Function at 0x1035783
Capabilities:
Create process on windows
Lock the desktop
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x1a3
push edi
mov ebx, ecx
cmp esi, eax
ja 0x104fae8
je 0x10550ca
add eax, 0xfffffff4
cmp esi, eax
ja 0x1047a85
je 0x105504c
cmp esi, 0x130
je 0x1038f39
cmp esi, 0x131
je 0x1055019
cmp esi, 0x132
je 0x1039eb2
cmp esi, 0x191
je 0x1047aab
mov eax, 0x192
cmp esi, eax
je 0x1054fc9
ja 0x1054f1c
pop edi
pop esi
pop ebx
leave
ret 8
push 0
push 0x132
push 0x111
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x10357fa
call fcn.01038e0b
mov eax, dword [0x10b10f0]
test eax, eax
je 0x1039edd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1039edd
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x10b10f0]
je 0x1054ff9
lea ecx, [ebx + 0xaf8]
call fcn.0103588e
test eax, eax
je 0x10357fa
push dword [ebx + 0xb10]
mov ecx, ebx
call fcn.01038ded
mov ecx, ebx
call fcn.01039f0e
jmp 0x10357fa
sub esi, 0x198
jne 0x1055064
push 1
xor eax, eax
push eax
push eax
push 0x1047acc
push eax
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10357fa
call fcn.0104e589
jmp 0x10357fa
test eax, eax
je 0x1039edd
jmp 0x10357fa
call fcn.010792be
jmp 0x10357fa
mov eax, 0x1388
cmp esi, eax
ja 0x105532b
je 0x1055309
sub esi, 0x1a4
je 0x1047ac2
dec esi
je 0x10552df
sub esi, 3
je 0x10551fd
sub esi, 0x4f
jne 0x10550db
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp + 8]
push eax
push 0x104fba4
push 0x17
push esi
push 0x104fbb4
mov dword [ebp + 8], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x104fb6e
push 0x104fb8c
lea ecx, [ebp + 0xc]
call fcn.0104fbc9
cmp dword [ebp + 0xc], esi
je 0x104fb65
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x10357fa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10357fa
cmp esi, 0x195
ja 0x10357fa
call fcn.01048242
test eax, eax
je 0x10357fa
cmp esi, 0x193
jne 0x1054f44
mov eax, 0x217
jmp 0x1054f56
xor eax, eax
cmp esi, 0x194
setne al
lea eax, [eax + eax + 0x218]
push eax
mov ecx, ebx
call fcn.0104ecbe
push 1
xor edi, edi
push edi
push 3
push edi
mov ecx, ebx
call fcn.01002fe4
push edi
push edi
push edi
cmp esi, 0x193
jne 0x1054f88
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CascadeWindows]
jmp 0x1054fa1
xor eax, eax
cmp esi, 0x194
setne al
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TileWindows]
push edi
push 0x1f4
push 0x12
push dword [ebx + 4]
mov dword [ebx + 0xc70], edi
call dword [sym.imp.USER32.dll_SetTimer]
push edi
push edi
push 3
push edi
mov ecx, ebx
call fcn.01002fe4
jmp 0x10357fa
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
mov byte [0x10b37f8], 1
call fcn.0106ed57
push dword [0x10b10e8]
call dword [sym.imp.SHELL32.dll_Ordinal_54]
jmp 0x10357fa
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [0x10b10f0]
cmp eax, ecx
jne 0x1039edd
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
jmp 0x1047ab5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
mov edi, 0xf3
push edi
push dword [ebx + 0xb10]
call esi
push 0
push 0
push edi
push dword [ebx + 0xb10]
call esi
jmp 0x10357fa
xor eax, eax
cmp dword [0x10b10f4], eax
push 1
sete al
push eax
call fcn.010078f4
jmp 0x10357fa
dec esi
dec esi
je 0x10550b1
dec esi
je 0x10550a7
dec esi
dec esi
je 0x1055091
dec esi
dec esi
je 0x1055085
dec esi
jne 0x10357fa
push esi
call fcn.0106f4a5
jmp 0x10357fa
push 0
call fcn.0104ec7d
jmp 0x10357fa
cmp dword [ebp + 0xc], 0
je 0x105509b
push 8
jmp 0x105509d
push 1
call fcn.0104266c
jmp 0x10357fa
call fcn.0106e61a
jmp 0x10357fa
push 0
push 0x2001
push 0
push 0x106e1ed
call dword [sym.imp.SHLWAPI.dll_SHCreateThread]
jmp 0x10357fa
push 1
push 0x1f5
call fcn.0104e223
jmp 0x10357fa
sub esi, 3
je 0x10551ce
sub esi, 0xb
jne 0x10357fa
cmp dword [0x10b21ec], esi
je 0x10551b6
mov dl, byte [0x10b21f0]
mov edi, 0x400000
mov esi, 0x80000000
cmp dl, 4
jae 0x1055112
test dl, dl
jne 0x105515f
mov eax, dword [0x10b21d8]
mov ecx, dword [0x10b21dc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x105515f
mov ebx, dword [0x10b21e0]
