Function at 0x47a790
Capabilities:
Contain obfuscated stackstrings
Get keyboard layout
Parse pe header

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
mov esi, ecx
xor eax, eax
push edi
mov al, byte [esi + 0x10]
mov dword [esp + 0x18], esi
mov ecx, eax
sub ecx, 0x10
je 0x47b437
dec ecx
je 0x47b3f4
dec ecx
je 0x47b3b1
cmp dword [esi + 0xc], 0x100
jne 0x47b395
xor edi, edi
lea ecx, [esp + 0x10]
push edi
push ecx
mov ecx, dword [esi + 0x10]
lea edx, [esi + 0x14]
shr ecx, 0x10
push edx
push ecx
push eax
mov dword [esi + 0x11c], 1
mov dword [esi + 0x124], eax
mov word [esp + 0x24], di
mov dword [esp + 0x26], edi
call dword [sym.imp.USER32.dll_ToAscii]
and word [esp + 0x10], 0xff
xor edx, edx
mov dl, byte [esi + 0x10]
push edi
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.0047a370
cmp ax, di
je 0x47a822
mov word [esp + 0x10], ax
mov ebx, 0x71
mov ebp, 0x72
mov edi, 0x73
mov esi, 0x74
mov edx, 0x76
mov ecx, 0x77
mov eax, 0x78
mov word [esp + 0x1c], 0xc2
mov word [esp + 0x1e], 0x42
mov word [esp + 0x20], 0x43
mov word [esp + 0x22], 0x44
mov word [esp + 0x24], 0xca
mov word [esp + 0x26], 0x46
mov word [esp + 0x28], 0x47
mov word [esp + 0x2a], 0x48
mov word [esp + 0x2c], 0xce
mov word [esp + 0x2e], 0x4a
mov word [esp + 0x30], 0x4b
mov word [esp + 0x32], 0x4c
mov word [esp + 0x34], 0x4d
mov word [esp + 0x36], 0x4e
mov word [esp + 0x38], 0xd4
mov word [esp + 0x3a], 0x50
mov word [esp + 0x3c], 0x51
mov word [esp + 0x3e], 0x52
mov word [esp + 0x40], 0x53
mov word [esp + 0x42], 0x54
mov word [esp + 0x44], 0xdb
mov word [esp + 0x46], 0x56
mov word [esp + 0x48], 0x57
mov word [esp + 0x4a], 0x58
mov word [esp + 0x4c], 0x59
mov word [esp + 0x4e], 0x5a
mov word [esp + 0x50], 0xe2
mov word [esp + 0x52], 0x62
mov word [esp + 0x54], 0x63
mov word [esp + 0x56], 0x64
mov word [esp + 0x58], 0xea
mov word [esp + 0x5a], 0x66
mov word [esp + 0x5c], 0x67
mov word [esp + 0x5e], 0x68
mov word [esp + 0x60], 0xee
mov word [esp + 0x62], 0x6a
mov word [esp + 0x64], 0x6b
mov word [esp + 0x66], 0x6c
mov word [esp + 0x68], 0x6d
mov word [esp + 0x6a], 0x6e
mov word [esp + 0x6c], 0xf4
mov word [esp + 0x6e], 0x70
mov word [esp + 0x70], bx
mov word [esp + 0x72], bp
mov word [esp + 0x74], di
mov word [esp + 0x76], si
mov word [esp + 0x78], 0xfb
mov word [esp + 0x7a], dx
mov word [esp + 0x7c], cx
mov word [esp + 0x7e], ax
mov word [esp + 0x80], 0x79
mov word [esp + 0x82], 0x7a
mov word [esp + 0x84], 0xc0
mov word [esp + 0x86], 0x42
mov word [esp + 0x88], 0x43
mov word [esp + 0x8a], 0x44
mov word [esp + 0x8c], 0xc8
mov word [esp + 0x8e], 0x46
mov word [esp + 0x90], 0x47
mov word [esp + 0x92], 0x48
mov word [esp + 0x94], 0xcc
mov word [esp + 0x96], 0x4a
mov word [esp + 0x98], 0x4b
mov word [esp + 0x9a], 0x4c
mov word [esp + 0x9c], 0x4d
mov word [esp + 0x9e], 0x4e
mov word [esp + 0xa0], 0xd2
mov word [esp + 0xa2], 0x50
mov word [esp + 0xa4], 0x51
mov word [esp + 0xa6], 0x52
mov word [esp + 0xa8], 0x53
mov word [esp + 0xaa], 0x54
mov word [esp + 0xac], 0xd9
mov word [esp + 0xae], 0x56
mov word [esp + 0xb0], 0x57
mov word [esp + 0xb2], 0x58
mov word [esp + 0xb4], 0x59
mov word [esp + 0xb6], 0x5a
mov word [esp + 0xb8], 0xe0
mov word [esp + 0xba], 0x62
mov word [esp + 0xbc], 0x63
mov word [esp + 0xbe], 0x64
mov word [esp + 0xc0], 0xe8
mov word [esp + 0xc2], 0x66
mov word [esp + 0xc4], 0x67
mov word [esp + 0xc6], 0x68
mov word [esp + 0xc8], 0xec
mov word [esp + 0xca], 0x6a
mov word [esp + 0xcc], 0x6b
mov word [esp + 0xce], 0x6c
mov word [esp + 0xd0], 0x6d
mov word [esp + 0xd2], 0x6e
mov word [esp + 0xd4], 0xf2
mov word [esp + 0xd6], 0x70
mov word [esp + 0xd8], bx
mov word [esp + 0xda], bp
mov word [esp + 0xdc], di
mov word [esp + 0xde], si
mov word [esp + 0xe0], 0xf9
mov word [esp + 0xe2], dx
mov word [esp + 0xe4], cx
mov word [esp + 0xe6], ax
mov word [esp + 0xe8], 0x79
mov word [esp + 0xea], 0x7a
mov word [esp + 0xec], 0xc1
mov word [esp + 0xee], 0x42
mov word [esp + 0xf0], 0x43
mov word [esp + 0xf2], 0x44
mov word [esp + 0xf4], 0xc9
mov word [esp + 0xf6], 0x46
mov word [esp + 0xf8], 0x47
mov word [esp + 0xfa], 0x48
mov word [esp + 0xfc], 0xcd
mov word [esp + 0xfe], 0x4a
mov word [esp + 0x100], 0x4b
mov word [esp + 0x102], 0x4c
mov word [esp + 0x104], 0x4d
mov word [esp + 0x106], 0x4e
mov word [esp + 0x108], 0xd3
mov word [esp + 0x10a], 0x50
mov word [esp + 0x10c], 0x51
mov word [esp + 0x10e], 0x52
mov word [esp + 0x110], 0x53
mov word [esp + 0x112], 0x54
mov word [esp + 0x114], 0xda
mov word [esp + 0x116], 0x56
mov word [esp + 0x118], 0x57
mov word [esp + 0x11a], 0x58
mov word [esp + 0x11c], 0xdd
mov word [esp + 0x11e], 0x5a
mov word [esp + 0x120], 0xe1
mov word [esp + 0x122], 0x62
mov word [esp + 0x124], 0x63
mov word [esp + 0x126], 0x64
mov word [esp + 0x128], 0xe9
mov word [esp + 0x12a], 0x66
mov word [esp + 0x12c], 0x67
mov word [esp + 0x12e], 0x68
mov word [esp + 0x130], 0xed
mov word [esp + 0x132], 0x6a
mov word [esp + 0x134], 0x6b
mov word [esp + 0x136], 0x6c
mov word [esp + 0x138], 0x6d
mov word [esp + 0x13a], 0x6e
mov word [esp + 0x13c], 0xf3
mov word [esp + 0x13e], 0x70
mov word [esp + 0x140], bx
mov word [esp + 0x142], bp
mov word [esp + 0x144], di
mov word [esp + 0x146], si
mov word [esp + 0x148], 0xfa
mov word [esp + 0x14a], dx
mov word [esp + 0x14c], cx
mov word [esp + 0x14e], ax
mov word [esp + 0x150], 0xfd
mov word [esp + 0x152], 0x7a
mov word [esp + 0x154], 0xc4
mov word [esp + 0x156], 0x42
mov word [esp + 0x158], 0x43
mov word [esp + 0x15a], 0x44
mov word [esp + 0x15c], 0xcb
mov word [esp + 0x15e], 0x46
mov word [esp + 0x160], 0x47
mov word [esp + 0x162], 0x48
mov word [esp + 0x164], 0xcf
mov word [esp + 0x166], 0x4a
mov word [esp + 0x168], 0x4b
mov word [esp + 0x16a], 0x4c
mov word [esp + 0x16c], 0x4d
mov word [esp + 0x16e], 0x4e
mov word [esp + 0x170], 0xd6
mov word [esp + 0x172], 0x50
mov word [esp + 0x174], 0x51
mov word [esp + 0x176], 0x52
mov word [esp + 0x178], 0x53
mov word [esp + 0x17a], 0x54
mov word [esp + 0x17c], 0xdc
mov word [esp + 0x17e], 0x56
mov word [esp + 0x180], 0x57
mov word [esp + 0x182], 0x58
mov word [esp + 0x184], 0x59
mov word [esp + 0x186], 0x5a
mov word [esp + 0x188], 0xe4
mov word [esp + 0x18a], 0x62
mov word [esp + 0x18c], 0x63
mov word [esp + 0x18e], 0x64
mov word [esp + 0x190], 0xeb
mov word [esp + 0x192], 0x66
mov word [esp + 0x194], 0x67
mov word [esp + 0x196], 0x68
mov word [esp + 0x198], 0xef
mov word [esp + 0x19a], 0x6a
mov word [esp + 0x19c], 0x6b
mov word [esp + 0x19e], 0x6c
mov word [esp + 0x1a0], 0x6d
mov word [esp + 0x1a2], 0x6e
mov word [esp + 0x1a4], 0xf6
mov word [esp + 0x1a6], 0x70
mov word [esp + 0x1a8], bx
mov word [esp + 0x1aa], bp
mov word [esp + 0x1ac], di
mov word [esp + 0x1ae], si
mov word [esp + 0x1b0], 0xfc
mov word [esp + 0x1b2], dx
mov word [esp + 0x1b4], cx
mov word [esp + 0x1b6], ax
mov word [esp + 0x1b8], 0xff
mov word [esp + 0x1ba], 0x7a
mov word [esp + 0x1bc], 0xc3
mov word [esp + 0x1be], 0x42
mov word [esp + 0x1c0], 0x43
mov word [esp + 0x1c2], 0x44
mov word [esp + 0x1c4], 0x45
mov word [esp + 0x1c6], 0x46
mov word [esp + 0x1c8], 0x47
mov word [esp + 0x1ca], 0x48
mov word [esp + 0x1cc], 0x49
mov word [esp + 0x1ce], 0x4a
mov word [esp + 0x1d0], 0x4b
mov word [esp + 0x1d2], 0x4c
mov word [esp + 0x1d4], 0x4d
mov word [esp + 0x1d6], 0xd1
mov word [esp + 0x1d8], 0xd5
mov word [esp + 0x1da], 0x50
mov word [esp + 0x1dc], 0x51
mov word [esp + 0x1de], 0x52
mov word [esp + 0x1e0], 0x53
mov word [esp + 0x1e2], 0x54
mov word [esp + 0x1e4], 0x55
mov word [esp + 0x1e6], 0x56
mov word [esp + 0x1e8], 0x57
mov word [esp + 0x1ea], 0x58
mov word [esp + 0x1ec], 0x59
mov word [esp + 0x1ee], 0x5a
mov word [esp + 0x1f0], 0xe3
mov word [esp + 0x1f2], 0x62
cmp word [esp + 0x10], 0x20
mov word [esp + 0x1f4], 0x63
mov word [esp + 0x1f6], 0x64
mov word [esp + 0x1f8], 0x65
mov word [esp + 0x1fa], 0x66
mov word [esp + 0x1fc], 0x67
mov word [esp + 0x1fe], 0x68
mov word [esp + 0x200], 0x69
mov word [esp + 0x202], 0x6a
mov word [esp + 0x204], 0x6b
mov word [esp + 0x206], 0x6c
mov word [esp + 0x208], 0x6d
mov word [esp + 0x20a], 0xf1
mov word [esp + 0x20c], 0xf5
mov word [esp + 0x20e], 0x70
mov word [esp + 0x210], bx
mov word [esp + 0x212], bp
mov word [esp + 0x214], di
mov word [esp + 0x216], si
mov word [esp + 0x218], 0x75
mov word [esp + 0x21a], dx
mov word [esp + 0x21c], cx
mov word [esp + 0x21e], ax
mov word [esp + 0x220], 0x79
mov word [esp + 0x222], 0x7a
jb 0x47b377
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and eax, 0xff
sub eax, 7
je 0x47b1c8
sub eax, 3
je 0x47b1c1
sub eax, 2
jne 0x47b1cd
mov esi, 0x1b
jmp 0x47b1cd
mov esi, 0x1f
jmp 0x47b1cd
mov esi, 7
mov eax, dword [esp + 0x10]
xor ebp, ebp
and eax, 0xffff
xor dl, dl
mov byte [esp + 0x17], dl
lea ecx, [eax - 0x5e]
cmp ecx, 0x56
ja case.0x47b1ee.100
xor ebx, ebx
mov bl, byte [ecx + 0x47b498]
jmp dword [ebx*4 + 0x47b47c]
mov ebp, 1
mov edi, dword [esp + 0x18]
mov ecx, dword [edi + 0x118]
and ebp, esi
test ecx, ecx
je 0x47b2de
mov cx, word [esp + 0x10]
test ebp, ebp
jne 0x47b33a
cmp cx, 0x41
jb 0x47b227
cmp cx, 0x5a
jbe 0x47b23b
cmp cx, 0x61
jb 0x47b2d8
cmp cx, 0x7a
ja 0x47b2d8
push eax
call fcn.005c42cd
mov esi, eax
mov eax, dword [edi + 0x118]
add esp, 4
mov ecx, edi
neg esi
sbb esi, esi
push eax
neg esi
call fcn.0047a040
lea edx, [eax + eax*2]
lea ecx, [esi + esi*2]
shl ecx, 1
lea eax, [eax + edx*4]
mov edx, dword [esp + 0x10]
shl eax, 2
sub eax, ecx
mov cx, word [esp + 0x10]
and edx, 0xffff
add eax, edx
mov ax, word [esp + eax*2 - 0x66]
cmp cx, ax
je 0x47b2d8
mov bl, byte [esp + 0x17]
mov cx, ax
mov word [esp + 0x10], cx
mov dl, 1
jmp 0x47b2e7
mov ebp, 2
jmp case.0x47b1ee.100
mov ebp, 4
jmp case.0x47b1ee.100
mov ebp, 8
jmp case.0x47b1ee.100
mov ebp, 0x10
jmp case.0x47b1ee.100
mov edi, dword [esp + 0x18]
mov cl, byte [edi + 0x122]
neg cl
sbb ecx, ecx
and ecx, 4
add ecx, 4
mov ebp, ecx
jmp 0x47b1fe
mov bl, 1
mov dl, bl
jmp 0x47b2e7
mov cx, word [esp + 0x10]
mov bl, byte [esp + 0x17]
test ebp, ebp
jne 0x47b33a
mov eax, dword [edi + 0x118]
test eax, eax
je 0x47b323
test bl, bl
je 0x47b323
mov word [esp + 0x12], cx
push eax
mov ecx, edi
call fcn.0047a040
mov ax, word [eax*4 + str._]
lea ecx, [esp + 0x10]
push 3
lea edx, [edi + 0x114]
push ecx
mov word [esp + 0x18], ax
push edx
jmp 0x47b355
lea eax, [esp + 0x10]
push 3
lea ecx, [edi + 0x114]
push eax
mov word [esp + 0x1a], 0
push ecx
jmp 0x47b355
cmp ebp, dword [edi + 0x118]
jne 0x47b369
lea edx, [esp + 0x10]
push 3
lea eax, [edi + 0x114]
push edx
mov word [esp + 0x1a], cx
push eax
call fcn.005c442d
add esp, 0xc
mov dword [edi + 0x11c], 2
jmp 0x47b36d
test dl, dl
je 0x47b38d
mov dword [edi + 0x118], 0
mov esi, dword [esp + 0x18]
pop edi
mov dword [esi + 0xc], 0
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
mov dword [edi + 0x118], ebp
jmp 0x47b377
mov dword [esi + 0x11c], 0
mov dword [esi + 0xc], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
mov eax, dword [esi + 0xc]
cmp eax, 0x100
je 0x47b3db
cmp eax, 0x104
je 0x47b3db
mov byte [esi + 0x120], 0
mov dword [esi + 0xc], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
mov byte [esi + 0x120], 1
mov dword [esi + 0xc], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
mov eax, dword [esi + 0xc]
cmp eax, 0x100
je 0x47b41e
cmp eax, 0x104
je 0x47b41e
mov byte [esi + 0x121], 0
mov dword [esi + 0xc], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
mov byte [esi + 0x121], 1
mov dword [esi + 0xc], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
mov eax, dword [esi + 0xc]
cmp eax, 0x100
je 0x47b461
cmp eax, 0x104
je 0x47b461
mov byte [esi + 0x122], 0
mov dword [esi + 0xc], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
mov byte [esi + 0x122], 1
mov dword [esi + 0xc], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret