Function at 0x1001c7a0
Capabilities:
Create thread
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f7d30
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x10158be8]
call fcn.100b1d00
mov ecx, dword [0x10158bec]
mov dword [0x10158be8], 0
call fcn.100b1d00
mov ecx, dword [0x10158bf0]
mov dword [0x10158bec], 0
call fcn.100b1d00
mov ecx, dword [0x10158c20]
mov dword [0x10158bf0], 0
call fcn.100b1d00
mov ecx, dword [0x10158c24]
mov dword [0x10158c20], 0
call fcn.100b1d00
mov ecx, dword [0x10158c28]
mov dword [0x10158c24], 0
call fcn.100b1d00
mov ecx, dword [0x10158c2c]
mov dword [0x10158c28], 0
call fcn.100b1d00
mov ecx, dword [0x10158c30]
mov dword [0x10158c2c], 0
call fcn.100b1d00
mov ecx, dword [0x10158c34]
mov dword [0x10158c30], 0
call fcn.100b1d00
mov ecx, dword [0x10158c38]
mov dword [0x10158c34], 0
call fcn.100b1d00
mov ecx, dword [0x10158c40]
mov dword [0x10158c38], 0
call fcn.100b1d00
mov dword [0x10158c40], 0
call fcn.1007b3b0
call fcn.1002a730
mov ecx, 0x1014c170
call fcn.1009cce0
mov ecx, dword [0x10158d2c]
call fcn.100b1d00
mov dword [0x10158d2c], 0
call fcn.100b1ad0
mov eax, dword [0x1013e7ec]
mov esi, dword [sym.imp.USER32.dll_DestroyWindow]
test eax, eax
je 0x1001c8f2
push eax
call esi
mov eax, dword [0x10148a7c]
test eax, eax
je 0x1001c8fe
push eax
call esi
call fcn.1005fab0
mov eax, dword [0x1014e8d0]
cmp eax, dword [0x1014e8d4]
je 0x1001c930
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [eax]
push 0
push 0
push 0x10
push dword [eax + 4]
call esi
mov eax, dword [0x1014e8d0]
cmp eax, dword [0x1014e8d4]
jne 0x1001c916
cmp dword [0x1014be58], 0
je 0x1001c982
push dword [0x10158af4]
call dword [sym.imp.ole32.dll_RevokeDragDrop]
mov eax, dword [0x1014be58]
test eax, eax
je 0x1001c982
push eax
push dword [0x10158af4]
call dword [sym.imp.ole32.dll_RegisterDragDrop]
mov eax, dword [0x1014be58]
test eax, eax
je 0x1001c982
mov dword [0x1014be58], 0
mov dword [ebp - 4], 1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov ecx, 2
call fcn.100162e0
push str.StartHookWindow
push str.WP_OpenShellMenu.CStartHookWindow
call dword [sym.imp.USER32.dll_FindWindowW]
push dword [0x10158b48]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [ebp - 0x24], eax
call esi
push dword [0x10158b4c]
call esi
mov ecx, dword [0x10158b50]
test ecx, ecx
je 0x1001c9c2
push ecx
call esi
mov eax, dword [0x10158b54]
mov dword [0x10158b50], 0
test eax, eax
je 0x1001c9d8
push eax
call esi
mov eax, dword [0x10158b58]
mov dword [0x10158b54], 0
test eax, eax
je 0x1001c9ee
push eax
call esi
mov eax, dword [0x1014be5c]
mov dword [0x10158b58], 0
test eax, eax
je 0x1001ca34
push dword [0x10158be4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [0x1014be5c]
test eax, eax
je 0x1001ca34
mov dword [0x1014be5c], 0
mov dword [ebp - 4], 3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.10015090
xor ecx, ecx
call fcn.100197e0
mov edi, dword [0x1014be48]
mov ebx, dword [sym.imp.COMCTL32.dll_RemoveWindowSubclass]
mov dword [0x10158af4], 0
mov esi, dword [edi]
cmp esi, edi
je 0x1001cc3e
mov eax, dword [esi + 0x24]
mov edi, 0xa00
test eax, eax
je 0x1001ca79
push 0x434c5348
push 0x10018f10
push eax
call ebx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1001ca8d
push 0x434c5348
push 0x10018d50
push eax
call ebx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1001cb1a
push 0x434c5348
push 0x10016bf0
push eax
call ebx
mov cx, word [0x10159320]
test cx, cx
jne 0x1001cad0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
movzx eax, al
shr ecx, 8
movzx ecx, cl
shl ax, 8
or cx, ax
mov word [0x10159320], cx
cmp cx, di
jae 0x1001cb00
mov ecx, dword [esi + 0x18]
xor edx, edx
push 0
push 0
call fcn.100147d0
add esp, 8
cmp eax, 3
jne 0x1001cb00
push 5
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [esi + 0x20]
call dword [sym.imp.ole32.dll_RevokeDragDrop]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x1001cb1a
push eax
push dword [esi + 0x20]
call dword [sym.imp.ole32.dll_RegisterDragDrop]
cmp byte [0x10158b9c], 0
jne 0x1001cb32
push 0x434c5348
push 0x10017d90
push dword [esi + 0x18]
call ebx
mov edi, dword [esi + 0x50]
cmp edi, dword [esi + 0x54]
je 0x1001cb56
nop word [eax + eax]
push 0x434c5348
push 0x10017c60
push dword [edi]
call ebx
add edi, 4
cmp edi, dword [esi + 0x54]
jne 0x1001cb40
mov edi, dword [esi + 0x5c]
cmp edi, dword [esi + 0x60]
je 0x1001cb76
nop
push 0x434c5348
push 0x100190c0
push dword [edi]
call ebx
add edi, 4
cmp edi, dword [esi + 0x60]
jne 0x1001cb60
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x1001cb8a
push 0x434c5348
push 0x10018e50
push eax
call ebx
mov eax, dword [esi + 0x30]
test eax, eax
je 0x1001cb9e
push 0x434c5348
push 0x10018eb0
push eax
call ebx
cmp byte [esi + 0x48], 0
je 0x1001cbb2
push 0x434c534d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
movzx ecx, ax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push 0
push 5
push dword [esi + 0x18]
call edi
push 0
push 0
push 0x31a
push dword [esi + 0x18]
call edi
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x1001cc1a
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1001cc16
cmp esi, dword [eax + 8]
jne 0x1001cc16
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x1001cc06
mov esi, eax
jmp 0x1001cc30
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x1001cc30
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x1001cc24
mov edi, dword [0x1014be48]
cmp esi, edi
jne 0x1001ca60
mov dword [ebp - 4], 4
push dword [edi + 4]
call fcn.1001fd20
cmp dword [0x1014b4b0], 0
mov eax, dword [0x1014be48]
mov dword [eax + 4], edi
mov eax, dword [0x1014be48]
mov dword [eax], edi
mov eax, dword [0x1014be48]
mov dword [eax + 8], edi
mov dword [0x1014be4c], 0
je 0x1001ccad
push 0x434c5348
push 0x10016e50
push dword [0x1014b4a4]
call ebx
push 0x434c5348
push 0x10016ef0
push dword [0x1014b4b0]
call ebx
push 0x434c5348
push 0x10017240
push dword [0x1014b4ac]
call ebx
cmp byte [0x10158b33], 0
je 0x1001ccc5
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov byte [0x10158b33], 0
push 0
push 0
push dword [ebp - 0x24]
push 0x1001c760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret