Function at 0x10001300
Capabilities:
Log keystrokes via application hook
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10002d88
mov eax, dword fs:[0]
push eax
sub esp, 0x650
mov eax, dword [0x1000401c]
xor eax, esp
mov dword [esp + 0x648], eax
push ebx
push esi
push edi
mov eax, dword [0x1000401c]
xor eax, esp
push eax
lea eax, [esp + 0x660]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [0x10004428], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
sub eax, edi
je 0x100015b2
sub eax, 1
jne 0x100015dc
lea esi, [edi + 5]
mov ebx, 0x4cda7d
call fcn.10001db0
push 0x10001950
mov cl, 0xe8
mov esi, ebx
call fcn.10001e90
add esp, 4
lea esi, [edi + 6]
mov ebx, 0x52d8f2
call fcn.10001db0
push 0x10001860
mov cl, 0xe9
mov esi, ebx
call fcn.10001e90
add esp, 4
lea esi, [esp + 0x1c]
call fcn.10001100
push 0x200
lea ecx, [esp + 0x458]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, edi
je 0x10001481
lea edx, [esp + 0x454]
push edx
lea ecx, [esp + 0x43c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [esp + 0x668], edi
mov eax, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, dword [eax]
push ecx
push 0x1000319c
lea ecx, [esp + 0x440]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_last_of_char_const___unsigned_int_const]
mov edx, dword [esp + 0x44c]
push edx
inc eax
push eax
lea eax, [esp + 0x424]
push eax
lea ecx, [esp + 0x444]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
mov eax, dword [esp + 0x434]
mov edx, dword [esp + 0x420]
mov esi, edx
cmp eax, 0x10
jae 0x10001430
lea esi, [esp + 0x420]
mov ecx, 7
mov edi, str.main.exe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp eax, 0x10
movsb byte es:[edi], byte [esi]
mov eax, edx
jae 0x1000144d
lea eax, [esp + 0x420]
push eax
lea edi, [esp + 0x20]
call fcn.10001250
lea ecx, [esp + 0x41c]
mov dword [0x10006b78], eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x438]
mov dword [esp + 0x668], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ebx, 0x10006b7c
mov esi, str.DarksTeam.dll
jmp 0x10001490
push esi
lea edi, [esp + 0x20]
call fcn.10001250
mov dword [ebx], eax
add esi, 0x1f
add ebx, 4
cmp esi, 0x100040d4
jl 0x10001490
push str.1.1.1.1
push 0x10
push 0x10006b68
call dword [sym.imp.MSVCR90.dll_strcpy_s]
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x34], esp
push str._getip.php
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.getip.mubz.bg
mov dword [esp + 0x6a4], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [esp + 0x6a0], 0xffffffff
call fcn.10001f20
mov ecx, dword [0x10004428]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add esp, 0x38
mov dword [0x100040e0], ecx
call esi
mov edx, dword [0x100040e0]
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push edx
push 0x10001020
push 2
call edi
mov dword [0x100040e4], eax
call esi
push eax
mov eax, dword [0x100040e0]
push eax
push 0x10001040
push 7
call edi
mov esi, 7
mov ebx, 0x5392d8
mov dword [0x100040e8], eax
call fcn.10001db0
push 0x10001890
mov cl, 0xe9
mov esi, ebx
call fcn.10001e90
add esp, 4
mov esi, 7
mov ebx, 0x55c6f5
call fcn.10001db0
push 0x100018d0
mov cl, 0xe9
mov esi, ebx
call fcn.10001e90
add esp, 4
mov esi, 7
mov ebx, 0x5663ca
call fcn.10001db0
push 0x10001910
mov cl, 0xe9
mov esi, ebx
call fcn.10001e90
add esp, 4
mov byte [0x585ae9], 0xda
jmp 0x100015dc
mov eax, dword [0x100040e4]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp eax, edi
je 0x100015ca
push eax
call esi
mov dword [0x100040e4], edi
mov eax, dword [0x100040e8]
cmp eax, edi
je 0x100015dc
push eax
call esi
mov dword [0x100040e8], edi
mov eax, 1
mov ecx, dword [esp + 0x660]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x648]
xor ecx, esp
call fcn.10002375
mov esp, ebp
pop ebp
ret 0xc