Function at 0x42c3d0
Capabilities:
Contain obfuscated stackstrings
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov al, byte [0x44fa58]
push ebx
push esi
push edi
xor edi, edi
test al, al
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
jne 0x42c429
push 0x44fa58
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
test eax, eax
jne 0x42c40d
push str.00000409
push 0x44fa58
call fcn.004296d0
add esp, 8
jmp 0x42c429
xor eax, eax
mov al, byte [0x44fa5f]
test byte [eax*2 + str._________], 2
je 0x42c424
mov al, byte [eax + 0x44a370]
mov byte [0x44fa5f], al
mov eax, dword [0x44fa3c]
cmp eax, edi
jne 0x42c443
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x44fa3c], eax
jmp 0x42c44a
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0x44a0d4], edi
jge 0x42c460
call dword [sym.imp.KERNEL32.dll_GetVersion]
shr eax, 0x1f
mov dword [0x44a0d4], eax
mov ecx, dword [0x44fa4c]
push ecx
call fcn.004291d0
add esp, 4
test eax, eax
jne 0x42c494
push edi
push str.CONIN_
call fcn.0042ec00
add esp, 8
cmp eax, 0xffffffff
mov dword [0x44fa4c], eax
jne 0x42c499
or eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x44fa4c]
mov edx, dword [0x4586d8]
mov dword [ebp - 0xc], edi
mov esi, dword [edx + eax*4]
mov eax, dword [0x44fa3c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
jmp 0x42c4b8
mov esi, dword [ebp - 0x18]
mov eax, dword [0x44fa48]
mov ebx, 1
cmp eax, edi
jne 0x42c4cb
or eax, 0xffffffff
jmp 0x42c4d7
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
push eax
lea ecx, [ebp - 0x24]
push edi
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
dec eax
je 0x42cded
sub eax, 0x101
je 0x42cdcf
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x38]
push edx
push ebx
push eax
push esi
mov word [ebp - 0x38], bx
mov dword [0x4586bc], edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
cmp dword [0x4586bc], edi
jne 0x42cd76
cmp word [ebp - 0x38], bx
jne case.0x42cd31.16
mov esi, dword [ebp - 0x2a]
mov eax, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x2e]
mov edx, dword [0x44a0d4]
and esi, 0xff
mov ecx, eax
and ebx, 0xffff
cmp edx, edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
je 0x42c5b1
test ah, 1
je 0x42c56d
cmp ebx, 0x12
jne 0x42c56d
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [0x44fa64], ecx
jmp case.0x42cd31.16
cmp dword [0x44fa64], edi
je 0x42c5ce
and al, 0xfe
cmp esi, edi
mov dword [ebp - 4], eax
jne 0x42c596
cmp ebx, 0x32
jne 0x42c58a
mov esi, 0x7e
jmp 0x42c5a0
cmp ebx, 0x37
jne 0x42c5a0
mov esi, 0x60
jmp 0x42c5a0
cmp esi, 0x33
jne 0x42c5a0
mov esi, 0xfc
test al, 0xc
je 0x42c5a7
and esi, 0xffffff9f
cmp esi, edi
je case.0x42cd31.16
jmp 0x42c5cb
mov cl, byte [ebp - 0x28]
test cl, 1
je 0x42c5cb
test cl, 8
je 0x42c5cb
and al, 0xf6
cmp esi, edi
mov dword [ebp - 4], eax
je case.0x42cd31.16
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x34]
test edi, edi
je 0x42c65e
test cl, 3
je case.default.0x42c67a
or eax, 0xffffffff
cmp ebx, 0x12
je case.0x42cd31.16
lea ecx, [ebx - 0xc]
cmp ecx, 0x5d
ja case.default.0x42c5fe
xor ebx, ebx
mov bl, byte [ecx + 0x42ceec]
jmp dword [ebx*4 + 0x42ce98]
xor eax, eax
jmp case.0x42c5fe.32
mov eax, 1
jmp case.0x42c5fe.32
mov eax, 2
jmp case.0x42c5fe.32
mov eax, 3
jmp case.0x42c5fe.32
mov eax, 4
jmp case.0x42c5fe.32
mov eax, 5
jmp case.0x42c5fe.32
mov eax, 6
jmp case.0x42c5fe.32
mov eax, 7
jmp case.0x42c5fe.32
mov eax, 8
jmp case.0x42c5fe.32
mov eax, 9
mov ebx, dword [ebp - 8]
test eax, eax
jl case.0x42c67a.16
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*2]
mov dword [ebp - 0x10], eax
jmp case.0x42cd31.16
mov eax, dword [ebp - 0x10]
test eax, eax
je case.default.0x42c67a
test cl, 3
je 0x42c681
lea eax, [ebx - 0xc]
cmp eax, 0x5d
ja case.default.0x42c67a
xor ecx, ecx
mov cl, byte [eax + 0x42cf60]
jmp dword [ecx*4 + 0x42cf4c]
cmp ebx, 0x12
je 0x42cd90
jmp case.default.0x42c67a
mov ecx, dword [ebp - 4]
test edx, edx
mov dword [ebp - 0x10], 0
je 0x42c716
test edi, edi
je 0x42c6db
cmp esi, 0xd
jne 0x42c6ab
mov dword [ebp - 0x14], esi
jmp case.0x42cd31.16
test esi, esi
jne 0x42c6c7
cmp ebx, 0xdc
je case.0x42cd31.16
cmp ebx, 0xdd
je case.0x42cd31.16
cmp esi, 0x2a
jne 0x42c71e
cmp ebx, 0x6a
jne 0x42c71e
test cl, 0x10
je 0x42c71e
jmp case.0x42cd31.16
cmp esi, 0xd
jne 0x42c6e5
cmp dword [ebp - 0x14], esi
je 0x42c71e
test esi, esi
jne 0x42c6f9
cmp ebx, 0xdc
je 0x42c71e
cmp ebx, 0xdd
je 0x42c71e
cmp esi, 0x2a
jne case.0x42cd31.16
cmp ebx, 0x6a
jne case.0x42cd31.16
test cl, 0x10
je case.0x42cd31.16
jmp 0x42c71e
test edi, edi
je case.0x42cd31.16
mov al, byte [0x44fa5e]
mov cl, byte [0x44fa5f]
test esi, esi
jne 0x42c74c
cmp ebx, 0xdc
jne 0x42c74c
cmp al, 0x30
jne 0x42c74c
cmp cl, 0x37
jne 0x42c74c
test byte [ebp - 4], 0xc
je 0x42c749
mov esi, 0x1e
mov ebx, dword [ebp - 8]
test edx, edx
je 0x42ccba
mov edx, dword [ebp - 4]
test esi, esi
jne 0x42c881
test dl, 0xf
jne 0x42c881
cmp ebx, 0x36
jne 0x42c79b
push str.00010409
push 0x44fa58
call fcn.0042a7d0
add esp, 8
test eax, eax
jne 0x42c866
test byte [ebp - 4], 0x10
je 0x42c866
mov esi, 0x5e
jmp 0x42c866
cmp ebx, 0xc0
jne 0x42c7d4
push str.00010409
push 0x44fa58
call fcn.0042a7d0
add esp, 8
test eax, eax
jne 0x42c866
mov edx, dword [ebp - 4]
and dl, 0x10
neg dl
sbb edx, edx
and edx, 0x1e
add edx, 0x60
mov esi, edx
jmp 0x42c866
cmp ebx, 0xdc
jne 0x42c7f0
mov eax, edx
and al, 0x10
neg al
sbb eax, eax
and eax, 0x9a
add eax, 0x5e
mov esi, eax
jmp 0x42c869
cmp ebx, 0xdd
jne 0x42c829
cmp al, 0x30
jne 0x42c817
cmp cl, 0x63
jne 0x42c817
mov ecx, edx
and cl, 0x10
neg cl
sbb ecx, ecx
and ecx, 0x9b
add ecx, 0x5e
mov esi, ecx
jmp 0x42c869
mov eax, edx
and al, 0x10
neg al
sbb eax, eax
and eax, 0x39
add eax, 0x27
mov esi, eax
jmp 0x42c869
cmp ebx, 0xde
jne 0x42c869
cmp al, 0x30
jne 0x42c83e
cmp cl, 0x63
je case.0x42cd31.16
push str.00010409
push 0x44fa58
call fcn.0042a7d0
add esp, 8
test eax, eax
jne 0x42c866
mov ecx, dword [ebp - 4]
and cl, 0x10
neg cl
sbb ecx, ecx
and ecx, 0xfffffffb
add ecx, 0x27
mov esi, ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x44fa50]
test eax, eax
jne 0x42c88e
test esi, esi
je 0x42c886
mov dword [0x44fa50], esi
jmp case.0x42cd31.16
mov eax, dword [0x44fa50]
test eax, eax
je case.0x42cacc.76
test esi, esi
je case.0x42cacc.76
cmp eax, 0x5e
jne 0x42c91a
lea eax, [esi - 0x41]
cmp eax, 0x34
ja case.0x42cacc.76
xor ecx, ecx
mov cl, byte [eax + 0x42cfec]
jmp dword [ecx*4 + 0x42cfc0]
mov esi, 0x83
jmp case.0x42cacc.76
mov esi, 0xb6
jmp case.0x42cacc.76
mov esi, 0x88
jmp case.0x42cacc.76
mov esi, 0xd2
jmp case.0x42cacc.76
mov esi, 0x8c
jmp case.0x42cacc.76
mov esi, 0xd7
jmp case.0x42cacc.76
mov esi, 0x93
jmp case.0x42cacc.76
mov esi, 0xe2
jmp case.0x42cacc.76
mov esi, 0x96
jmp case.0x42cacc.76
mov esi, 0xea
jmp case.0x42cacc.76
cmp eax, 0x7e
jne 0x42c976
lea eax, [esi - 0x41]
cmp eax, 0x2e
ja case.0x42cacc.76
xor ecx, ecx
mov cl, byte [eax + 0x42d040]
jmp dword [ecx*4 + 0x42d024]
mov esi, 0xc6
jmp case.0x42cacc.76
mov esi, 0xc7
jmp case.0x42cacc.76
mov esi, 0xe4
jmp case.0x42cacc.76
mov esi, 0xe5
jmp case.0x42cacc.76
mov esi, 0xa4
jmp case.0x42cacc.76
mov esi, 0xa5
jmp case.0x42cacc.76
cmp eax, 0x27
jne 0x42ca12
lea eax, [esi - 0x41]
cmp eax, 0x38
ja case.0x42cacc.76
xor ecx, ecx
mov cl, byte [eax + 0x42d0a4]
jmp dword [ecx*4 + 0x42d070]
mov esi, 0xa0
jmp case.0x42cacc.76
mov esi, 0xb5
jmp case.0x42cacc.76
mov esi, 0x82
jmp case.0x42cacc.76
mov esi, 0x90
jmp case.0x42cacc.76
mov esi, 0xa1
jmp case.0x42cacc.76
mov esi, 0xd6
jmp case.0x42cacc.76
mov esi, 0xa2
jmp case.0x42cacc.76
mov esi, 0xe0
jmp case.0x42cacc.76
mov esi, 0xa3
jmp case.0x42cacc.76
mov esi, 0xe9
jmp case.0x42cacc.76
mov esi, 0xec
jmp case.0x42cacc.76
mov esi, 0xed
jmp case.0x42cacc.76
cmp eax, 0x60
jne 0x42ca96
lea eax, [esi - 0x41]
cmp eax, 0x34
ja case.0x42cacc.76
xor ecx, ecx
mov cl, byte [eax + 0x42d10c]
jmp dword [ecx*4 + 0x42d0e0]
mov esi, 0x85
jmp case.0x42cacc.76
mov esi, 0xb7
jmp case.0x42cacc.76
mov esi, 0x8a
jmp case.0x42cacc.76
mov esi, 0xd4
jmp case.0x42cacc.76
mov esi, 0x8d
jmp case.0x42cacc.76
mov esi, 0xde
jmp case.0x42cacc.76
mov esi, 0x95
jmp case.0x42cacc.76
mov esi, 0xe3
jmp case.0x42cacc.76
mov esi, 0x97
jmp case.0x42cacc.76
mov esi, 0xeb
jmp case.0x42cacc.76
cmp eax, 0xf8
jne 0x42cab5
cmp esi, 0x41
je 0x42caae
cmp esi, 0x61
jne case.0x42cacc.76
mov esi, 0x86
jmp case.0x42cacc.76
mov esi, 0x8f
jmp case.0x42cacc.76
cmp eax, 0xf9
jne case.0x42cacc.76
lea eax, [esi - 0x41]
cmp eax, 0x38
ja case.0x42cacc.76
xor ecx, ecx
mov cl, byte [eax + 0x42d174]
jmp dword [ecx*4 + 0x42d144]
mov esi, 0x84
jmp case.0x42cacc.76
mov esi, 0x8e
jmp case.0x42cacc.76
mov esi, 0x89
jmp case.0x42cacc.76
mov esi, 0xd3
jmp case.0x42cacc.76
mov esi, 0x8b
jmp case.0x42cacc.76
mov esi, 0xd8
jmp case.0x42cacc.76
mov esi, 0x94
jmp case.0x42cacc.76
mov esi, 0x99
jmp case.0x42cacc.76
mov esi, 0x81
jmp case.0x42cacc.76
mov esi, 0x9a
jmp case.0x42cacc.76
mov esi, 0x98
mov edi, edx
xor ecx, ecx
and edi, 0x80
mov dword [0x44fa50], ecx
je 0x42cbd0
cmp esi, ecx
je 0x42cbd0
test byte [esi*2 + 0x44a16b], 8
jne 0x42cbd0
mov byte [ebp - 0x50], pe_nt_image_headers32
mov byte [ebp - 0x4f], 0x31
mov byte [ebp - 0x4e], 0x32
mov byte [ebp - 0x4d], 0x33
mov byte [ebp - 0x4c], 0x34
mov byte [ebp - 0x4b], 0x35
mov byte [ebp - 0x4a], 0x36
mov byte [ebp - 0x49], 0x37
mov byte [ebp - 0x48], 0x38
mov byte [ebp - 0x47], 0x39
mov byte [ebp - 0x46], 0x30
mov byte [ebp - 0x45], 0xbd
mov byte [ebp - 0x44], 0xbb
mov byte [ebp - 0x43], 0xdc
mov byte [ebp - 0x42], 0xdb
mov byte [ebp - 0x41], 0xdd
mov byte [ebp - 0x40], 0xba
mov byte [ebp - 0x3f], 0xde
mov byte [ebp - 0x3e], 0xbc
mov byte [ebp - 0x3d], 0xbe
mov byte [ebp - 0x3c], 0xbf
mov byte [ebp - 0x3b], cl
mov al, pe_nt_image_headers32
and eax, 0xff
cmp ebx, eax
je 0x42cbb7
mov al, byte [ebp + ecx - 0x4f]
inc ecx
test al, al
jne 0x42cba3
jmp 0x42cbd0
test dl, 0x10
je 0x42cbc6
xor eax, eax
mov al, byte [ecx + str._______:____]
jmp 0x42cbce
xor eax, eax
mov al, byte [ecx + str._1234567890_____._]
mov esi, eax
mov ax, word [esi*2 + str._________]
test ah, 8
je 0x42cc29
test edi, edi
mov ecx, edx
je 0x42cc02
and ecx, 0x10
je 0x42cbf8
test al, 2
je 0x42cbf8
xor ecx, ecx
mov cl, byte [esi + 0x44a370]
mov esi, ecx
jmp 0x42cc29
test ecx, ecx
jne 0x42cc29
test al, 1
je 0x42cc29
jmp 0x42cc1f
and ecx, 0x10
je 0x42cc17
test al, 1
je 0x42cc17
xor ecx, ecx
mov cl, byte [esi + 0x44a370]
mov esi, ecx
jmp 0x42cc29
test ecx, ecx
jne 0x42cc29
test al, 2
je 0x42cc29
xor eax, eax
mov al, byte [esi + 0x44a370]
mov esi, eax
mov ecx, edx
and ecx, 0x100
je 0x42cc50
cmp ebx, 0xbd
je 0x42cc4b
cmp ebx, 0xbf
je 0x42cc4b
cmp ebx, 0xdf
jne 0x42cc50
mov esi, 0x2f
test esi, esi
jne case.0x42ccae.15
test dl, 0xf
jne 0x42ce5e
lea eax, [ebx - 8]
cmp eax, 0xd6
ja case.default.0x42cc73
xor edx, edx
mov dl, byte [eax + 0x42d1d0]
jmp dword [edx*4 + 0x42d1b0]
test byte [ebp - 4], 0x10
je 0x42ce18
mov esi, 0x5e
mov edx, dword [ebp - 4]
test esi, esi
jne case.0x42ccae.15
test ecx, ecx
jne case.0x42ccae.15
test dl, 0x10
je 0x42cd17
test dl, 0x20
je case.0x42ccae.15
lea eax, [ebx - 0xc]
cmp eax, 0x22
ja case.0x42ccae.15
xor ecx, ecx
mov cl, byte [eax + 0x42d2b8]
jmp dword [ecx*4 + 0x42d2a8]
and edx, 0xffffffef
jmp case.0x42ccae.15
test esi, esi
jne 0x42ccff
cmp ebx, 0x36
je case.0x42cd31.16
cmp ebx, 0xba
je case.0x42cd31.16
cmp ebx, 0xc0
je case.0x42cd31.16
cmp ebx, 0xdb
je case.0x42cd31.16
cmp ebx, 0xdc
je case.0x42cd31.16
cmp ebx, 0xdd
je case.0x42cd31.16
cmp ebx, 0xde
je case.0x42cd31.16
mov edx, dword [ebp - 4]
test dl, 0x10
je 0x42cd17
cmp ebx, 0x70
jl 0x42cd17
cmp ebx, 0x7b
jg 0x42cd17
add ebx, 0xa
and edx, 0xffffffef
test esi, esi
jne 0x42cd9f
lea eax, [ebx - 0x10]
cmp eax, 0x81
ja case.0x42cd31.19
xor ecx, ecx
mov cl, byte [eax + 0x42d2ec]
jmp dword [ecx*4 + 0x42d2dc]
test dl, 3
je 0x42cd43
or ebx, 0x140000
test dl, 0xc
je 0x42cd4e
or ebx, 0x120000
test dl, 0x10
je 0x42cd59
or ebx, 0x110000
or ebx, 0x100000
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
xor edi, edi
cmp eax, edi
je 0x42c4b5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x4586bc], edi
mov dword [0x4586cc], 0xfffffff6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
and eax, 0xff
mov dword [ebp - 0xc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
test dl, 3
mov dword [ebp - 0xc], eax
je 0x42cdb4
or esi, 0x140000
mov eax, esi
mov dword [ebp - 0xc], eax
cmp eax, 9
jne 0x42ce0e
test dl, 0x10
je 0x42ce0e
mov dword [ebp - 0xc], 0x110009
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xe
call fcn.00431ad0
add esp, 4
mov dword [0x4586cc], 0xfffffff6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x44fa3c]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [0x4586cc], 0xfffffff6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je case.0x42cc73.15
mov esi, 0x36
jmp case.0x42cc73.15
mov eax, dword [ebp - 4]
and al, 0x10
neg al
sbb eax, eax
and eax, 0x1e
add eax, 0x60
mov esi, eax
jmp case.0x42cc73.15
mov edx, dword [ebp - 4]
and dl, 0x10
neg dl
sbb edx, edx
and edx, 0xfffffffb
add edx, 0x27
mov esi, edx
jmp case.0x42cc73.15
mov esi, ebx
jmp case.0x42cc73.15
test dl, 0xc
je case.default.0x42cc73
test dl, 0x10
je case.default.0x42cc73
cmp ebx, 0x36
jne 0x42ce7f
mov esi, 0x1e
jmp case.default.0x42cc73
cmp ebx, 0xbd
jne case.default.0x42cc73
mov esi, 0x1f
jmp case.default.0x42cc73