Function at 0x41b4d0
Capabilities:
Enumerate processes
Get disk information
Get hostname
Manipulate console buffer
Move file
Read .ini file
Set current directory
Terminate process
Terminate process by name
Write file on windows

Disassembly:
mov eax, 0x18fc
call fcn.0041c4f0
push esi
xor esi, esi
cmp dword [0x44d27c], 0x177
jne 0x41b51e
push esi
push esi
push esi
push 0xa04
push 0x44c878
call fcn.0041bd80
push esi
push esi
push esi
push 0x43e248
call fcn.0041cff0
push esi
call fcn.0041cc20
push esi
push esi
call fcn.0041cbd0
add esp, 0x30
push esi
call fcn.0041c620
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
push ebp
push edi
xor ebp, ebp
cmp dword [0x44d27c], 0x47
jne 0x41b67d
lea eax, [esp + 0x14]
push eax
push 0x40171c
call ebx
push 0x401730
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push esi
call sub.KERNEL32.dll_Process32NextW
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
lea eax, [esp + 0x510]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push 0x40178c
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
push 0x4017a8
push 0x4017c4
push 0x4017d8
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push esi
lea eax, [esp + 0x1110]
push eax
push esi
push 0x401848
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push esi
lea eax, [esp + 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
lea eax, [esp + 0x1c]
push eax
push 0x401860
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
xor eax, eax
mov word [esp + 0x10], ax
lea edi, [esp + 0x12]
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
push esi
push 0x40186c
lea eax, [esp + 0x914]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
push esi
push esi
push 0x401898
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommMask]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0x4018ac
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp ebp, 0x69d
je 0x41b694
inc ebp
cmp ebp, 0x1133661
jl 0x41b529
jmp 0x41b69e
mov eax, dword [0x43d160]
mov dword [0x44d27c], eax
xor edi, edi
cmp edi, 0x4cb
jge 0x41b6af
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x44d27c], 0x6b
jne 0x41b6c1
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0x26e5d
mov dword [0x44c868], esi
jle 0x41b70c
cmp dword [esp + 0x18], 0xdfe5c2
je 0x41b70c
cmp dword [esp + 0x4c], 0xdf5922
je 0x41b70c
cmp dword [0x44d27c], 0x28
jne 0x41b70c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x910]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x4018dc
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
inc edi
cmp edi, 0x176343a7
jl 0x41b6a0
mov ebp, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], 0x3fa
jne 0x41b733
push 0x44d27c
call fcn.00419637
cmp dword [0x44d27c], 0x44d
jne 0x41b7e6
xor eax, eax
mov word [esp + 0x14], ax
lea edi, [esp + 0x16]
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
push esi
push 0x4018e8
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0x401944
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
call ebp
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
call ebp
push esi
push esi
lea eax, [esp + 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
push esi
lea eax, [esp + 0x910]
push eax
push esi
call sub.KERNEL32.dll_VerLanguageNameW
push 0x401958
lea eax, [esp + 0x1110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x485ceb
jl 0x41b71f
call fcn.0041b26a
mov edi, 0x56a5e7
cmp dword [0x44d27c], 0x15
jne 0x41b811
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
dec edi
jne 0x41b802
mov edi, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebp, dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov dword [esp + 0x10], esi
cmp dword [0x44d27c], 0xfd
jne 0x41b837
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp dword [esp + 0x10], 0x3c58
jne 0x41b84b
mov eax, dword [0x43d008]
mov dword [0x44d280], eax
cmp dword [0x44d27c], 0x23
jne 0x41b9db
push 0x4019a0
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push esi
push 0x4019c8
push 0x401a08
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push esi
push esi
push esi
push esi
call edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransmitCommChar]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
lea eax, [esp + 0x18]
push eax
push 0x401a54
call ebx
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
lea eax, [esp + 0x40]
push eax
push 0x401a7c
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push esi
push esi
push esi
call edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esp + 0x50c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esp + 0xcc]
push eax
push 0x401aac
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringA]
push 0x30
lea eax, [esp + 0x70]
push esi
push eax
mov dword [esp + 0x74], esi
call fcn.0041d020
add esp, 0xc
push esi
lea eax, [esp + 0x6c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push esi
lea eax, [esp + 0x910]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
push esi
call sub.KERNEL32.dll_Process32FirstW
lea eax, [esp + 0x10c]
push eax
push esi
push 0x401adc
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push 0x401af0
push esi
lea eax, [esp + 0x1114]
push eax
push 0x401b04
push 0x401b10
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
push esi
push esi
call ebp
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xe6a95
jl 0x41b824
xor edi, edi
cmp dword [0x44d27c], esi
jbe 0x41ba06
push edi
call fcn.004194fc
inc edi
cmp edi, dword [0x44d27c]
jb 0x41b9f7
xor edi, edi
cmp edi, 0x26
jne 0x41ba12
call fcn.00419644
inc edi
cmp edi, 0x3dc4b7
jl 0x41ba08
call fcn.0041b27e
cmp dword [0x44d27c], 0x1d
jne 0x41bb20
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
push esi
push esi
call ebp
push esi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push 0x401b24
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x38]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
lea eax, [esp + 0x910]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor eax, eax
mov dword [esp + 0x24], esi
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
push esi
lea eax, [esp + 0x1118]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x401b38
push 0x401b44
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0x401b68
push esi
lea eax, [esp + 0x514]
push eax
push 0x401b98
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
lea eax, [esp + 0x10]
push eax
push esi
push 0x401bd0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x18fc
ret 0x10