Function at 0x405320
Capabilities:
Get file attributes
Log keystrokes via polling
Manipulate console buffer

Disassembly:
mov edx, 0x4a0b60
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x405307
ret
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49ae06
push eax
mov eax, 0x1178
mov dword fs:[0], esp
call fcn.00416950
cmp dword [0x75e7f4], 0x6a6
push ebx
push esi
push edi
jne 0x4054e1
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetScrollInfo]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0x40386c
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_ModifyMenuA]
push esi
lea eax, [ebp - 0x1180]
push eax
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push esi
push esi
lea ecx, [ebp - 0x18]
push ecx
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_CreateDiscardableBitmap]
xor edx, edx
xor eax, eax
mov word [ebp - 0x12], ax
lea ecx, [ebp - 0x10]
push ecx
mov word [ebp - 0x14], dx
mov edx, dword [ebp - 0x14]
push edx
push esi
lea eax, [ebp - 0x980]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
push esi
push esi
lea ecx, [ebp - 0xb0]
push ecx
push esi
call dword [sym.imp.USER32.dll_DrawEdge]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_GetEventLogInformation]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
push esi
push 0x4036df
push 0x4a0b60
call fcn.00408232
add esp, 0xc
lea ecx, [ebp - 0xa0]
call fcn.0040824c
lea ecx, [ebp - 0xa0]
call fcn.0040832a
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x14], 0x403880
call fcn.0040825d
mov dword [ebp - 0xa0], 0x402424
lea ecx, [ebp - 0xa0]
call fcn.0040832a
push esi
call fcn.00408498
add esp, 4
push esi
call fcn.00408469
add esp, 4
push esi
push esi
call fcn.0040847f
push esi
push esi
call fcn.004085e9
add esp, 0x10
jmp 0x405300
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthI]
xor esi, esi
lea esp, [esp]
cmp esi, 0x9c0c
jge 0x405506
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
call edi
inc esi
cmp esi, 0x13612
jl 0x4054f0
mov eax, 0x11b1b
add dword [0x75e7f4], eax
call fcn.00405210
call fcn.00405230
xor esi, esi
cmp dword [0x75e7f4], esi
jbe 0x40557a
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
lea ebx, [ebx]
mov ecx, dword [0x75f194]
mov dl, byte [ecx + esi + 0x11b1b]
mov eax, dword [0x75b6fc]
mov byte [eax + esi], dl
cmp dword [0x75e7f4], 0xa8
jne 0x405571
push 0
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
inc esi
cmp esi, dword [0x75e7f4]
jb 0x405540
mov esi, dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
mov edi, dword [sym.imp.USER32.dll_MessageBoxIndirectA]
mov ebx, dword [sym.imp.USER32.dll_LoadMenuA]
xor eax, eax
mov dword [ebp - 0x10], eax
mov ecx, dword [0x75e7f4]
add ecx, eax
cmp ecx, 0xe
jne 0x405627
push 0x30
lea edx, [ebp - 0xe0]
push 0
push edx
mov dword [ebp - 0xe4], 0
call fcn.0040b330
add esp, 0xc
push 0
lea eax, [ebp - 0xe4]
push eax
push 0
call esi
push 0
call edi
push 0
push 0
call ebx
push 0x403890
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push 0
push 0
lea ecx, [ebp - 0x1180]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
push 0x4038b4
lea edx, [ebp - 0x980]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 0x4f95a3
mov dword [ebp - 0x10], eax
jl 0x405591
mov edi, dword [sym.imp.GDI32.dll_GetCharABCWidthsA]
mov esi, 0x4f4
push 0
push 0
push 0
push 0
call edi
sub esi, 1
jne 0x405641
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
cmp esi, 0x26c0e8
jge 0x4059a3
mov dword [ebp - 0x3c], 0x492cbb35
mov dword [ebp - 0x40], 0x57f15988
mov dword [ebp - 0x18], 0x685fa56c
mov dword [ebp - 0x5c], 0x5f52e86f
mov dword [ebp - 0x68], 0xd1ff52e
mov dword [ebp - 0x90], 0x554ac3e1
mov dword [ebp - 0x54], 0x7c83830a
mov dword [ebp - 0x44], 0x3bb08b8b
mov dword [ebp - 0x88], 0x69cbbd1c
mov dword [ebp - 0x64], 0x663a8906
mov dword [ebp - 0x78], 0x562c53be
mov dword [ebp - 0x14], 0x5a7e1795
mov dword [ebp - 0x58], 0x3dee83ac
mov dword [ebp - 0x28], 0x3b647778
mov dword [ebp - 0x38], 0x6a21946b
mov dword [ebp - 0x10], 0x182893a8
mov dword [ebp - 0x7c], 0x2d22ab3d
mov dword [ebp - 0x48], 0xa56ef9c
mov dword [ebp - 0x84], 0x7989dc1c
mov dword [ebp - 0x20], 0x7303bf3f
mov dword [ebp - 0x1c], 0x5a71ba29
mov dword [ebp - 0x80], 0x6c1701b3
mov dword [ebp - 0x94], 0x128a3532
mov dword [ebp - 0x70], 0x60601bc1
mov dword [ebp - 0x50], 0x68a2386a
mov dword [ebp - 0x34], 0x7dbfe29a
mov dword [ebp - 0x60], 0x640cd771
mov dword [ebp - 0x8c], 0x204e82b1
mov dword [ebp - 0x74], 0x2bd19ec0
mov dword [ebp - 0x30], 0x2fb012ce
mov dword [ebp - 0x2c], 0x665d386a
mov dword [ebp - 0x4c], 0x7218dbfa
mov dword [ebp - 0x24], 0x77cf54d1
mov dword [ebp - 0x6c], 0x22aa174f
add dword [ebp - 0x40], 0x734e7382
sub dword [ebp - 0x3c], 0x639dca36
add dword [ebp - 0x18], 0x2575138c
add dword [ebp - 0x40], 0x15194e20
add dword [ebp - 0x40], 0x63853852
mov eax, 0x70a53373
mul dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
add dword [ebp - 0x3c], 0x6132c6ff
sub dword [ebp - 0x40], 0x61886423
sub dword [ebp - 0x3c], 0x2346fcc
sub dword [ebp - 0x18], 0x43f5502a
mov eax, 0x3a0bf46d
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x18], 0xc500736
sub dword [ebp - 0x18], 0x3d6e1371
sub dword [ebp - 0x40], 0x688cded3
sub dword [ebp - 0x3c], 0x47bd50
add dword [ebp - 0x18], 0xe89261b
sub dword [ebp - 0x68], 0x3ee825e9
add dword [ebp - 0x54], 0x761ea406
mov eax, 0x6e457933
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub dword [ebp - 0x5c], 0x29cd2ef6
mov eax, 0x4564e111
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
sub dword [ebp - 0x90], 0x749c9adb
sub dword [ebp - 0x14], 0x291117ea
add dword [ebp - 0x14], 0x5a9b2ee1
add dword [ebp - 0x90], 0x7b80caff
mov eax, 0x5368920c
mul dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x5c], 0x79faaceb
mov eax, 0x28a926d0
mul dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
add dword [ebp - 0x7c], 0x772f010
mov eax, 0x1c10977
mul dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
sub dword [ebp - 0x48], 0x38d739b6
sub dword [ebp - 0x40], 0x37ec8f36
sub dword [ebp - 0x14], 0x71fc8666
mov eax, 0x3c80f4dd
mul dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, 0x440f13af
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, 0x78613148
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x64], 0x52a74fd7
add dword [ebp - 0x90], 0x45f1693a
add dword [ebp - 0x88], 0x12ebce78
add dword [ebp - 0x34], 0x6c76e8ea
mov eax, 0x447bdbdc
mul dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
sub dword [ebp - 0x48], 0xc28836a
sub dword [ebp - 0x20], 0x57cdd716
add dword [ebp - 0x10], 0x17c546ac
mov eax, 0x6b2b0404
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
sub dword [ebp - 0x44], 0x398e75f6
mov eax, 0x67627e6a
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
sub dword [ebp - 0x3c], 0x4af931b2
sub dword [ebp - 0x10], 0x5e0064ad
sub dword [ebp - 0x1c], 0x218e944
mov eax, 0x391fca52
mul dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
add dword [ebp - 0x5c], 0x28829cab
add dword [ebp - 0x70], 0x73966dab
sub dword [ebp - 0x10], 0x29b8c81c
sub dword [ebp - 0x8c], 0x715e631a
add dword [ebp - 0x48], 0x5b533554
add dword [ebp - 0x44], 0x2d3a7178
mov eax, 0x3818b5bf
mul dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
add dword [ebp - 0x74], 0x51e1f57e
mov eax, 0x6c271a1d
mul dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
sub dword [ebp - 0x44], 0x1fda0b6d
sub dword [ebp - 0x84], 0x3cd49a01
mov eax, 0x12804e49
mul dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
sub dword [ebp - 0x10], 0x600e9b1e
mov eax, 0x6b82ae34
mul dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x28], 0x64f5a0e4
cmp esi, 0x2735c9
jg 0x4059b8
inc esi
cmp esi, 0x1f6e7e0
jl 0x405656
call fcn.00405050
xor edx, edx
nop
cmp edx, 0x26
jne 0x4059ca
call fcn.004051f0
inc edx
cmp edx, 0x409495
jl 0x4059c0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov ebx, 0x7b
cmp dword [0x75e7f4], 0x86
jne 0x4059fa
push 0
call esi
push 0
push 0
call edi
sub ebx, 1
jne 0x4059e4
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edi, dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov dword [ebp - 0x10], 0x180ef
jmp 0x405a20
cmp dword [0x75e7f4], 0x1f
jne 0x405a41
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
call esi
push 0
push 0
call edi
push 0
call ebx
sub dword [ebp - 0x10], 1
jne 0x405a20
push 0x4038d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.004052f0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret