Function at 0x410600
Capabilities:
Accept command line arguments
Create mailslot
Create pipe
Delete file
Get common file path
Get disk information
Get hostname
Identify system language via api
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x414ce6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0x19f0
call fcn.0040f770
push ebx
mov ebx, dword [sym.imp.USER32.dll_CharUpperBuffW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_CharUpperA]
xor esi, esi
cmp esi, 0x1f029
jge 0x410654
push 0
call edi
push 0
push 0
call ebx
call ebp
cmp esi, 0x1e970ad2
jle 0x410673
cmp dword [esp + 0x2c], 0xae6930
je 0x410673
cmp dword [esp + 0xa4], 0x8924530
jne 0x41067c
inc esi
cmp esi, 0x95c3c4c0
jb 0x410640
cmp dword [0x246819c], 0x520
jne 0x41084d
push 0
push 0
push 0
push 0x43e110
call fcn.00405583
xor ebp, ebp
push ebp
push ebp
call fcn.0040519c
push ebp
call fcn.004101fe
add esp, 0x1c
push ebp
push ebp
call fcn.00405336
push ebp
call fcn.00406244
add esp, 0xc
lea eax, [esp + 0x48]
push eax
call fcn.00404bd0
mov esi, 0x403bc4
push ebp
mov dword [esp + 0x4c], esi
mov dword [esp + 0x88], ebp
mov dword [esp + 0x8c], ebp
call fcn.00405cb1
add esp, 4
push ebp
call fcn.0040530a
add esp, 4
push ebp
push ebp
call fcn.00405432
push ebp
call fcn.00405472
fld qword [0x403c00]
add esp, 4
fstp qword [esp]
push 0x4033ac
call fcn.00405cc8
add esp, 0xc
push ebp
call fcn.00405472
add esp, 4
push ebp
push ebp
call fcn.00405432
push ebp
push ebp
call fcn.00406197
push ebp
call fcn.0040616f
add esp, 0x14
push ebp
push ebp
push ebp
push ebp
push ebp
call fcn.004060a9
add esp, 0x14
push ebp
push ebp
push ebp
call fcn.00405b1a
add esp, 0xc
push ebp
push ebp
push ebp
push ebp
call fcn.00405b45
push ebp
push ebp
push ebp
call fcn.00405b62
add esp, 0x1c
push ebp
push ebp
call fcn.004060c9
push ebp
call fcn.00405320
add esp, 0xc
push ebp
push ebp
push ebp
call fcn.004058c4
add esp, 0xc
test byte [esp + 0x88], 1
mov dword [esp + 0x48], esi
je 0x41079b
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx]
push eax
call fcn.00405d85
add esp, 4
mov edx, dword [esp + 0x58]
mov dword [edx], ebp
mov eax, dword [esp + 0x68]
mov dword [eax], ebp
mov ecx, dword [esp + 0x78]
mov dword [ecx], ebp
mov edx, dword [esp + 0x5c]
mov dword [edx], ebp
mov eax, dword [esp + 0x6c]
mov dword [eax], ebp
mov ecx, dword [esp + 0x7c]
mov dword [ecx], ebp
and dword [esp + 0x88], 0xfffffffe
mov dword [esp + 0x84], ebp
mov dword [esp + 0x48], 0x403b84
mov dword [esp + 0x1a3c], 1
mov eax, dword [esp + 0x80]
mov ebx, eax
cmp eax, ebp
je 0x410839
mov edi, dword [eax]
cmp edi, ebp
je 0x410830
push ebp
lea ecx, [esp + 0x30]
call fcn.00404d73
mov eax, dword [edi + 4]
cmp eax, ebp
jbe 0x41080e
cmp eax, 0xffffffff
jae 0x41080e
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x2c]
and esi, edi
call fcn.00404d9b
cmp esi, ebp
je 0x410830
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
push ebx
call fcn.00405d85
add esp, 4
lea ecx, [esp + 0x4c]
mov dword [esp + 0x1a3c], 0xffffffff
call fcn.00404dcc
mov eax, 0x5d1
add dword [0x246819c], eax
mov ecx, dword [0x246819c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [0x245e144], eax
mov eax, dword [0x246819c]
mov dword [esp + 0x2c], 0x9682ab
cmp eax, 3
jne 0x4108ad
push 0
push 0x4033b8
push 0x403418
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [0x246819c]
cmp eax, 0xdf
jne 0x4109ec
xor eax, eax
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x9c]
push ecx
push eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call esi
push 0
push 0
push 0
push 0x4034e0
call edi
push 0
push 0
lea edx, [esp + 0xa08]
push edx
push 0
push 0
call ebp
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
lea ecx, [esp + 0xe04]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0x403508
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push 0x40351c
push 0x403548
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
lea edx, [esp + 0x1604]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0x403578
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x30
lea edx, [esp + 0x50]
push 0
push edx
mov dword [esp + 0x54], 0
call fcn.0040cd40
add esp, 0xc
push 0
lea eax, [esp + 0x4c]
push eax
push 0x403638
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
mov eax, dword [0x246819c]
dec dword [esp + 0x2c]
jne 0x410891
xor esi, esi
test eax, eax
je 0x410a53
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
mov ebx, dword [sym.imp.KERNEL32.dll__hwrite]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, 0xfe
jne 0x410a44
push 0
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x4036a0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
call fcn.004102f0
mov eax, dword [0x246819c]
inc esi
cmp esi, eax
jb 0x410a0e
mov ebx, dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
cmp eax, 0x70
jne 0x410b0f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x403704
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [esp + 0x200]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x403738
push 0x4037a0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea edx, [esp + 0x30]
push edx
push 0
lea eax, [esp + 0xa0]
push eax
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
push eax
lea edx, [esp + 0xe04]
push edx
push 0x4037f0
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], eax
mov word [esp + 0x4e], ax
xor ecx, ecx
lea eax, [esp + 0x40]
push eax
push ecx
push ecx
mov word [esp + 0x4c], cx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x8dc
lea ebx, [ebx]
push 0
call edi
dec esi
jne 0x410b20
mov byte [0x43e110], 0
call fcn.00410210
call fcn.004105d0
mov edi, dword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov edi, edi
cmp dword [0x246819c], 0xba
jne 0x410b60
push 0
push 0
push 0
push 0x4038b4
push 0x4038bc
push 0
call edi
cmp esi, 0x2f64
jne 0x410b72
add dword [0x245e144], 0x2972
inc esi
cmp esi, 0x46d9a
jl 0x410b40
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, 0xf2b8b
cmp dword [0x246819c], 0x21
jne 0x410b91
call edi
dec esi
jne 0x410b86
call fcn.004103e0
cmp dword [0x246819c], 0xc30
jne 0x410bfa
lea ecx, [esp + 0xc0]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x4038f0
call esi
push 0x40391c
call esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
call ebx
push 0
lea eax, [esp + 0x204]
push eax
push 0x403958
push 0x403a00
push 0x403ad0
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
mov ecx, dword [esp + 0x1a34]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret