Function at 0x40e089
Capabilities:
Hide graphical window
Inspect load icon resource
Log keystrokes via application hook
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
nop
mov eax, 0x4b
mov byte [ebp - 0x12], al
mov eax, 0x65
mov byte [ebp - 0x11], al
mov eax, 0x79
mov byte [ebp - 0x10], al
mov eax, 0x62
mov byte [ebp - 0xf], al
mov eax, 0x6f
mov byte [ebp - 0xe], al
mov eax, 0x61
mov byte [ebp - 0xd], al
mov eax, 0x72
mov byte [ebp - 0xc], al
mov eax, 0x64
mov byte [ebp - 0xb], al
mov eax, 0x48
mov byte [ebp - 0xa], al
mov eax, 0x6f
mov byte [ebp - 9], al
mov eax, 0x6f
mov byte [ebp - 8], al
mov eax, 0x6b
mov byte [ebp - 7], al
mov eax, 0x43
mov byte [ebp - 6], al
mov eax, 0x6c
mov byte [ebp - 5], al
mov eax, 0x61
mov byte [ebp - 4], al
mov eax, 0x73
mov byte [ebp - 3], al
mov eax, 0x73
mov byte [ebp - 2], al
mov eax, 0
mov byte [ebp - 1], al
mov eax, 3
mov dword [ebp - 0x5c], eax
mov eax, 0x40e633
mov dword [ebp - 0x58], eax
mov eax, 0
mov dword [ebp - 0x54], eax
mov eax, 0
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [0x5717d0], eax
mov eax, 0x65
push eax
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x48], eax
mov eax, 0x7f89
push eax
mov eax, 0
push eax
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x44], eax
mov eax, 3
push eax
call sub.gdi32.dll_GetStockObject
mov dword [ebp - 0x40], eax
mov eax, 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x12]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x5c]
push eax
call sub.user32.dll_RegisterClassA
test eax, eax
je 0x40e1aa
jmp 0x40e1cf
mov eax, 0x10
push eax
lea eax, [ebp - 0x12]
push eax
mov eax, str.This_program_requires_Windows_NT_
push eax
mov eax, 0
push eax
call sub.user32.dll_MessageBoxA
mov eax, 1
jmp 0x40e62f
mov eax, 0
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, 0x40549d
push eax
mov eax, 0xd
push eax
call sub.user32.dll_SetWindowsHookExA
mov dword [0x571390], eax
mov eax, dword [0x571390]
cmp eax, 0
jne 0x40e226
mov eax, 0x10
push eax
mov eax, 0x56edfa
push eax
mov eax, str.Failed_to_install_keyboard_hook__Please_contact_to_programmer.
push eax
mov eax, 0
push eax
call sub.user32.dll_MessageBoxA
mov eax, 1
jmp 0x40e62f
mov eax, 0x12b
push eax
mov eax, 0xbe
push eax
call fcn.00410fc2
add esp, 8
mov ecx, 0
push ecx
mov ecx, dword [ebp + 8]
push ecx
mov ecx, 0
push ecx
mov ecx, 0
push ecx
mov ecx, 0x44
push ecx
mov ecx, 0x12c
push ecx
mov ecx, 0
push ecx
push eax
mov eax, 0xca0008
push eax
mov eax, 0x56ee00
push eax
lea eax, [ebp - 0x12]
push eax
mov eax, 0
push eax
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 0x18], eax
mov eax, 0x56ee18
push eax
mov eax, dword [str.Qk02AAMAAAAAADYAAAAoAAAAAAEAAAABAAABABgAAAAAAAAAAAAQFwAAEBcAAAAAAAAAAAAAiK_agqfYe6XaZpnacqLahqragKjYhKzaiK_bfarcg6rccaDZXpTYYpfZeKTZeqbaZ5raWZDZVI3YWpLZW5TZaZ3XdqXbdaLacp_aZJbZZprZfqrcfancg6vdgarcdqLaaJzaZ5vbaZvbZ5zbYZjaXJbbW5XbZZrbXJPaWY_WXpLYWpLZW5PZW5baXpbaWZHZWI_ZWJHbWZTbWpXbWZPbW5PbW5LZXJTbW5TaVo_YX5PYYZXZW5Xaf6zdiK_eg63diLLdmb7hibPfaaHddKbckbnfkbjfbqPdYZvbaJ_cYJnbWZLaWI_YWI7ZWpHZW5HZXJTbXZbbXZXbXJTbWZHaWpLaWpHZWpDYWZHZWZHaW5XcXpjcYJrcX5jbYJrbYZ7cZaLdY6DcYp7cYZvcXZjbYZnbYJrbX5zeYJ3cYZ7bYp_cYZ3aZJ_cY53aZKDcZqHdZKHdaqjfaKXfZaPfZ6bhZaPgaKbhaKfhZqPhZKHhYqDgYqHhYZ_fYJ7eX57eXpzcXpvcXprcXZnbXZrbXprcX5zcXpzcXJncXJjcXJreW5jdW5bcW5jdW5fdW5fdW5bcWpXcWpXcWZTbV5HZV5HYV5PZWJPZV5PaX5nabKTcZZ3aXJbZXZfZXZjaXZfaZJ3bZZ_bbaDcb6DcYZzbYpvbZJzcYprcdKTdha7fg6zfhK7fhK7fcqPdh7LhlLrjl7zjk7fjjrbjjLXjfazhfKrgZZ_fiLXjibXjhrHif67ijLXihK_hdqfgaaDfXpvfbaXfbaPfYJreX5vfYZ3fbqTeY5vdaJ3cZZzdWpXdWZPdXZbcYJjcW5jdXJjeWpjeV5fcWpzeXp3cXJfcWpfdXJjeXpnfX5zeX53eYJ3eYJ7eYZ3dXZnaXpzdX53fYJ3eX5zdX5zeYp3eYp7eYJ3eYJveYZ3dYZzcX5rcYJrcX5ncXpbUWo7EW4exZICYXWdvZm91dn2BeX2BfYGEfXCdnl9UVNUR0lKSElKSElKSUpMSktMSUlLSUlMRkdIRkZHV11iaZrYT4vWU5DbU4_bU5DaUY7aUo_ZUY7ZUY7ZU5HbUY_bUo_aVZLcVJDbUo_bUY7aUo_bVI7aVZDbVZDbVI3ZUo3aUYzaUYzaUo7aVI7ZUozZUYzaUozZUYzaUo3aVI3ZVY7ZVY_aVJDbVI_bVY7aVY_aVpDaVI7aVpDbVo_ZVpDaVpHaVpLbV5PcV5LbWJTbWZPbWZPcWJPcWJPbWZTcWZXcWZbcWJTcVpLbWJLbVpLcV5PcWJTcVZTbVZTcWJjcWJbcWJjcWpfcXJjdWpfcWZjbWJXcWpjcXZncWJbcV5LcVpDbVZDbVpDbVY_bVZDbVpLbVZHcVpHbVpLbVZLbWJXbV5PbVpPaV5PbWZbdW5jeW5fcW5ndWpncXZrcXpvcW5ncXJvcXZvbXZvcXZrbXJfZXJvcWpbWV5TTXp3cXp7cXp7bXp7bXZvaXZrbXJncXZrcXZzeX57eXpzeXpzeX57eYaHgYaHgYaPhYKHhX57hYaDhX5_gXJreW5rcXJvdXJzcW5ndW5ncWZfbWZfbWpjcWZfcWZfcWZfcWZfdWZbdWZfdWpfdWpfdWZbcWZbdWZfdWpbcWZXbV5TaWJPZWJTZV5PZWJPaV5LaVpLZV5HYV5LZV5LYV5LZV5LZVpLaVpLaVZPbVZPbWJTbV5XcVpXbV5bcVpXdVJTdVJPcVJTdVZbdVpbeVZXeVZbfVpffVZbfVpfgV5ngWJffVpbfWZrgVpjgVpfgVpbgV5XgVZXgVpTfVpTeV5beWZfeWJXeV5beWJbeWJbeV5beVJPdVZTdU5PdVJXdVpbdVpbdV5fdV5neV5rdWJreV5reWJzfWZzfWZrfWJneWZjfW5rfXJrfW5rfWZrfW5vfWpreW5neXJreXJveXJreXZreXZndXJneXZveXJndXJveXJndXZrdXZrdXJjbXJjbXJjaW5fXXJbUVH6mRVJeRElQSlBXS01PUFVXXGBiXGBiUlVXRkdIRUZIRkZIRUZGR0hJR0hJSEhJSEhJSkpLS0tLVVlecqXbVJDYWJTcV5XbVZTbVZPcVJHYVZLZVJDbVZHbVpLcU4_bU5DcU5DcVJLdVJDcU4_bUo7bU5DcVJPdU47bU4_bU4_bU47aVJDbVJDbVI_bVI_aVY_bVI_aVZHbVpHaVY_bVZDcVpLcVpPcVZLbVZHbVpDZVpHaVpPbV5LbV5LaVpPaV5XcV5TcWJbcWpndWpfcWJXdWJXcWZfcWJbdWJbcWZfdV5XcVpLbVpLbV5PcVZHbVJDaVpHbVZDbVJDaU4_aVpDaV5PbVpLbVJHaVpLaVZHaVZDZU4_ZVJDaVI7aU4_aU5HaVJDaVI_aVZLbVZLbVZHbVZHbV5PbV5TbVpLaV5PaVpLaV5TbWJfcWpjcWZfcWZjcWpjbWpjbWpncWpnbWZfbW5nbW5rbWZjbWpjbWpjcUYvLUo3QXJzdWJjbWpnbWpnbWJfaWpfaWZjbWZjbW5rcW5vdWprdWpndXJveXZ3fXJ3gXqDgXZ7gXp3gX6DhX5_gWpndWZfbWZjbWZjcWJfcWZfcWJbbWJbbWZjcWZjdWJXcWJfcWZbcV5TdWZXdWJTcV5PbV5PbV5LbV5PbV5PbVpPbV5PbVpLaVpLaVZHZVpHZVpPaVpTZVpPZVpPZVpPZVpPaV5PaV5PaV5TbWZbcWZXbWJXbWJXcV5TbV5XdWZXdWJXdWJPdVpHcVJDcVpPdV5TeWJTeWZXeWpbfW5ffXJngXJjgW5ngWpjfWpffWpjfWpjgW5fgWpXfWpbfWZjfWJbeV5XeWJbeWJnfV5feVpbeVpfeVpjdVJbdVJbdU5XdVZbcVpfcV5reV5reV5ndV5jdV5reWJzeWZzfWJneV5feWJjeW5neW5neWJjeVZbeWJjdWZjdW5neW5jdW5jdW5ndXJjdW5ndW5jdW5ndW5ncXJndWpbcW5jcW5bbWpXaWpXaWpTXW5fdV4nDQktXOz1CQ01ZQ0RHQUFDP0FCSUtNU1VVUlNURUZHQUJEQ0RGQUJEQUJEQEFDQUNEQUJEQkNGQ0NDTlZhfaraUY7XVZPbVZTbU5HZU5HaU5LYU5LYU5DbUo_cU5DcUo_cUo_cUpDcU5HdUY7bUIvaUYzbUY7cU5DdUo7cUo7aUo7bUYzaUo3aUo7aUo3ZUo3aVJHbU5DbUo7aUo_bUY7aUo_bU4_bVJHbVJDbVJDbVJHbVJHbVJHbVZLbVZPaVZPbVZPbVZPbVpbdVpXcV5PbVZPcVZTcVZTcV5XdVZPcVpXcVZLbVZPbVJLbVpPcVZTcVJLbVJLcVJLbVJPbVJHaVJHbVJHaVJDaVJHaVJLbVJDaU5DaU5DaVJDaVJHaU5HaVJLaVpPbVpPbVpTbVpPcV5TcV5XbV5TbV5XbV5XbV5PaV5XbWZjbWZjcW5veW5rdXJvdW5vcW5rcXJvcW5rcWpfbXZ3cXZ7cXJvbXpzcXZzcW5rZW5vaXJzcXJzcXZ3cW5zcWprbW5ncWpjbW5rbW5rcWZndWZfcWZfcWpjdW5feXZvfYKHgXp7gXp_hX6HhX6DhW5veWpncW5rcWZfcWJbbWZbbWZbbWpbbWZbcWZbcWJTcWJTbWJPbWJPcV5LcV5LbVpHbVpLbVpHbVpHbVpDaVZDaVpLbVpLZVZHYVJDYVZHZVZHZVZHZVZDYVZDXVZHYVZDYVZDZVpDZVZLaVpPbVpPaV5TbV5PbVZLaV5TcV5XdVpTdVpXdWJbdV5TdVpPdVpTeVpLeVpPeWJXfWZjgWZffV5XeWZfgWZjgV5beV5bfV5ffV5bfV5beWJjfWZneV5fdV5bdVpXdV5bdVpbdVpfeVpfeVpjcU5XcVJbdVJfdVJbcV5rdWJveVZfdV5jdV5fdV5feV5jeV5bdV5beVpXdWJbdW5reW5ndWJfdVZTdWJjdWpfdWpbcWpfdWZfdWpjdWpbcWpbcW5bcW5fdWpfcWpfcWpfbW5fcW5jbWpfaW5fYW5naVo7ERVdoPDs8P0NI]
push eax
call fcn.00413708
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.0040de7e
add esp, 4
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_UpdateWindow
mov eax, 0x56ee3c
push eax
mov eax, 0x10
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0x190
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0x11
push eax
call sub.gdi32.dll_CreateFontA
mov ecx, 1
push ecx
push eax
mov eax, 0x30
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_SendMessageA
mov eax, 3
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0xffffffff
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_SetWindowPos
mov eax, str.advapi32.dll
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp eax, 0
jne 0x40e386
mov eax, str.Error_loading_advapi32.dll_
push eax
call sub.msvcrt.dll_puts
add esp, 4
mov eax, 1
jmp 0x40e62f
mov eax, str.RegOpenKeyExA
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x64], eax
mov eax, str.RegSetValueExA
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x68], eax
mov eax, str.RegCloseKey
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x40e3e2
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x40e3e2
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x40e3e2
jmp 0x40e403
mov eax, str.Error_getting_function_addresses.
push eax
call sub.msvcrt.dll_puts
add esp, 4
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_FreeLibrary
mov eax, 1
jmp 0x40e62f
mov eax, 0x104
push eax
lea eax, [ebp - 0x170]
push eax
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleFileNameA
cmp eax, 0
jne 0x40e44b
call sub.kernel32.dll_GetLastError
push eax
mov eax, str.Error_getting_file_name:__ld_n
push eax
call sub.msvcrt.dll_printf
add esp, 8
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_FreeLibrary
mov eax, 1
jmp 0x40e62f
lea eax, [ebp - 0x170]
push eax
mov eax, str.Executable_path:__s_n
push eax
call sub.msvcrt.dll_printf
add esp, 8
lea eax, [ebp - 0x174]
push eax
mov eax, 2
push eax
mov eax, 0
push eax
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun
push eax
mov eax, 0x80000001
push eax
mov eax, dword [ebp - 0x64]
call eax
cmp eax, 0
jne 0x40e4fe
lea eax, [ebp - 0x170]
push eax
call sub.msvcrt.dll_strlen
add esp, 4
inc eax
push eax
lea eax, [ebp - 0x170]
push eax
mov eax, 1
push eax
mov eax, 0
push eax
mov eax, 0x56ef21
push eax
mov eax, dword [ebp - 0x174]
push eax
mov eax, dword [ebp - 0x68]
call eax
cmp eax, 0
jne 0x40e4df
mov eax, str.Registry_key_set_successfully.
push eax
call sub.msvcrt.dll_puts
add esp, 4
jmp 0x40e4ed
mov eax, str.Failed_to_set_registry_key_
push eax
call sub.msvcrt.dll_puts
add esp, 4
mov eax, dword [ebp - 0x174]
push eax
mov eax, dword [ebp - 0x6c]
call eax
jmp 0x40e50c
mov eax, str.Failed_to_open_registry_key.
push eax
call sub.msvcrt.dll_puts
add esp, 4
mov eax, 0x19c
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x310]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x19c
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30c], eax
mov eax, 1
mov dword [ebp - 0x308], eax
mov eax, 0x17
mov dword [ebp - 0x304], eax
mov eax, 0x65
push eax
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
cmp eax, 0
jne 0x40e575
mov eax, str.Welcome_again_
push eax
lea eax, [ebp - 0x2f8]
push eax
call sub.msvcrt.dll_strcpy
add esp, 8
mov eax, str.Welcome_again_by_Hasin_Israk_Toaha.
push eax
lea eax, [ebp - 0x2b8]
push eax
call sub.msvcrt.dll_strcpy
add esp, 8
mov eax, str.Shahid_Mughdho_Keyboard
push eax
lea eax, [ebp - 0x1b8]
push eax
call sub.msvcrt.dll_strcpy
add esp, 8
mov eax, 1
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x310]
push eax
mov eax, 0
push eax
call sub.shell32.dll_Shell_NotifyIconA
test eax, eax
je 0x40e5de
jmp 0x40e5de
lea eax, [ebp - 0x310]
push eax
mov eax, 1
push eax
call sub.shell32.dll_Shell_NotifyIconA
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x34]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
je 0x40e627
lea eax, [ebp - 0x34]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x34]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x40e5f0
mov eax, dword [ebp - 0x2c]
jmp 0x40e62f
leave
ret 0x10