3a16e68201
Some processes just return from the entry point; this only exits the thread, not the process. It seems that when ANSICON created its flush thread in DllMain, that became the primary thread, so when the entry point returned the process was still waiting for the flush thread to exit. Creating the flush thread the first time it is used avoids this problem, letting the process exit.
ANSICON 
ANSICON provides ANSI escape sequences for Windows console programs. It
provides much the same functionality as ANSI.SYS does for MS-DOS.
Requirements
- 32-bit: Windows 2000 Professional and later (it won't work with NT or 9X).
- 64-bit: AMD64 (it won't work with IA64).
How it Works
ANSICON injects a DLL into a process, hooking its functions.
Injection
One of three methods is used to inject the DLL.
-
LoadLibraryviaCreateRemoteThreadfor a running process. -
LdrLoadDllviaCreateRemoteThreadfor a 64-bit .NET AnyCPU process. -
Adding the DLL directly to the import table, otherwise.
Hooking
Hooking is achieved by modifying import addresses, or the return value of
GetProcAddress.