Function at 0x1000a360
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100151bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x190
mov dword [ebp - 0x10], ecx
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xf8]
push ecx
push 0x100018a0
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xfc], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xfc], 0
jne 0x1000a502
push 1
lea ecx, [ebp - 0x19c]
call fcn.10006980
mov dword [ebp - 4], 0
push str.Failed_to_set_WH_GETMESSAGE_hook__0x
lea ecx, [ebp - 0x19c]
push ecx
call fcn.10001dd0
add esp, 8
mov dword [ebp - 0x18], eax
push 0x1000eba0
mov ecx, dword [ebp - 0x18]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x10016b50
push eax
call fcn.10001dd0
add esp, 8
push 1
lea ecx, [ebp - 0x104]
call fcn.10006980
mov byte [ebp - 4], 1
push 0x10016b94
lea eax, [ebp - 0x104]
push eax
call fcn.10001dd0
add esp, 8
push str.CFsImplant::Install
push eax
call fcn.10001dd0
add esp, 8
push 0x10016b7c
push eax
call fcn.10001dd0
add esp, 8
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x19c]
call fcn.10010ba0
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call fcn.10001d90
add esp, 8
mov dword [ebp - 0x34], eax
push 0x10005680
mov ecx, dword [ebp - 0x34]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.100081f0
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x104]
call fcn.10010ba0
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x3c]
call fcn.1000dfe0
push eax
call fcn.1000e300
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6c]
call fcn.100081f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x104]
call fcn.10009490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.10009490
jmp 0x1000a513
push 0
push 0
push 0
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0xfc], 0
je 0x1000a528
mov dword [ebp - 0x14], 1
jmp 0x1000a52f
mov dword [ebp - 0x14], 0
movzx eax, byte [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret