Function at 0x1001ea36
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x10052821
call fcn.10037f36
xor eax, eax
xor edi, edi
push 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
pop ebx
cmp dword [0x1006a458], eax
je 0x1001ecbd
cmp byte [0x10069c46], al
je 0x1001ea9b
mov ecx, dword [0x10069c30]
mov edi, dword [0x10069c34]
mov dword [ebp - 0x24], ecx
mov ecx, dword [0x10069c38]
mov dword [ebp - 0x18], ecx
mov ecx, dword [0x10069c3c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [0x10069c40]
mov dword [ebp - 0x20], ecx
jmp 0x1001ec33
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
and dword [ebp - 0x14], edi
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
push 0x10056838
push ebx
push 0
push 0x10056858
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1001eb06
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001eb06
and dword [ebp - 0x10], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
call dword [ecx + 0x38]
test eax, eax
jne 0x1001eb06
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], esi
test al, 1
je 0x1001eb06
mov ecx, eax
and ecx, ebx
mov dword [ebp - 0x18], ecx
mov edi, eax
mov ecx, eax
and ecx, 8
and edi, 2
and eax, 0x40
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1001e586
cmp dword [ebp - 0x28], 0
jne 0x1001ec31
xor eax, eax
cmp dword [0x10069bcc], eax
jne 0x1001eb5d
push 0x10069bcc
push esi
push eax
push str.SoftwareDownloadManagerSpecialKeys
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001eb4e
and dword [0x10069bcc], 0
cmp dword [0x10069bcc], 0
je 0x1001ec31
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push eax
push str.UseKeyToPrevent
push dword [0x10069bcc]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x1001ecc5
mov eax, dword [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x1001ecc5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push str.AltP
push dword [0x10069bcc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x1001ebbf
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.ShiftP
push dword [0x10069bcc]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x1001ebe5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.CtrlP
push dword [0x10069bcc]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x1001ec0b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.DelP
push dword [0x10069bcc]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x1001ec31
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1001ecc5
cmp edi, eax
jne 0x1001ec4f
cmp dword [ebp - 0x18], eax
jne 0x1001ec4f
cmp dword [ebp - 0x1c], eax
jne 0x1001ec4f
cmp dword [ebp - 0x20], eax
je 0x1001ecc5
xor esi, esi
and dword [ebp - 0x14], esi
test edi, edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0x8000
je 0x1001ec76
push 0x12
inc esi
call edi
mov ecx, ebx
test cx, ax
je 0x1001ec76
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x18], 0
je 0x1001ec8b
push 0x10
inc esi
call edi
mov ecx, ebx
test cx, ax
je 0x1001ec8b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x1c], 0
je 0x1001eca0
push 0x11
inc esi
call edi
mov ecx, ebx
test cx, ax
je 0x1001eca0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x20], 0
je 0x1001ecb3
push 0x2e
inc esi
call edi
test bx, ax
je 0x1001ecb3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jne 0x1001ecc5
xor eax, eax
inc eax
jmp 0x1001ecc7
xor esi, esi
inc esi
jmp 0x1001eb24
xor eax, eax
call fcn.1003800e
ret