Function at 0x414ae0
Capabilities:
Check mutex on windows
Delete file
Enumerate gui resources
Get common file path
Get file attributes
Get hostname
Manipulate console buffer
Query environment variable
Read .ini file
Read pipe
Write pipe

Disassembly:
mov eax, 0x184c
call fcn.0040ebb0
cmp dword [0x2b6f994], 0x422
push ebx
push ebp
push esi
push edi
jne 0x414b38
push 0
push 0
push 0
call fcn.00403a86
push 0x403570
push 0
call fcn.00403a86
push 0
call fcn.00414326
push 0x40357c
push 0x403580
push 0x446180
call fcn.00403a86
push 0
push 0
call fcn.00403a46
add esp, 0x2c
mov edi, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
xor esi, esi
cmp esi, 0xc0a
jne 0x414b53
mov eax, 0x38d6
add dword [0x2b6f994], eax
cmp dword [0x2b6f994], 0xd04
jne 0x414b67
push 0
push 0
push 0
call edi
inc esi
cmp esi, 0x33a146
jl 0x414b40
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x30]
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
cmp esi, 0x1c275
jge 0x414b8c
push 0
call ebp
cmp esi, 0x1ea070f3
jle 0x414ba4
cmp edi, 0xacd436
je 0x414ba4
cmp ebx, 0xad1af0c
jne 0x414bad
inc esi
cmp esi, 0x8c238a18
jb 0x414b80
mov eax, dword [0x2b6f994]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
mov edi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [0x2b6f478], eax
mov eax, dword [0x2b6f994]
mov dword [esp + 0x10], 0x962ae8
cmp eax, 3
jne 0x414bfc
lea ecx, [esp + 0x58]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov eax, dword [0x2b6f994]
cmp eax, 0xd
jne 0x414ce3
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call edi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x5c]
push eax
push 0
call ebp
push 0
call ebx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xc5c]
push edx
push 0
push 0x403588
push 0x4035f8
push 0x4035dc
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
xor eax, eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x464]
push ecx
push eax
push eax
push eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x4036b8
push 0
lea edx, [esp + 0x860]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
lea eax, [esp + 0x18]
push eax
push 0
push 0x403708
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
push 0
lea ecx, [esp + 0x1060]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
mov eax, dword [0x2b6f994]
dec dword [esp + 0x10]
jne 0x414be5
xor esi, esi
test eax, eax
je 0x414d34
mov edi, dword [sym.imp.KERNEL32.dll__lclose]
mov ebx, dword [sym.imp.KERNEL32.dll_FatalAppExitA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
cmp eax, 0xfe
jne 0x414d19
push 0
call edi
push 0x403758
push 0
call ebx
call fcn.00414820
mov eax, dword [0x2b6f994]
cmp eax, 0x29
jne 0x414d2f
call ebp
mov eax, dword [0x2b6f994]
inc esi
cmp esi, eax
jb 0x414d05
mov ebx, dword [sym.imp.KERNEL32.dll_AddAtomA]
cmp eax, 0x19c
jne 0x414d6d
push 0x403780
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x4037cc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edi, dword [sym.imp.USER32.dll_LoadMenuA]
mov esi, 0x8dc
push 0
push 0
call edi
dec esi
jne 0x414d78
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 0x25865
mov ebp, 0x15a
cmp dword [0x2b6f994], ebp
jne 0x414da3
push 0
call ebx
push 0
push 0
call esi
dec edi
jne 0x414d91
mov byte [0x446180], 0
call fcn.00414360
call fcn.00414ab0
call fcn.00414800
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov ebp, 0xdd7b3
cmp dword [0x2b6f994], 0x21
jne 0x414dfc
call esi
push 0
push 0
lea edx, [esp + 0x1060]
push edx
push 0
call edi
lea eax, [esp + 0x14]
push eax
push 0x403684
push 0
call ebx
dec ebp
jne 0x414dd3
call fcn.00414930
cmp dword [0x2b6f994], 0x58c
mov byte [0x446181], 0x73
jne 0x414e8c
lea ecx, [esp + 0x58]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push ebp
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0x30
lea edx, [esp + 0x2c]
push ebp
push edx
mov dword [esp + 0x30], ebp
call fcn.00408000
add esp, 0xc
push ebp
lea eax, [esp + 0x28]
push eax
push 0x4037dc
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
push 0x4037f0
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
lea ecx, [esp + 0x14]
push ecx
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
call fcn.00414810
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x184c
ret