Function at 0x40d0c0
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56cc75
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x410], 0
sub eax, 2
je 0x40d856
sub eax, 0x10e
je 0x40d18f
sub eax, 1
je 0x40d120
xor eax, eax
jmp 0x40d85b
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40d856
cmp eax, 2
jbe 0x40d17f
cmp eax, 0x6d8
jne 0x40d856
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x100
test cx, ax
je 0x40d856
mov eax, dword [ebx + 0x30]
dec eax
push eax
push 0
push 0xb1
push 0x6d7
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push dword [ebx + 0xc]
lea eax, [ebx + 0x20]
push eax
call fcn.00426ea0
add esp, 8
jmp 0x40d856
push 0
push 0
mov ecx, ebx
call fcn.004e92f0
jmp 0x40d856
call fcn.0040baa0
push 0x10
lea edi, [ebx + 0x20]
mov esi, eax
push 0x58805c
mov ecx, edi
call fcn.00406c80
mov al, byte [esi + 0x231e1]
mov edx, str.____64_bit_
test al, al
jne 0x40d1bb
mov edx, str.____32_bit_
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d1c0
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00406760
push 2
push 0x5878a4
mov ecx, edi
call fcn.00406760
push 0xd
push str.Build_time_:
mov ecx, edi
call fcn.00406760
xor eax, eax
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x3d8], 0
mov dword [ebp - 0x3d8], 7
mov dword [ebp - 0x3dc], 0
mov word [ebp - 0x3ec], ax
mov dword [ebp - 4], eax
call fcn.0040b9e0
push 0
push 0
push 0xffffffffffffffff
push 0
push str.Apr_21_2020
mov ecx, eax
mov dword [ebp - 0x418], eax
call fcn.00424360
mov edx, eax
cmp word [edx], 0
jne 0x40d253
xor ecx, ecx
jmp 0x40d26f
mov ecx, edx
lea esi, [ecx + 2]
jmp 0x40d260
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d260
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3ec]
call fcn.00406760
push 3
push 0x587aa8
lea ecx, [ebp - 0x3ec]
call fcn.00406760
mov ecx, dword [ebp - 0x418]
push 0
push 0
push 0xffffffffffffffff
push 0
push str.15:17:06
call fcn.00424360
mov edx, eax
cmp word [edx], 0
jne 0x40d2b2
xor ecx, ecx
jmp 0x40d2c6
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d2b7
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3ec]
call fcn.00406760
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3ec]
mov ecx, edi
push eax
call fcn.00406650
push 2
push 0x5878a4
mov ecx, edi
call fcn.00406760
push 7
push str.Path_:
mov ecx, edi
call fcn.00406760
push 0x104
lea eax, [ebp - 0x3bc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [ebp - 0x3bc], 0
jne 0x40d323
xor ecx, ecx
jmp 0x40d33f
lea ecx, [ebp - 0x3bc]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d330
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x3bc]
mov ecx, edi
push eax
call fcn.00406760
push 2
push 0x5878a4
mov ecx, edi
call fcn.00406760
push 0xd
push str.Admin_mode_:
mov ecx, edi
call fcn.00406760
cmp byte [ebx + 0x38], 0
mov edx, 0x5880dc
jne 0x40d37a
mov edx, 0x5880e4
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d380
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00406760
push 2
push 0x5878a4
mov ecx, edi
call fcn.00406760
push 0x12
push str.Local_Conf_mode_:
mov ecx, edi
call fcn.00406760
call fcn.0040baa0
mov edx, 0x5880dc
mov al, byte [eax + 0x231e0]
test al, al
jne 0x40d3cd
mov edx, 0x5880e4
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d3d2
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00406760
push 2
push 0x5878a4
mov ecx, edi
call fcn.00406760
push 0xc0
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x408], 0
push 0
push eax
call fcn.00544020
push 0x40
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.00544020
push 0x40
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.00544020
xor eax, eax
mov dword [ebp - 0x414], 0
add esp, 0x24
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x40c]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [ebp - 0x28], 0x30
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d560
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x408], 0xc0
push eax
push 0
push 0
push 0x588174
push dword [ebp - 0x40c]
call esi
xor eax, eax
mov dword [ebp - 0x408], 0x40
mov word [ebp - 0xf6], ax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0
push 0
push str.ReleaseId
push dword [ebp - 0x40c]
call esi
xor eax, eax
mov dword [ebp - 0x408], 0x40
mov word [ebp - 0x72], ax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push str.CurrentBuildNumber
push dword [ebp - 0x40c]
call esi
xor eax, eax
mov dword [ebp - 0x408], 4
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x5881c8
push dword [ebp - 0x40c]
call esi
test eax, eax
jne 0x40d554
push dword [ebp - 0x414]
lea eax, [ebp - 0x28]
push 0x5881d0
push eax
call fcn.0040d9c0
add esp, 0xc
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x1b4], 0
jne 0x40d5ad
call fcn.0040baa0
lea ecx, [ebp - 0x3d4]
push ecx
mov ecx, eax
call fcn.004b4b20
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x40d589
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1b4]
push 0x5881d8
push eax
call fcn.0040d9c0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3d4]
call fcn.004038c0
cmp word [ebp - 0x6c], 0
jne 0x40d5d6
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x40d5d6
shr eax, 0x10
push eax
lea eax, [ebp - 0x6c]
push 0x5881d0
push eax
call fcn.0040d9c0
add esp, 0xc
push str.OS_Name_:
mov ecx, edi
call fcn.0040a2e0
lea eax, [ebp - 0x1b4]
mov ecx, edi
push eax
call fcn.0040a2e0
push 0x5881f8
mov ecx, edi
call fcn.0040a2e0
call fcn.0040baa0
lea ecx, [ebp - 0x3d4]
push ecx
mov ecx, eax
call fcn.004b4a90
mov byte [ebp - 4], 2
mov ecx, edi
push 0xffffffffffffffff
push 0
push eax
call fcn.00406650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3d4]
call fcn.004038c0
push 0x588200
mov ecx, edi
call fcn.0040a2e0
push 0x5878a4
mov ecx, edi
call fcn.0040a2e0
cmp word [ebp - 0xb0], 0
je 0x40d676
push str.OS_Version_:
mov ecx, edi
call fcn.0040a2e0
lea eax, [ebp - 0xb0]
mov ecx, edi
push eax
call fcn.0040a2e0
push 0x5878a4
mov ecx, edi
call fcn.0040a2e0
cmp word [ebp - 0x6c], 0
je 0x40d6b7
push str.OS_Build_:
mov ecx, edi
call fcn.0040a2e0
lea eax, [ebp - 0x6c]
mov ecx, edi
push eax
call fcn.0040a2e0
push 0x58823c
mov ecx, edi
call fcn.0040a2e0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.0040a2e0
push 0x5878a4
mov ecx, edi
call fcn.0040a2e0
push str.wine_get_version
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d70f
call eax
push eax
lea eax, [ebp - 0xf0]
push 0x588268
push eax
call fcn.0040d9c0
add esp, 0xc
mov ecx, edi
push str.WINE_:
call fcn.0040a2e0
lea eax, [ebp - 0xf0]
mov ecx, edi
push eax
call fcn.0040a2e0
push 0x5878a4
mov ecx, edi
call fcn.0040a2e0
push str.Plugins_:
mov ecx, edi
call fcn.0040a2e0
cmp dword [ebx + 0x4c], 0
jne 0x40d73c
push str.none
lea ecx, [ebp - 0x404]
call fcn.004029a0
mov byte [ebp - 4], 3
mov ebx, 1
jmp 0x40d791
xor eax, eax
mov dword [ebp - 0x3c4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x3d4], ax
lea ecx, [ebp - 0x3d4]
lea eax, [ebx + 0x3c]
mov dword [ebp - 0x3c0], 0
push eax
mov dword [ebp - 0x3c0], 7
mov dword [ebp - 0x3c4], 0
call fcn.00406ac0
lea eax, [ebp - 0x3d4]
mov dword [ebp - 4], 4
mov ebx, 2
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
mov dword [ebp - 0x410], ebx
call fcn.00406650
mov dword [ebp - 4], 3
test bl, 2
je 0x40d7c3
and ebx, 0xfffffffd
lea ecx, [ebp - 0x3d4]
mov dword [ebp - 0x410], ebx
call fcn.004038c0
mov dword [ebp - 4], 0
test bl, 1
je 0x40d7e3
and ebx, 0xfffffffe
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x410], ebx
call fcn.004038c0
push 0x5878a4
mov ecx, edi
call fcn.0040a2e0
cmp dword [edi + 0x14], 8
jb 0x40d7f7
mov edi, dword [edi]
push edi
mov edi, dword [ebp - 0x41c]
push 0x6d7
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [edi + 0xc]
mov eax, dword [edi + 0x54]
lea ecx, [edi + 0x54]
push dword [edi + 4]
call dword [eax + 4]
push 0
push 0x6d8
push 0x6d8
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
lea ecx, [edi + 0x54]
call fcn.004f90b0
mov edx, dword [edi]
lea eax, [edi + 0x10]
push eax
mov ecx, edi
call dword [edx + 0x1c]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ec]
call fcn.004038c0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10