Function at 0x40b5f0
Capabilities:
Accept command line arguments
Create mailslot
Delete file
Get common file path
Get disk information
Get file attributes
Get hostname
Identify system language via api
Manipulate console buffer
Move file
Read .ini file
Set current directory
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x410067
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x2af0
call fcn.0040b270
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_CharUpperA]
xor ebx, ebx
xor esi, esi
lea ebx, [ebx]
cmp esi, 0x1f03c
jge 0x40b63d
push ebx
call edi
call ebp
cmp esi, 0x1e970b36
jle 0x40b659
cmp dword [esp + 0x14], 0xbd844c
je 0x40b659
cmp dword [esp + 0x74], 0x8910cb0
jne 0x40b662
inc esi
cmp esi, 0x95c3c0e2
jb 0x40b630
cmp dword [0x235b884], 0x84
jne 0x40b7a9
push ebx
call fcn.00405776
add esp, 4
push ebx
push ebx
call fcn.0040514e
push ebx
call fcn.00405776
add esp, 0xc
lea eax, [esp + 0x68]
push eax
call fcn.004046d0
mov dword [esp + 0x68], 0x403514
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x2b0c], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x2b0c], 2
xor eax, eax
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b6e0
sub eax, edx
mov esi, eax
cmp esi, 0xfffffffe
jbe 0x40b6fa
push 0x4034bc
call fcn.00404c5d
cmp esi, 0xf
jbe 0x40b70d
push ebx
push esi
lea ecx, [esp + 0x38]
push ecx
call fcn.004049f0
jmp 0x40b71a
cmp esi, ebx
jne 0x40b71c
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], 0
cmp esi, ebx
seta al
mov ebp, 0x10
test al, al
je 0x40b757
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x44], ebp
jae 0x40b736
lea eax, [esp + 0x30]
push esi
push ebx
push eax
call fcn.004060b0
mov eax, dword [esp + 0x3c]
add esp, 0xc
mov dword [esp + 0x40], esi
cmp dword [esp + 0x44], ebp
jae 0x40b753
lea eax, [esp + 0x30]
mov byte [eax + esi], 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b0c], 3
call fcn.00404800
mov esi, dword [esp + 0x1c]
push esi
lea edi, [esp + 0x34]
call fcn.00404b50
add esi, 0x1c
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x44], ebp
jb 0x40b790
mov edx, dword [esp + 0x30]
push edx
call fcn.004057a6
add esp, 4
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov byte [esp + 0x2b0c], 4
call fcn.004057b1
mov eax, 0x5d1
add dword [0x235b884], eax
mov eax, dword [0x235b884]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, dword [sym.imp.KERNEL32.DLL_ReadConsoleOutputCharacterW]
mov edi, dword [sym.imp.KERNEL32.DLL_BuildCommDCBAndTimeoutsW]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetFileType]
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateMailslotW]
mov dword [0x235182c], eax
mov eax, dword [0x235b884]
mov dword [esp + 0x14], 0x9682ab
jmp 0x40b7f0
cmp eax, 3
jne 0x40b806
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov eax, dword [0x235b884]
cmp eax, 0xdf
jne 0x40b9ec
xor ecx, ecx
lea eax, [esp + 0x64]
push eax
push ecx
push ecx
lea edx, [esp + 0xb0c]
push edx
push ecx
mov dword [esp + 0x40], ecx
call esi
xor eax, eax
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x6c]
push edx
push eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
call edi
push 0
call ebp
push 0
push 0
push 0
push 0x403330
call ebx
push 0
push 0
lea eax, [esp + 0x708]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStructW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GenerateConsoleCtrlEvent]
push 0
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea ecx, [esp + 0x60]
push ecx
push 0
lea edx, [esp + 0x38]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_PeekConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WaitNamedPipeW]
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchangeAdd]
lea ecx, [esp + 0x28]
push ecx
push 0
lea edx, [esp + 0x1f08]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetCalendarInfoA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_EnumDateFormatsW]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_IsDBCSLeadByteEx]
push 0
lea eax, [esp + 0x1704]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeW]
push 0x40327c
call dword [sym.imp.KERNEL32.DLL_DeleteVolumeMountPointA]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
push 0
lea ecx, [esp + 0x1304]
push ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetNumberFormatA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0x403370
push 0
call dword [sym.imp.KERNEL32.DLL_SetFileShortNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetProcessAffinityMask]
lea edx, [esp + 0xb0]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_OpenFileMappingA]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
push 0
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetVolumeNameForVolumeMountPointW]
push 0
call dword [sym.imp.KERNEL32.DLL_TlsFree]
push 0
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
push 0
call dword [sym.imp.KERNEL32.DLL_SetComputerNameA]
push 0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push 0x4033b0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileSectionW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x304]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
push 0
lea edx, [esp + 0x2304]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov eax, dword [0x235b884]
dec dword [esp + 0x14]
jne 0x40b7f0
xor esi, esi
test eax, eax
je 0x40ba60
mov edi, dword [sym.imp.KERNEL32.DLL__lclose]
mov ebx, dword [sym.imp.KERNEL32.DLL__hread]
mov ebp, dword [sym.imp.KERNEL32.DLL_TerminateProcess]
cmp eax, 0xfe
jne 0x40ba31
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
call fcn.0040b350
mov eax, dword [0x235b884]
cmp eax, 0x29
jne 0x40ba5b
push 0
push 0
push 0
push 0x403410
push 0x403420
call dword [sym.imp.KERNEL32.DLL_MoveFileWithProgressW]
mov eax, dword [0x235b884]
inc esi
cmp esi, eax
jb 0x40ba0e
mov ebp, dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
cmp eax, 0x70
jne 0x40bb2c
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLCID]
push 0
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
lea ecx, [esp + 0x2300]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0
lea edx, [esp + 0x1704]
push edx
call dword [sym.imp.KERNEL32.DLL_GetConsoleAliasExesW]
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_QueryInformationJobObject]
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLangID]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_EnumSystemLocalesW]
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
push 0
call ebp
lea ecx, [esp + 0x28]
push ecx
push 0
lea edx, [esp + 0x38]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_ReadConsoleInputW]
xor eax, eax
push eax
lea ecx, [esp + 0xb04]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
push eax
push eax
mov word [esp + 0x30], ax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov word [esp + 0x3e], ax
call dword [sym.imp.KERNEL32.DLL_GetTimeFormatW]
mov edi, dword [sym.imp.KERNEL32.DLL_SetLastError]
mov esi, 0x8dc
push 0
call edi
dec esi
jne 0x40bb37
mov esi, dword [sym.imp.KERNEL32.DLL_OpenMutexW]
mov edi, dword [sym.imp.KERNEL32.DLL_GetConsoleMode]
mov ebx, 0x25887
nop
cmp dword [0x235b884], 0x222
jne 0x40bb6d
push 0x40345c
push 0
push 0
call esi
push 0
push 0
call edi
dec ebx
jne 0x40bb50
mov byte [0x4b81f8], bl
call fcn.0040b2b0
call fcn.0040b5a0
mov edi, dword [sym.imp.KERNEL32.DLL_GetHandleInformation]
mov ebx, dword [sym.imp.KERNEL32.DLL_AddAtomW]
xor esi, esi
cmp dword [0x235b884], 0xba
jne 0x40bba4
push 0
push 0
call edi
push 0
call ebx
cmp esi, 0x2f64
jne 0x40bbb6
add dword [0x235182c], 0
inc esi
cmp esi, 0x46d9a
jl 0x40bb8e
mov esi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov edi, 0xf2b8b
lea ebx, [ebx]
cmp dword [0x235b884], 0x21
jne 0x40bbdd
push 0
call esi
dec edi
jne 0x40bbd0
mov eax, 0x73
mov ecx, 0x6d
mov word [0x23518c2], ax
mov word [0x23518c6], cx
xor ecx, ecx
mov edx, 0x33
mov eax, 0x67
mov word [0x23518ca], dx
mov word [0x23518d6], cx
mov word [0x23518c8], ax
mov ecx, 0x69
mov edx, 0x6d
mov eax, 0x6c
push 0x23518c0
mov dword [0x23518d0], 0x6c0064
mov word [0x23518c4], cx
mov word [0x23518c0], dx
mov word [0x23518d4], ax
mov dword [0x23518cc], 0x2e0032
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
cmp dword [0x235b884], 0xc30
jne 0x40bcc9
push edi
call dword [sym.imp.KERNEL32.DLL_LocalSize]
push edi
call ebp
lea eax, [esp + 0xb0]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
push edi
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
push edi
call esi
push 0x40346c
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
lea eax, [esp + 0x28]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_ReadConsoleInputW]
push edi
lea ecx, [esp + 0x304]
push ecx
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetProfileStringA]
mov ecx, dword [esp + 0x2b04]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret