Function at 0x10021c4
Capabilities:
Log keystrokes
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x10070f4]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x78]
push eax
xor ebx, ebx
push 1
push ebx
push 0x1001248
push 0x80000002
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov byte [ebp - 0x65], bl
mov word [ebp - 0x44], bx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002244
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push 0x1001210
push dword [ebp - 0x78]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x80], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002236
cmp dword [ebp - 0x6c], ebx
setne byte [ebp - 0x65]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x65], bl
jne 0x1002254
call fcn.010013dd
test eax, eax
je 0x1002254
xor eax, eax
jmp 0x1002402
push edi
push 0x10071a0
call dword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
push 0x28
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
xor eax, eax
cmp edi, ebx
mov dword [0x10071bc], edi
je 0x1002401
push 0xa
pop edx
mov ecx, edx
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea eax, [ebp - 0x64]
push eax
push 0xc
push esi
mov dword [0x10071b8], edx
call edi
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0xe
push esi
call edi
push 0x10011dc
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, ebx
mov dword [ebp - 0x6c], eax
je 0x10023a5
push 2
push esi
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], 0x1001d8a
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], esi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push ebx
mov dword [ebp - 0x94], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push ebx
mov dword [ebp - 0x90], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
cmp ax, bx
mov dword [ebp - 0x74], eax
je 0x10023a5
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call esi
push 0xf
mov edi, eax
call esi
push 3
pop esi
mov ecx, eax
mov eax, edi
cdq
idiv esi
push ebx
push dword [ebp - 0x7c]
lea edx, [ecx + ecx*4]
push ebx
push ebx
shl edx, 1
push edx
push eax
push ecx
sub edi, eax
push edi
push 0xcf0000
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, ebx
mov dword [ebp - 0x70], eax
je 0x10023a2
push 0x1007120
push eax
call sub.KERNEL32.dll_RegisterConsoleIME
test eax, eax
je 0x10023a2
push 1
push dword [0x1007120]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
jne 0x10023ec
mov esi, dword [ebp - 0x7c]
cmp dword [0x1007120], ebx
je 0x10023b2
call sub.KERNEL32.dll_UnregisterConsoleIME
cmp dword [ebp - 0x70], ebx
je 0x10023c0
push dword [ebp - 0x70]
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp word [ebp - 0x74], bx
je 0x10023d1
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_UnregisterClassW]
cmp dword [ebp - 0x6c], ebx
je 0x10023e8
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1002401
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.010055c7
leave
ret 4