Function at 0x1001df70
Capabilities:
Log keystrokes via polling
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push edi
mov edi, ecx
cmp ebx, 4
jne 0x1001df9b
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1001dfe9
jmp 0x1001e0e8
test ebx, 0x20000
je 0x1001dfe4
lea eax, [ebp + 8]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftwindowsCurrentVersionWindowsUpdateOrchestratorInstallAtShutdown
push reloc.SHELL32.dll_SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001dfe4
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, 0x14
je 0x1001e065
lea eax, [ebp - 0x18]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp ebx, 0x10
jne 0x1001e009
mov ecx, dword [edi]
push 0
push 0
push ebx
mov eax, dword [ecx]
call dword [eax]
push eax
call esi
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0x10054a5c
push 3
push 0
push 0x1004ef58
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, dword [ebp + 8]
test esi, esi
je 0x1001e05f
mov ecx, dword [0x1005e0dc]
lea eax, [ebp - 0x18]
mov edi, dword [esi]
push eax
mov eax, dword [ecx]
call dword [eax]
push eax
push ebx
push esi
call dword [edi + 0x14]
mov eax, dword [ebp + 8]
test eax, eax
je 0x1001e1d7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
cmp ebx, 0x100
jne 0x1001e0e0
push 0
lea eax, [ebp + 8]
mov dword [ebp - 8], 1
push eax
push 0
push 2
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationLogonUIUserSwitch
push reloc.SHELL32.dll_SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.Enabled
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi + 0x2c], 0
je 0x1001e127
cmp ebx, 2
jne 0x1001e127
mov ecx, dword [edi]
push 0
mov eax, dword [ecx]
call dword [eax]
mov edx, str.SlideToShutdown.exe
mov ecx, eax
call fcn.10019010
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ebx, 0x2000000
jne 0x1001e0b5
push str.RtlAdjustPrivilege
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp + 0xb]
push ecx
push 0
push 1
push 0x13
call eax
push 0
push 0x404
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1001cef0
test eax, eax
je 0x1001e148
cmp ebx, 1
jne 0x1001e148
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi]
push 0
push 0
push 0x10
mov eax, dword [ecx]
call dword [eax]
push eax
call esi
cmp ebx, 0x10
jne 0x1001e174
push 0
push 0
push 0x1001df50
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ebx, 0x40
jne 0x1001e191
push 0
push 1
push 0x1001df50
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0x1fa
cmp ebx, 0x80
jne 0x1001e1a5
mov eax, 0x1388
jmp 0x1001e1c8
cmp ebx, 0x100
je 0x1001e19e
cmp ebx, 0x200
jne 0x1001e1ba
lea eax, [ebx + 5]
jmp 0x1001e1c8
cmp ebx, 0x400
mov ecx, 0x19a
cmove eax, ecx
push ebx
push eax
push 0x111
push dword [0x1005dc0c]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4