Function at 0x4052b0
Capabilities:
Get file attributes
Log keystrokes via polling
Manipulate console buffer

Disassembly:
mov edx, 0x44eb60
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x405297
ret
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x448ab6
push eax
mov dword fs:[0], esp
sub esp, 0xd68
cmp dword [0x70c7f4], 0x6a6
push ebx
push esi
push edi
jne 0x40545a
call dword [sym.imp.USER32.dll_GetShellWindow]
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetScrollInfo]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
call dword [sym.imp.USER32.dll_GetDC]
push esi
lea eax, [ebp - 0x570]
push eax
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_CreateDiscardableBitmap]
xor ecx, ecx
xor edx, edx
mov word [ebp - 0x12], dx
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x14], cx
mov ecx, dword [ebp - 0x14]
push ecx
push esi
lea edx, [ebp - 0xd70]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
xor ecx, ecx
push ecx
xor eax, eax
push eax
push esi
call dword [sym.imp.USER32.dll_RealChildWindowFromPoint]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_GetEventLogInformation]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
push esi
push 0x4036df
push 0x44eb60
call fcn.004081e2
add esp, 0xc
lea ecx, [ebp - 0xa0]
call fcn.004081fc
lea ecx, [ebp - 0xa0]
call fcn.004082da
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x14], 0x403828
call fcn.0040820d
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x402424
call fcn.004082da
push esi
call fcn.00408448
add esp, 4
push esi
call fcn.00408419
add esp, 4
push esi
push esi
call fcn.0040842f
push esi
push esi
call fcn.00408599
add esp, 0x10
jmp 0x405290
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthI]
xor esi, esi
cmp esi, 0x98ec
jge 0x405478
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 0
call edi
inc esi
cmp esi, 0x11aba
jl 0x405462
mov eax, 0x11b1b
add dword [0x70c7f4], eax
call fcn.004051a0
call fcn.004051c0
xor esi, esi
cmp dword [0x70c7f4], esi
jbe 0x4054e9
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
lea esp, [esp]
mov edx, dword [0x70d194]
mov al, byte [edx + esi + 0x11b1b]
mov ecx, dword [0x7096fc]
mov byte [ecx + esi], al
cmp dword [0x70c7f4], 0xa8
jne 0x4054e0
push 0
push 0
push 0
push 0
call edi
push 0
call ebx
inc esi
cmp esi, dword [0x70c7f4]
jb 0x4054b0
mov esi, dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
mov edi, dword [sym.imp.USER32.dll_MessageBoxIndirectA]
mov ebx, dword [sym.imp.USER32.dll_LoadMenuA]
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [0x70c7f4]
add edx, eax
cmp edx, 0xe
jne 0x40558f
push 0x30
lea eax, [ebp - 0xd0]
push 0
push eax
mov dword [ebp - 0xd4], 0
call fcn.0040b2e0
add esp, 0xc
push 0
lea ecx, [ebp - 0xd4]
push ecx
push 0
call esi
push 0
call edi
push 0
push 0
call ebx
call dword [sym.imp.USER32.dll_GetKBCodePage]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push 0
push 0
lea edx, [ebp - 0xd70]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
push 0x403838
lea eax, [ebp - 0x570]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 0x4f95a3
mov dword [ebp - 0x10], eax
jl 0x405500
mov edi, dword [sym.imp.GDI32.dll_GetCharABCWidthsA]
mov esi, 0x4f4
lea esp, [esp]
push 0
push 0
push 0
push 0
call edi
sub esi, 1
jne 0x4055b0
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
cmp esi, 0x26c0e8
jge 0x405915
mov dword [ebp - 0x40], 0x492cbb35
mov dword [ebp - 0x74], 0x57f15988
mov dword [ebp - 0x84], 0x685fa56c
mov dword [ebp - 0x60], 0x5f52e86f
mov dword [ebp - 0x20], 0xd1ff52e
mov dword [ebp - 0x2c], 0x554ac3e1
mov dword [ebp - 0x58], 0x7c83830a
mov dword [ebp - 0x48], 0x3bb08b8b
mov dword [ebp - 0x64], 0x69cbbd1c
mov dword [ebp - 0x68], 0x663a8906
mov dword [ebp - 0x44], 0x562c53be
mov dword [ebp - 0x14], 0x5a7e1795
mov dword [ebp - 0x8c], 0x3dee83ac
mov dword [ebp - 0x94], 0x3b647778
mov dword [ebp - 0x90], 0x6a21946b
mov dword [ebp - 0x10], 0x182893a8
mov dword [ebp - 0x24], 0x2d22ab3d
mov dword [ebp - 0x88], 0xa56ef9c
mov dword [ebp - 0x3c], 0x7989dc1c
mov dword [ebp - 0x1c], 0x7303bf3f
mov dword [ebp - 0x18], 0x5a71ba29
mov dword [ebp - 0x54], 0x6c1701b3
mov dword [ebp - 0x5c], 0x128a3532
mov dword [ebp - 0x34], 0x60601bc1
mov dword [ebp - 0x7c], 0x68a2386a
mov dword [ebp - 0x38], 0x7dbfe29a
mov dword [ebp - 0x80], 0x640cd771
mov dword [ebp - 0x4c], 0x204e82b1
mov dword [ebp - 0x78], 0x2bd19ec0
mov dword [ebp - 0x6c], 0x2fb012ce
mov dword [ebp - 0x30], 0x665d386a
mov dword [ebp - 0x50], 0x7218dbfa
mov dword [ebp - 0x28], 0x77cf54d1
mov dword [ebp - 0x70], 0x22aa174f
add dword [ebp - 0x74], 0x734e7382
sub dword [ebp - 0x40], 0x639dca36
add dword [ebp - 0x84], 0x2575138c
add dword [ebp - 0x74], 0x15194e20
add dword [ebp - 0x74], 0x63853852
mov eax, 0x70a53373
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
add dword [ebp - 0x40], 0x6132c6ff
sub dword [ebp - 0x74], 0x61886423
sub dword [ebp - 0x40], 0x2346fcc
sub dword [ebp - 0x84], 0x43f5502a
mov eax, 0x3a0bf46d
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
add dword [ebp - 0x84], 0xc500736
sub dword [ebp - 0x84], 0x3d6e1371
sub dword [ebp - 0x74], 0x688cded3
sub dword [ebp - 0x40], 0x47bd50
add dword [ebp - 0x84], 0xe89261b
sub dword [ebp - 0x20], 0x3ee825e9
add dword [ebp - 0x58], 0x761ea406
mov eax, 0x6e457933
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
sub dword [ebp - 0x60], 0x29cd2ef6
mov eax, 0x4564e111
mul dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
sub dword [ebp - 0x2c], 0x749c9adb
sub dword [ebp - 0x14], 0x291117ea
add dword [ebp - 0x14], 0x5a9b2ee1
add dword [ebp - 0x2c], 0x7b80caff
mov eax, 0x5368920c
mul dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x60], 0x79faaceb
mov eax, 0x28a926d0
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x24], 0x772f010
mov eax, 0x1c10977
mul dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x88], 0x38d739b6
sub dword [ebp - 0x74], 0x37ec8f36
sub dword [ebp - 0x14], 0x71fc8666
mov eax, 0x3c80f4dd
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, 0x440f13af
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, 0x78613148
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x68], 0x52a74fd7
add dword [ebp - 0x2c], 0x45f1693a
add dword [ebp - 0x64], 0x12ebce78
add dword [ebp - 0x38], 0x6c76e8ea
mov eax, 0x447bdbdc
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
sub dword [ebp - 0x88], 0xc28836a
sub dword [ebp - 0x1c], 0x57cdd716
add dword [ebp - 0x10], 0x17c546ac
mov eax, 0x6b2b0404
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0x48], 0x398e75f6
mov eax, 0x67627e6a
mul dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
sub dword [ebp - 0x40], 0x4af931b2
sub dword [ebp - 0x10], 0x5e0064ad
sub dword [ebp - 0x18], 0x218e944
mov eax, 0x391fca52
mul dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x60], 0x28829cab
add dword [ebp - 0x34], 0x73966dab
sub dword [ebp - 0x10], 0x29b8c81c
sub dword [ebp - 0x4c], 0x715e631a
add dword [ebp - 0x88], 0x5b533554
add dword [ebp - 0x48], 0x2d3a7178
mov eax, 0x3818b5bf
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
add dword [ebp - 0x78], 0x51e1f57e
mov eax, 0x6c271a1d
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0x48], 0x1fda0b6d
sub dword [ebp - 0x3c], 0x3cd49a01
mov eax, 0x12804e49
mul dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
sub dword [ebp - 0x10], 0x600e9b1e
mov eax, 0x6b82ae34
mul dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
add dword [ebp - 0x94], 0x64f5a0e4
cmp esi, 0x2735c9
jg 0x40592a
inc esi
cmp esi, 0x1f6e7e0
jl 0x4055c5
call fcn.00404fe0
xor edx, edx
cmp edx, 0x26
jne 0x40593b
call fcn.00405180
inc edx
cmp edx, 0x409495
jl 0x405931
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov ebx, 0x7b
jmp 0x405960
cmp dword [0x70c7f4], 0x86
jne 0x405976
push 0
call esi
push 0
push 0
call edi
sub ebx, 1
jne 0x405960
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edi, dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov dword [ebp - 0x10], 0x180ef
cmp dword [0x70c7f4], 0x1f
jne 0x4059b5
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0
call esi
push 0
push 0
call edi
push 0
call ebx
sub dword [ebp - 0x10], 1
jne 0x405994
push 0x403864
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.00405280
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret