Function at 0x40d480
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Hide graphical window
Identify system language via api
Log keystrokes via polling
Print debug messages

Disassembly:
sub esp, 0x658
cmp dword [0x45cc5c], 0
push ebx
push ebp
push esi
push edi
je 0x40d4ec
mov al, byte [esp + 0xc8]
cmp al, 0x40
je 0x40d4d9
cmp al, 0x71
je 0x40d4d9
mov esi, dword [esp + 0x18]
mov edi, 0x104
nop dword [eax + eax]
lea eax, [esp + 0xc8]
push 0x10
push eax
push eax
call fcn.0042a336
add esp, 0xc
mov byte [esi], al
cmp byte [esp + 0xc8], 0x20
lea esi, [esi + 1]
jb 0x40d4ec
sub edi, 1
jne 0x40d4b0
jmp 0x40d4ec
lea eax, [esp + 0xc8]
push 0x10
push eax
push eax
call fcn.0042a336
add esp, 0xc
mov edi, dword [0x45c314]
test edi, edi
je 0x40d61e
mov eax, dword fs:[0x2c]
mov ecx, dword [0x45d0e4]
mov esi, dword [0x459600]
mov ebp, dword [0x45c0fc]
mov ebx, dword [esp + 0x18]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x45cc74]
cmp eax, dword [ecx + 4]
jg 0x40de6f
push ebp
push esi
push edi
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ebp, eax
test edi, edi
je 0x40d5fc
cmp edi, 8
jne 0x40d61e
and esi, 0xfff0
sub esi, 0xf000
je 0x40d578
sub esi, 0x10
jne 0x40d61e
or bl, byte [esp + 0x10]
or bl, byte [esp + 0x10]
or bl, byte [esp + 0x10]
mov byte [0x45cc70], bl
jmp 0x40d61e
lea eax, [esp + 0x18]
mov byte [0x45cc70], 0
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edx, eax
test edx, edx
jne 0x40d5ab
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x658
ret
movzx ecx, word [esp + 0x1c]
movzx eax, word [esp + 0x18]
shl ecx, 0x10
or ecx, eax
push ecx
push 0
push 0x84
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
add eax, 0xfffffff6
cmp eax, 7
ja case.default.0x40d5d1
jmp dword [eax*4 + 0x40deb0]
mov eax, dword [esp + 0x10]
mov byte [0x45cc70], al
jmp 0x40d61e
mov eax, dword [esp + 0x10]
or al, byte [esp + 0x10]
mov byte [0x45cc70], al
jmp 0x40d61e
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x40d61e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xfffe
test cx, ax
mov eax, dword [0x459600]
mov ecx, 0
cmove eax, ecx
mov dword [0x459600], eax
mov eax, dword [esp + 0x66c]
xorps xmm0, xmm0
push 0x208
mov dword [esp + 0x28], eax
lea eax, [esp + 0xcc]
push 0
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x34], 0
movups xmmword [esp + 0x4c], xmm0
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x74], xmm0
movq qword [esp + 0x3c], xmm0
call fcn.0041c490
mov ebp, dword [0x45cc4c]
lea eax, [esp + 0xd4]
mov edi, dword [0x45cb04]
add esp, 0xc
movzx ecx, ax
mov eax, 1
sub eax, ecx
add dword [0x45c0fc], eax
mov eax, dword [0x45c44c]
mov dword [esp + 0x20], eax
mov dword [0x45c55c], eax
cmp bp, 1
jb 0x40d6bf
mov ebx, dword [0x45c308]
movzx ecx, byte [0x45cc5c]
movzx eax, bl
imul ecx, eax
mov eax, edi
sub eax, ecx
add dword [0x459600], eax
mov ecx, dword [0x45c308]
mov eax, dword [0x45c558]
inc ecx
lea eax, [eax + ecx*2]
add eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x68]
movzx eax, ax
cmp eax, dword [esp + 0x34]
jg 0x40d707
mov ecx, dword [0x45c314]
movzx eax, byte [0x45cc60]
cdq
lea ecx, [ecx + 0x5c]
idiv ecx
mov ecx, dword [0x45c674]
imul eax, dword [0x45cc5c]
sub ecx, eax
mov dword [esp + 0x28], ecx
mov eax, dword [0x45c674]
xor ebx, ebx
movzx ecx, al
mov eax, 0x5397829d
imul ecx, ebp
mov ebp, 0x2b
imul ecx
mov eax, 0x92492493
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
imul dword [0x45c30c]
mov eax, dword [0x45c0f8]
add edx, dword [0x45c30c]
dec eax
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, esi
sub ecx, dword [0x45cc58]
add eax, ecx
mov dword [0x45c0f8], eax
cmp dword [esp + 0x10], ebx
jle 0x40d861
mov esi, dword [0x45c674]
mov ebp, dword [0x45c31c]
test ebp, ebp
je 0x40d77e
mov al, bl
add al, byte [0x45c308]
jmp 0x40d784
mov al, byte [ebx + 0x459608]
cmp dword [esp + 0x34], 0
mov byte [esp + 0x17], al
jne 0x40d7a6
mov eax, dword [0x45c674]
add eax, dword [esp + 0x70]
add dword [0x459600], eax
mov esi, dword [0x45c674]
jmp 0x40d7cb
mov ecx, dword [0x45c30c]
mov eax, edi
cdq
lea ecx, [ecx + 0x55]
idiv ecx
mov ecx, dword [0x45c30c]
movzx ecx, cx
imul eax, ecx
mov ecx, 1
sub ecx, eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x24]
cmp dword [0x45c310], ecx
jne 0x40d806
mov ecx, dword [0x45cc54]
mov eax, dword [esp + 0x68]
cdq
lea ecx, [ecx + 0x46]
idiv ecx
mov ecx, dword [0x459600]
add ecx, ecx
sub ecx, eax
sub ecx, dword [esp + 0x40]
sub ecx, dword [0x45c44c]
dec ecx
mov dword [0x459600], ecx
mov ecx, dword [esp + 0x24]
cmp dword [0x45c314], 0
jne 0x40d835
mov edx, dword [esp + 0x20]
mov al, byte [esp + 0x17]
mov byte [ebx + edx], al
mov eax, dword [0x45c55c]
mov edi, dword [0x45cb04]
mov esi, dword [0x45c674]
mov ebp, dword [0x45c31c]
mov dword [esp + 0x20], eax
mov eax, 0x2aaaaaab
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ebp
je 0x40d851
sub edi, ecx
mov dword [0x45cb04], edi
inc ebx
cmp ebx, dword [esp + 0x10]
jl 0x40d770
mov ebp, 0x2b
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x45c100
mov ebx, dword [0x45c308]
movzx esi, al
sub esi, dword [esp + 0x74]
sub esi, dword [esp + 0x28]
nop dword [eax]
mov eax, esi
dec ebp
sub eax, ebx
push 0x44
mov dword [0x45cc4c], eax
lea eax, [esp + 0x88]
push 0
push eax
call fcn.0041c490
add esp, 0xc
cmp dword [esp + 0x88], 0x160
jne 0x40d8bb
lea eax, [esp + 0x318]
push eax
call edi
mov ebx, dword [0x45c308]
test ebp, ebp
jne 0x40d880
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
push ebp
push ebp
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [0x45c558]
add eax, 0xc3
push eax
push dword [esp + 0x14]
push dword [0x45c55c]
call fcn.0040b2a0
cmp dword [esp + 0x18], ebp
je 0x40d90d
movzx eax, word [0x45cc58]
mov ecx, dword [esp + 0x4c]
sub ecx, eax
sub ecx, dword [esp + 0x28]
add ecx, dword [0x45c30c]
add dword [0x45c0f8], ecx
mov eax, dword [0x45c55c]
lea ecx, [esp + 0x66c]
push 0xffffffffffffffeb
mov dword [eax + 1], ecx
mov edi, dword [0x45c31c]
mov ebp, dword [0x45cb04]
mov esi, dword [0x45cc4c]
mov ebx, dword [0x45cc54]
push edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, dword [sym.imp.USER32.dll_GetParent]
mov dword [esp + 0x18], eax
mov eax, dword [sym.imp.USER32.dll_CallWindowProcA]
cmp ebx, 0xf3
ja 0x40d97e
je 0x40da48
lea eax, [ebx - 7]
cmp eax, 0xea
ja case.0x40d977.9
movzx eax, byte [eax + 0x40dee0]
jmp dword [eax*4 + 0x40ded0]
cmp ebx, 0x100
jb 0x40da81
cmp ebx, 0x102
jbe case.0x40d977.7
cmp ebx, 0x215
je 0x40da6b
jmp 0x40da81
push esi
push ebp
push ebx
push edi
call ecx
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [esp + 0x18], 0
je case.0x40d977.9
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov ebp, dword [esp + 0x18]
test eax, eax
jne 0x40d9da
add ebp, 4
lea eax, [esp + 0x80]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 0x40]
push eax
push edi
call esi
lea eax, [esp + 0x2c]
push eax
push edi
call esi
lea eax, [esp + 0x68]
push eax
push 0x18
push dword [ebp]
call dword [sym.imp.GDI32.dll_GetObjectA]
test byte [esp + 0x18], 0x20
je 0x40da24
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x6c]
mov dword [esp + 0x40], eax
jmp 0x40da2c
mov eax, dword [esp + 0x6c]
add dword [esp + 0x2c], eax
lea eax, [esp + 0x80]
push eax
push edi
call dword [sym.imp.USER32.dll_EndPaint]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov eax, dword [sym.imp.USER32.dll_CallWindowProcA]
push esi
push ebp
push ebx
push edi
push 0x40eb60
call eax
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [sym.imp.USER32.dll_GetParent]
push esi
push ebp
push 0x215
push edi
call ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [sym.imp.USER32.dll_CallWindowProcA]
cmp dword [0x45cc54], 0
je 0x40da95
push esi
push ebp
push ebx
push edi
push 0x40eb60
call eax
mov eax, dword [esp + 0x66c]
push 0x7f00
push 0
mov dword [esp + 0x48], 3
mov dword [esp + 0x4c], 0x40eb60
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push str..cur
mov dword [esp + 0x58], eax
call dword [sym.imp.USER32.dll_LoadCursorFromFileA]
push 0
mov dword [esp + 0x5c], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], str.DWnd
call dword [sym.imp.USER32.dll_RegisterClassA]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [sym.imp.USER32.dll_PostQuitMessage]
test ax, ax
jne 0x40db32
cmp dword [0x45cc58], 0
jne 0x40db32
push 0
push 0
push str.RegisterClass_FAILED
push 0
call ebx
push 0
call edi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
call esi
movaps xmm0, xmmword [0x442240]
lea eax, [esp + 0x2c]
push 0
push 0xcf0000
push eax
movups xmmword [esp + 0x38], xmm0
call dword [sym.imp.USER32.dll_AdjustWindowRect]
push 0
push dword [esp + 0x670]
push 0
push 0
push dword [esp + 0x48]
push dword [esp + 0x48]
push 0x64
push 0xfa
push 0xcf0000
push 0x45c450
push str.DWnd
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x40dbac
cmp dword [0x45cc58], eax
jne 0x40dbac
push eax
push eax
push str.CreateWindow_FAILED
push eax
call ebx
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push esi
call ebp
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x10000
push 0
push 0x45c450
call dword [sym.imp.WINMM.dll_mmioOpenA]
mov ecx, dword [0x45cb04]
mov edi, eax
mov esi, dword [sym.imp.WINMM.dll_mmioDescend]
lea eax, [esp + 0x2c]
push 0x20
push 0
test edi, edi
mov dword [esp + 0x3c], 0x45564157
push eax
cmove ecx, dword [0x45cc4c]
push edi
mov dword [0x45cb04], ecx
call esi
mov ecx, dword [0x45cb04]
test eax, eax
push 0x10
cmovne ecx, dword [0x45cc4c]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x48]
mov dword [0x45cb04], ecx
push eax
push edi
mov dword [esp + 0x50], 0x20746d66
call esi
mov ecx, dword [0x45cb04]
test eax, eax
mov eax, dword [0x45cc4c]
cmovne ecx, eax
cmp dword [esp + 0x18], 0xffffffff
push 0
cmove eax, ecx
mov dword [0x45cb04], ecx
mov dword [0x45cc4c], eax
lea eax, [esp + 0x44]
push eax
push edi
call dword [sym.imp.WINMM.dll_mmioAscend]
mov ecx, dword [0x45cc4c]
test eax, eax
push 0x10
cmovne ecx, dword [0x45cb04]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x48]
mov dword [0x45cc4c], ecx
push eax
push edi
mov dword [esp + 0x50], 0x61746164
call esi
mov ecx, dword [0x45cc4c]
test eax, eax
mov eax, dword [0x45cc58]
cmovne ecx, dword [0x45cb04]
mov esi, dword [esp + 0x44]
mov dword [0x45cc4c], ecx
lea eax, [eax + eax*2]
shl eax, 2
push eax
call fcn.00428525
mov ecx, dword [0x45cc4c]
add esp, 4
test eax, eax
cmove ecx, dword [0x45cb04]
push esi
push eax
push edi
mov dword [0x45cc4c], ecx
call dword [sym.imp.WINMM.dll_mmioRead]
mov ecx, dword [0x45cc4c]
cmp eax, 0xffffffff
cmove ecx, dword [0x45cb04]
push 0
push edi
mov dword [0x45cc4c], ecx
call dword [sym.imp.WINMM.dll_mmioClose]
mov eax, dword [0x45cb04]
mov edi, dword [0x45c31c]
mov esi, dword [0x45c314]
mov dword [esp + 0x20], eax
mov eax, dword [0x45cc4c]
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetParent]
cmp esi, 0x200
ja 0x40dd50
je 0x40dd3a
mov eax, esi
sub eax, 8
je 0x40dd77
sub eax, 7
je 0x40dd77
sub eax, 1
jne 0x40dd5e
push eax
push edi
call ebp
jmp 0x40dd77
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x40dd77
mov eax, esi
sub eax, 0x201
je 0x40dd70
sub eax, 1
je 0x40dd77
push dword [esp + 0x18]
push dword [esp + 0x24]
push esi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x40dd77
push edi
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [0x45cc54]
mov esi, 1
imul eax, dword [0x45cc4c]
mov ecx, dword [0x45cc58]
mov edi, dword [esp + 0x66c]
movzx ebp, word [0x45c314]
add eax, ecx
cmp eax, 3
jbe 0x40ddb1
mov eax, dword [0x45c31c]
mov esi, 0xd
sub esi, eax
jmp 0x40ddcc
push 0
push 0x45c320
push 0x45c450
push 0
call ebx
mov eax, dword [0x45c31c]
mov ecx, dword [0x45cc58]
test ecx, ecx
je 0x40ddde
cmp dword [0x45cc60], 0
cmovne esi, dword [0x45c55c]
test bp, bp
je 0x40ddeb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x40dded
neg eax
cmp dword [0x45cc54], 0
movzx ecx, ax
jne 0x40de0d
push 0
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
mov eax, dword [esp + 0x18]
jmp 0x40de5a
test cx, cx
je 0x40de30
push ecx
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0x2d8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov eax, dword [esp + 0x18]
jmp 0x40de5a
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x40de5a
mov edx, 0x400
cmp cx, dx
je 0x40de5a
push edx
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0x2d8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x658
ret
push 0x45cc74
call fcn.00413023
add esp, 4
cmp dword [0x45cc74], 0xffffffff
jne 0x40d52a
mov al, bl
or al, byte [esp + 0x10]
or al, byte [esp + 0x10]
or al, byte [esp + 0x10]
push 0x45cc74
mov byte [0x45cc70], al
call fcn.00412fe4
add esp, 4
jmp 0x40d52a