
Lock the desktop
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x1a3
push edi
mov ebx, ecx
cmp esi, eax
ja 0x1051da8
je 0x1058216
add eax, 0xfffffff4
cmp esi, eax
ja 0x104e423
je 0x1058198
cmp esi, 0x130
je 0x103a0ab
cmp esi, 0x131
je 0x1058165
cmp esi, 0x132
je 0x103b08a
cmp esi, 0x191
je 0x104e449
mov eax, 0x192
cmp esi, eax
je 0x1058115
ja 0x1058068
pop edi
pop esi
pop ebx
leave
ret 8
push 0
push 0x132
push 0x111
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1037081
call fcn.01039f7d
mov eax, dword [0x10b10f4]
test eax, eax
je 0x103b0b5
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x103b0b5
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x10b10f4]
je 0x1058145
lea ecx, [ebx + 0xaf8]
call fcn.010372f5
test eax, eax
je 0x1037081
push dword [ebx + 0xb10]
mov ecx, ebx
call fcn.01039f5f
mov ecx, ebx
call fcn.0103b0e6
jmp 0x1037081
sub esi, 0x198
jne 0x10581b0
push 1
xor eax, eax
push eax
push eax
push 0x104e46c
push eax
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1037081
call fcn.0103ff19
jmp 0x1037081
test eax, eax
je 0x103b0b5
jmp 0x1037081
call fcn.0107a52e
jmp 0x1037081
mov eax, 0x1388
cmp esi, eax
ja 0x1058477
je 0x1058455
sub esi, 0x1a4
je 0x104e460
dec esi
je 0x105842b
sub esi, 3
je 0x1058349
sub esi, 0x4f
jne 0x1058227
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp + 8]
push eax
push 0x1051e64
push 0x17
push esi
push 0x1051e74
mov dword [ebp + 8], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1051e2e
push 0x1051e4c
lea ecx, [ebp + 0xc]
call fcn.01051e89
cmp dword [ebp + 0xc], esi
je 0x1051e25
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x1037081
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1037081
cmp esi, 0x195
ja 0x1037081
call fcn.0104ebca
test eax, eax
je 0x1037081
cmp esi, 0x193
jne 0x1058090
mov eax, 0x217
jmp 0x10580a2
xor eax, eax
cmp esi, 0x194
setne al
lea eax, [eax + eax + 0x218]
push eax
mov ecx, ebx
call fcn.01040163
push 1
xor edi, edi
push edi
push 3
push edi
mov ecx, ebx
call fcn.0100309d
push edi
push edi
push edi
cmp esi, 0x193
jne 0x10580d4
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CascadeWindows]
jmp 0x10580ed
xor eax, eax
cmp esi, 0x194
setne al
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TileWindows]
push edi
push 0x1f4
push 0x12
push dword [ebx + 4]
mov dword [ebx + 0xc70], edi
call dword [sym.imp.USER32.dll_SetTimer]
push edi
push edi
push 3
push edi
mov ecx, ebx
call fcn.0100309d
jmp 0x1037081
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
mov byte [0x10b39b8], 1
call fcn.01070a1c
push dword [0x10b10ec]
call dword [sym.imp.SHELL32.dll_Ordinal_54]
jmp 0x1037081
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [0x10b10f4]
cmp eax, ecx
jne 0x103b0b5
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
jmp 0x104e453
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
mov edi, 0xf3
push edi
push dword [ebx + 0xb10]
call esi
push 0
push 0
push edi
push dword [ebx + 0xb10]
call esi
jmp 0x1037081
xor eax, eax
cmp dword [0x10b10f8], eax
push 1
sete al
push eax
call fcn.01009aab
jmp 0x1037081
dec esi
dec esi
je 0x10581fd
dec esi
je 0x10581f3
dec esi
dec esi
je 0x10581dd
dec esi
dec esi
je 0x10581d1
dec esi
jne 0x1037081
push esi
call fcn.0107116d
jmp 0x1037081
push 0
call fcn.0104003f
jmp 0x1037081
cmp dword [ebp + 0xc], 0
je 0x10581e7
push 8
jmp 0x10581e9
push 1
call fcn.0104945c
jmp 0x1037081
call fcn.010703d2
jmp 0x1037081
push 0
push 0x2001
push 0
push 0x106ffa5
call dword [sym.imp.SHLWAPI.dll_SHCreateThread]
jmp 0x1037081
push 1
push 0x1f5
call fcn.0103fbb3
jmp 0x1037081
sub esi, 3
je 0x105831a
sub esi, 0xb
jne 0x1037081
cmp dword [0x10b24cc], esi
je 0x1058302
mov dl, byte [0x10b24d0]
mov edi, 0x400000
mov esi, 0x80000000
cmp dl, 4
jae 0x105825e
test dl, dl
jne 0x10582ab
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x10582ab
mov ebx, dword [0x10b24c0]
mov ecx, dword [0x10b24c4]
mov eax, ebx
and eax, edi
and ecx, esi
cmp eax, ebx
jne 0x10582ab
cmp ecx, dword [0x10b24c4]
jne 0x10582ab
push 0x1068968
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
mov dl, byte [0x10b24d0]
cmp dword [0x10b24cc], 0
je 0x1058302
cmp dl, 4
jae 0x10582bd
test dl, dl
jne 0x1058302
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x1058302
mov edx, dword [0x10b24c0]
mov eax, edx
and eax, edi
mov edi, dword [0x10b24c4]
mov ecx, edi
and ecx, esi
cmp eax, edx
jne 0x1058302
cmp ecx, edi
jne 0x1058302
push 0x1068958
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
call fcn.010704a1
test eax, eax
je 0x1037081
call dword [sym.imp.USER32.dll_LockWorkStation]
jmp 0x1037081
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0xc]
mov ecx, ebx
push 0
push dword [0x10b10ec]
mov byte [0x10b39b8], 1
call fcn.01070e65
jmp 0x1037081
cmp dword [0x10b24cc], 0
mov esi, 0x80000000
mov edi, 0x10000
je 0x10583af
mov al, byte [0x10b24d0]
cmp al, 4
jae 0x1058369
test al, al
jne 0x10583af
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x10583af
mov eax, dword [0x10b24c0]
mov edx, dword [0x10b24c4]
mov ecx, eax
and ecx, edi
and edx, esi
cmp ecx, eax
jne 0x10583af
cmp edx, dword [0x10b24c4]
jne 0x10583af
push 0x10585d8
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
push 2
mov ecx, ebx
call fcn.01071248
cmp dword [0x10b24cc], 0
je 0x1037081
mov al, byte [0x10b24d0]
cmp al, 4
jae 0x10583d6
test al, al
jne 0x1037081
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x1037081
mov eax, dword [0x10b24c0]
mov ecx, eax
and ecx, edi
mov edi, dword [0x10b24c4]
mov edx, edi
and edx, esi
cmp ecx, eax
jne 0x1037081
cmp edx, edi
jne 0x1037081
push 0x10585e8
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
jmp 0x1037081
push 4
call fcn.0104945c
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
inc eax
lea ecx, [ebp - 8]
push ecx
push eax
push 0x1121
push 0
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
call sub.ntdll.dll_WinSqmAddToStream
jmp 0x1037081
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x10b10ec]
call dword [sym.imp.SHELL32.dll_Ordinal_254]
jmp 0x1037081
sub esi, 0x1389
je 0x10585b3
sub esi, 0x8ca7
je 0x10584c4
sub esi, 0x35
je 0x10584ba
sub esi, 0x20
je 0x10584a9
dec esi
jne 0x1037081
push esi
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_91]
jmp 0x1037081
push 0
push 0
push dword [ebx + 4]
call sub.SHELL32.dll_Ordinal_886
jmp 0x1037081
call fcn.0105153c
jmp 0x1037081
and dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x100
mov dword [ebp - 0x1c], 9
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x414
push dword [ebx + 0xc04]
mov esi, eax
call edi
push 0
push 0x10002
push 0x128
push dword [ebx + 4]
mov dword [ebp + 0xc], eax
call edi
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov edi, ecx
test esi, esi
je 0x1058590
push esi
push dword [ebx + 0xb10]
call fcn.0100e838
test eax, eax
je 0x1058550
test edi, edi
jne 0x105856b
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebx + 0x3c]
call dword [sym.imp.SHLWAPI.dll_Ordinal_479]
jmp 0x1037081
cmp esi, dword [ebp + 0xc]
jne 0x1058575
test edi, edi
je 0x105856b
mov ecx, ebx
push dword [ebx + 0xc04]
call fcn.01039f5f
jmp 0x1037081
call fcn.0106fe4d
jmp 0x1037081
push esi
push dword [ebx + 0xc04]
call fcn.0100e838
test eax, eax
je 0x1058590
test edi, edi
jne 0x105853c
push dword [ebp + 0xc]
mov ecx, ebx
jmp 0x1058561
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0x3c]
call dword [sym.imp.SHLWAPI.dll_Ordinal_478]
test eax, eax
je 0x1037081
mov ecx, ebx
test edi, edi
je 0x105855b
push dword [ebx + 0xb10]
jmp 0x1058561
push 3
call dword [sym.imp.SHLWAPI.dll_Ordinal_413]
test eax, eax
je 0x1037081
xor eax, eax
push eax
push eax
push 0xd
push 0xffffffffffffffff
push eax
call sub.WINSTA.dll_WinStationSetInformationW
jmp 0x1037081