Function at 0x10371aa
Capabilities:
Create process on windows
Lock the desktop
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x1a4
push edi
mov ebx, ecx
cmp esi, eax
ja 0x104d170
je 0x1047b64
add eax, 0xfffffff4
cmp esi, eax
ja 0x1047b20
je 0x1047b31
mov eax, 0x191
cmp esi, eax
jbe 0x10586a5
mov eax, 0x192
cmp esi, eax
je 0x10587e6
ja 0x1058719
pop edi
pop esi
pop ebx
leave
ret 8
push 0
push 0x132
push 0x111
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x10371fe
call fcn.0103a0fd
mov eax, dword [0x10b10f4]
test eax, eax
je 0x103b235
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x103b235
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x10b10f4]
je 0x10586bc
lea ecx, [ebx + 0xaf8]
call fcn.01037472
test eax, eax
je 0x10371fe
push dword [ebx + 0xb10]
mov ecx, ebx
call fcn.0103a0df
mov ecx, ebx
call fcn.0103b266
jmp 0x10371fe
sub esi, 0x19a
jne 0x1058816
jmp 0x1058876
push 1
xor eax, eax
push eax
push eax
push 0x1047b70
push eax
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10371fe
dec esi
je 0x103b20a
jmp 0x10371fe
test eax, eax
je 0x103b235
jmp 0x10371fe
call fcn.0107af1e
jmp 0x10371fe
sub esi, 0x4f
jne 0x1058898
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp + 8]
push eax
push 0x104d150
push 0x17
push esi
push 0x104d160
mov dword [ebp + 8], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x104d11b
push 0x104d138
lea ecx, [ebp + 0xc]
call fcn.0104d1a7
cmp dword [ebp + 0xc], esi
je 0x104d112
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x10371fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10371fe
mov eax, 0x205
cmp esi, eax
ja 0x1058ae2
je 0x1058a00
sub esi, 0x1a5
je 0x10589d6
dec esi
je 0x10589c2
dec esi
jne 0x105888f
jmp 0x10589b1
je 0x105870f
sub esi, 0x130
je 0x103a22b
dec esi
jne 0x1047b4b
jmp 0x10586dc
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [0x10b10f4]
cmp eax, ecx
jne 0x103b235
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
jmp 0x1047b57
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
mov edi, 0xf3
push edi
push dword [ebx + 0xb10]
call esi
push 0
push 0
push edi
push dword [ebx + 0xb10]
call esi
jmp 0x10371fe
call fcn.010511a9
jmp 0x10371fe
cmp esi, 0x195
jbe 0x1058745
cmp esi, 0x197
jne 0x10371fe
xor eax, eax
cmp dword [0x10b10f8], eax
push 1
sete al
push eax
call fcn.01009aab
jmp 0x10371fe
call fcn.010482a2
test eax, eax
je 0x10371fe
cmp esi, 0x193
jne 0x1058761
mov eax, 0x217
jmp 0x1058773
xor eax, eax
cmp esi, 0x194
setne al
lea eax, [eax + eax + 0x218]
push eax
mov ecx, ebx
call fcn.010513f3
push 1
xor edi, edi
push edi
push 3
push edi
mov ecx, ebx
call fcn.0100309d
push edi
push edi
push edi
cmp esi, 0x193
jne 0x10587a5
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CascadeWindows]
jmp 0x10587be
xor eax, eax
cmp esi, 0x194
setne al
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TileWindows]
push edi
push 0x1f4
push 0x12
push dword [ebx + 4]
mov dword [ebx + 0xc70], edi
call dword [sym.imp.USER32.dll_SetTimer]
push edi
push edi
push 3
push edi
mov ecx, ebx
call fcn.0100309d
jmp 0x10371fe
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
mov byte [0x10b3a90], 1
call fcn.01071031
push dword [0x10b10ec]
call dword [sym.imp.SHELL32.dll_Ordinal_54]
jmp 0x10371fe
dec esi
je 0x105886c
dec esi
dec esi
je 0x1058856
dec esi
dec esi
je 0x105884a
dec esi
je 0x105883e
sub esi, 3
jne 0x10371fe
push 1
push 0x1f5
call fcn.01050e43
jmp 0x10371fe
push 0
call fcn.01071785
jmp 0x10371fe
push 0
call fcn.010512cf
jmp 0x10371fe
cmp dword [ebp + 0xc], 0
je 0x1058860
push 8
jmp 0x1058862
push 1
call fcn.01042b24
jmp 0x10371fe
call fcn.0107072a
jmp 0x10371fe
push 0
push 0x2001
push 0
push 0x10702fd
call dword [sym.imp.SHLWAPI.dll_SHCreateThread]
jmp 0x10371fe
dec esi
jne 0x104d0c4
jmp 0x10588cf
sub esi, 3
jne 0x10371fe
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0xc]
mov ecx, ebx
push esi
push dword [0x10b10ec]
mov byte [0x10b3a90], 1
call fcn.0107147a
jmp 0x10371fe
cmp dword [0x10b24cc], 0
mov edi, 0x10000
mov esi, SHChangeNotifyRegister
je 0x1058935
mov al, byte [0x10b24d0]
cmp al, 4
jae 0x10588ef
test al, al
jne 0x1058935
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x1058935
mov eax, dword [0x10b24c0]
mov edx, dword [0x10b24c4]
mov ecx, eax
and ecx, edi
and edx, esi
cmp ecx, eax
jne 0x1058935
cmp edx, dword [0x10b24c4]
jne 0x1058935
push 0x1058c70
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
push 2
mov ecx, ebx
call fcn.01071860
cmp dword [0x10b24cc], 0
je 0x10371fe
mov al, byte [0x10b24d0]
cmp al, 4
jae 0x105895c
test al, al
jne 0x10371fe
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x10371fe
mov eax, dword [0x10b24c0]
mov ecx, eax
and ecx, edi
mov edi, dword [0x10b24c4]
mov edx, edi
and edx, esi
cmp ecx, eax
jne 0x10371fe
cmp edx, edi
jne 0x10371fe
push 0x1058c80
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
jmp 0x10371fe
call fcn.01070de5
mov ecx, eax
call fcn.01073619
jmp 0x10371fe
push dword [ebp + 0xc]
call fcn.01070de5
mov ecx, eax
call fcn.01073519
jmp 0x10371fe
push 4
call fcn.01042b24
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
inc eax
lea ecx, [ebp - 8]
push ecx
push eax
push 0x1121
push 0
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
call sub.ntdll.dll_WinSqmAddToStream
jmp 0x10371fe
cmp dword [0x10b24cc], 0
je 0x1058aca
mov dl, byte [0x10b24d0]
mov esi, SHChangeNotifyRegister
mov edi, 0x400000
cmp dl, 4
jae 0x1058a26
test dl, dl
jne 0x1058a73
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x1058a73
mov ebx, dword [0x10b24c0]
mov ecx, dword [0x10b24c4]
mov eax, ebx
and eax, edi
and ecx, esi
cmp eax, ebx
jne 0x1058a73
cmp ecx, dword [0x10b24c4]
jne 0x1058a73
push 0x1068bf0
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
mov dl, byte [0x10b24d0]
cmp dword [0x10b24cc], 0
je 0x1058aca
cmp dl, 4
jae 0x1058a85
test dl, dl
jne 0x1058aca
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x1058aca
mov edx, dword [0x10b24c0]
mov eax, edx
and eax, edi
mov edi, dword [0x10b24c4]
mov ecx, edi
and ecx, esi
cmp eax, edx
jne 0x1058aca
cmp ecx, edi
jne 0x1058aca
push 0x1068be0
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
call fcn.010707f9
test eax, eax
je 0x10371fe
call dword [sym.imp.USER32.dll_LockWorkStation]
jmp 0x10371fe
sub esi, 0x1388
je 0x1058c48
dec esi
je 0x1058c25
sub esi, 0x8ca7
je 0x1058b36
sub esi, 0x35
je 0x1058b2c
sub esi, 0x20
je 0x1058b1b
dec esi
jne 0x10371fe
push esi
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_91]
jmp 0x10371fe
push 0
push 0
push dword [ebx + 4]
call sub.SHELL32.dll_Ordinal_886
jmp 0x10371fe
call fcn.01053c74
jmp 0x10371fe
and dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x100
mov dword [ebp - 0x1c], 9
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x414
push dword [ebx + 0xc04]
mov esi, eax
call edi
push 0
push 0x10002
push 0x128
push dword [ebx + 4]
mov dword [ebp + 0xc], eax
call edi
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov edi, ecx
test esi, esi
je 0x1058c02
push esi
push dword [ebx + 0xb10]
call fcn.0100e838
test eax, eax
je 0x1058bc2
test edi, edi
jne 0x1058bdd
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebx + 0x3c]
call dword [sym.imp.SHLWAPI.dll_Ordinal_479]
jmp 0x10371fe
cmp esi, dword [ebp + 0xc]
jne 0x1058be7
test edi, edi
je 0x1058bdd
mov ecx, ebx
push dword [ebx + 0xc04]
call fcn.0103a0df
jmp 0x10371fe
call fcn.010701a1
jmp 0x10371fe
push esi
push dword [ebx + 0xc04]
call fcn.0100e838
test eax, eax
je 0x1058c02
test edi, edi
jne 0x1058bae
push dword [ebp + 0xc]
mov ecx, ebx
jmp 0x1058bd3
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0x3c]
call dword [sym.imp.SHLWAPI.dll_Ordinal_478]
test eax, eax
je 0x10371fe
mov ecx, ebx
test edi, edi
je 0x1058bcd
push dword [ebx + 0xb10]
jmp 0x1058bd3
push 3
call dword [sym.imp.SHLWAPI.dll_Ordinal_413]
test eax, eax
je 0x10371fe
xor eax, eax
push eax
push eax
push 0xd
push 0xffffffffffffffff
push eax
call sub.WINSTA.dll_WinStationSetInformationW
jmp 0x10371fe
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x10b10ec]
call dword [sym.imp.SHELL32.dll_Ordinal_254]
jmp 0x10371fe