Function at 0x10001300
Capabilities:
Log keystrokes via application hook
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10003078
mov eax, dword fs:[0]
push eax
sub esp, 0x650
mov eax, dword [0x1000501c]
xor eax, esp
mov dword [esp + 0x648], eax
push ebx
push esi
push edi
mov eax, dword [0x1000501c]
xor eax, esp
push eax
lea eax, [esp + 0x660]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [0x10005458], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
sub eax, edi
je 0x1000173c
sub eax, 1
jne 0x10001766
lea esi, [edi + 5]
mov ebx, 0x4cda7d
call fcn.10002060
push 0x10001ae0
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
lea esi, [edi + 6]
mov ebx, 0x52d8f2
call fcn.10002060
push 0x100019f0
mov cl, 0xe9
mov esi, ebx
call fcn.10002140
add esp, 4
lea esi, [esp + 0x1c]
call fcn.10001100
push 0x200
lea ecx, [esp + 0x458]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, edi
je 0x10001481
lea edx, [esp + 0x454]
push edx
lea ecx, [esp + 0x43c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [esp + 0x668], edi
mov eax, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, dword [eax]
push ecx
push 0x100041ac
lea ecx, [esp + 0x440]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_last_of_char_const___unsigned_int_const]
mov edx, dword [esp + 0x44c]
push edx
inc eax
push eax
lea eax, [esp + 0x424]
push eax
lea ecx, [esp + 0x444]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
mov eax, dword [esp + 0x434]
mov edx, dword [esp + 0x420]
mov esi, edx
cmp eax, 0x10
jae 0x10001430
lea esi, [esp + 0x420]
mov ecx, 7
mov edi, str.main.exe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp eax, 0x10
movsb byte es:[edi], byte [esi]
mov eax, edx
jae 0x1000144d
lea eax, [esp + 0x420]
push eax
lea edi, [esp + 0x20]
call fcn.10001250
lea ecx, [esp + 0x41c]
mov dword [0x10007ba8], eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x438]
mov dword [esp + 0x668], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ebx, 0x10007bac
mov esi, str.DarksTeam.dll
jmp 0x10001490
push esi
lea edi, [esp + 0x20]
call fcn.10001250
mov dword [ebx], eax
add esi, 0x1f
add ebx, 4
cmp esi, 0x100050dc
jl 0x10001490
push str.1.1.1.1
push 0x10
push 0x10007b98
call dword [sym.imp.MSVCR90.dll_strcpy_s]
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x34], esp
push str._getip.php
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.getip.mubz.bg
mov dword [esp + 0x6a4], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [esp + 0x6a0], 0xffffffff
call fcn.100021d0
mov ecx, dword [0x10005458]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add esp, 0x38
mov dword [0x100050e4], ecx
call esi
mov edx, dword [0x100050e4]
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push edx
push 0x10001020
push 2
call edi
mov dword [0x100050e8], eax
call esi
push eax
mov eax, dword [0x100050e4]
push eax
push 0x10001040
push 7
call edi
mov esi, 7
mov ebx, 0x5392d8
mov dword [0x100050ec], eax
call fcn.10002060
push 0x10001a20
mov cl, 0xe9
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 7
mov ebx, 0x55c6f5
call fcn.10002060
push 0x10001a60
mov cl, 0xe9
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 7
mov ebx, 0x5663ca
call fcn.10002060
push 0x10001aa0
mov cl, 0xe9
mov esi, ebx
call fcn.10002140
mov byte [0x585ae9], 0xda
add esp, 4
mov esi, 5
mov ebx, 0x4b7999
mov dword [0x100050f8], 0
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4b823e
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4b839f
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4b83ef
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4b8478
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4b84c8
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4b84e6
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4bb699
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4bbff9
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4bc02e
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4bcadb
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
mov esi, 5
mov ebx, 0x4bcb10
call fcn.10002060
push 0x10002640
mov cl, 0xe8
mov esi, ebx
call fcn.10002140
add esp, 4
jmp 0x10001766
mov eax, dword [0x100050e8]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp eax, edi
je 0x10001754
push eax
call esi
mov dword [0x100050e8], edi
mov eax, dword [0x100050ec]
cmp eax, edi
je 0x10001766
push eax
call esi
mov dword [0x100050ec], edi
mov eax, 1
mov ecx, dword [esp + 0x660]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x648]
xor ecx, esp
call fcn.10002663
mov esp, ebp
pop ebp
ret 0xc