mov ecx, dword [0x10b21e4]
mov eax, ebx
and eax, edi
and ecx, esi
cmp eax, ebx
jne 0x105515f
cmp ecx, dword [0x10b21e4]
jne 0x105515f
push 0x1065b78
push dword [0x10b219c]
push dword [0x10b2198]
call fcn.010127a5
mov dl, byte [0x10b21f0]
cmp dword [0x10b21ec], 0
je 0x10551b6
cmp dl, 4
jae 0x1055171
test dl, dl
jne 0x10551b6
mov eax, dword [0x10b21d8]
mov ecx, dword [0x10b21dc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x10551b6
mov edx, dword [0x10b21e0]
mov eax, edx
and eax, edi
mov edi, dword [0x10b21e4]
mov ecx, edi
and ecx, esi
cmp eax, edx
jne 0x10551b6
cmp ecx, edi
jne 0x10551b6
push 0x1065b68
push dword [0x10b219c]
push dword [0x10b2198]
call fcn.010127a5
call fcn.0106e6e9
test eax, eax
je 0x10357fa
call dword [sym.imp.USER32.dll_LockWorkStation]
jmp 0x10357fa
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0xc]
mov ecx, ebx
push 0
push dword [0x10b10e8]
mov byte [0x10b37f8], 1
call fcn.0106f1a0
jmp 0x10357fa
cmp dword [0x10b21ec], 0
mov esi, 0x80000000
mov edi, 0x10000
je 0x1055263
mov al, byte [0x10b21f0]
cmp al, 4
jae 0x105521d
test al, al
jne 0x1055263
mov eax, dword [0x10b21d8]
mov ecx, dword [0x10b21dc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x1055263
mov eax, dword [0x10b21e0]
mov edx, dword [0x10b21e4]
mov ecx, eax
and ecx, edi
and edx, esi
cmp ecx, eax
jne 0x1055263
cmp edx, dword [0x10b21e4]
jne 0x1055263
push 0x1055488
push dword [0x10b219c]
push dword [0x10b2198]
call fcn.010127a5
push 2
mov ecx, ebx
call fcn.0106f580
cmp dword [0x10b21ec], 0
je 0x10357fa
mov al, byte [0x10b21f0]
cmp al, 4
jae 0x105528a
test al, al
jne 0x10357fa
mov eax, dword [0x10b21d8]
mov ecx, dword [0x10b21dc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x10357fa
mov eax, dword [0x10b21e0]
mov ecx, eax
and ecx, edi
mov edi, dword [0x10b21e4]
mov edx, edi
and edx, esi
cmp ecx, eax
jne 0x10357fa
cmp edx, edi
jne 0x10357fa
push 0x1055498
push dword [0x10b219c]
push dword [0x10b2198]
call fcn.010127a5
jmp 0x10357fa
push 4
call fcn.0104266c
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
inc eax
lea ecx, [ebp - 8]
push ecx
push eax
push 0x1121
push 0
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
call sub.ntdll.dll_WinSqmAddToStream
jmp 0x10357fa
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x10b10e8]
call dword [sym.imp.SHELL32.dll_Ordinal_254]
jmp 0x10357fa
sub esi, 0x1389
je 0x1055460
sub esi, 0x8ca7
je 0x1055371
sub esi, 0x35
je 0x1055367
sub esi, 0x20
je 0x105535d
dec esi
jne 0x10357fa
push esi
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_91]
jmp 0x10357fa
call fcn.0106e064
jmp 0x10357fa
call fcn.0104d11f
jmp 0x10357fa
and dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x100
mov dword [ebp - 0x1c], 9
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x414
push dword [ebx + 0xc04]
mov esi, eax
call edi
push 0
push 0x10002
push 0x128
push dword [ebx + 4]
mov dword [ebp + 0xc], eax
call edi
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov edi, ecx
test esi, esi
je 0x105543d
push esi
push dword [ebx + 0xb10]
call fcn.01011bee
test eax, eax
je 0x10553fd
test edi, edi
jne 0x1055418
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebx + 0x3c]
call dword [sym.imp.SHLWAPI.dll_Ordinal_479]
jmp 0x10357fa
cmp esi, dword [ebp + 0xc]
jne 0x1055422
test edi, edi
je 0x1055418
mov ecx, ebx
push dword [ebx + 0xc04]
call fcn.01038ded
jmp 0x10357fa
call fcn.0106e03d
jmp 0x10357fa
push esi
push dword [ebx + 0xc04]
call fcn.01011bee
test eax, eax
je 0x105543d
test edi, edi
jne 0x10553e9
push dword [ebp + 0xc]
mov ecx, ebx
jmp 0x105540e
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0x3c]
call dword [sym.imp.SHLWAPI.dll_Ordinal_478]
test eax, eax
je 0x10357fa
mov ecx, ebx
test edi, edi
je 0x1055408
push dword [ebx + 0xb10]
jmp 0x105540e
push 3
call dword [sym.imp.SHLWAPI.dll_Ordinal_413]
test eax, eax
je 0x10357fa
xor eax, eax
push eax
push eax
push 0xd
push 0xffffffffffffffff
push eax
call sub.WINSTA.dll_WinStationSetInformationW
jmp 0x10357fa