Function at 0x409800
Capabilities:
Copy file
Create mailslot
Enumerate gui resources
Manipulate console buffer
Move file
Print debug messages
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x479484]
sub esp, 0x85c
cmp ecx, 0x177
jne 0x409838
push 0
call fcn.0040aa00
push 0
call fcn.0040a730
push 0
push 0
call fcn.0040a6e0
add esp, 0x10
push 0
call fcn.0040a130
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
mov dword [ebp - 4], eax
cmp ecx, 0x47
jne 0x40992c
lea eax, [ebp - 0x1c]
push eax
push 0
call esi
push 0
lea ecx, [ebp - 0x85c]
push ecx
call edi
xor eax, eax
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
push edx
lea eax, [ebp - 0x50]
push eax
push 0x4013b8
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor edx, edx
xor ecx, ecx
lea eax, [ebp - 0x18]
push eax
mov word [ebp - 0x14], cx
mov word [ebp - 0x12], dx
mov ecx, dword [ebp - 0x14]
push ecx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
lea edx, [ebp - 0x45c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor ecx, ecx
xor eax, eax
lea edx, [ebp - 8]
push edx
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], cx
mov eax, dword [ebp - 0x10]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov eax, dword [ebp - 4]
cmp eax, 0x6a1
je 0x409cb7
mov ecx, dword [0x479484]
cmp ecx, 0xf
je 0x409cc8
inc eax
cmp eax, 0x53f9406
mov dword [ebp - 4], eax
jl 0x409852
mov ebx, dword [sym.imp.USER32.dll_CharUpperW]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
xor esi, esi
cmp esi, 0x7423
jge 0x409975
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x3f56b
mov dword [0x478b10], 0
jle 0x4099c2
cmp dword [ebp - 8], 0xdfe5c2
je 0x4099c2
cmp dword [ebp - 0x50], 0xdf5954
je 0x4099c2
cmp dword [0x479484], 0x28
jne 0x4099c2
push 0x4013e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push 0x4013ec
push 0x401410
push 0x401444
call edi
inc esi
cmp esi, 0x180bc451
jl 0x409963
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x40d
jne 0x4099f4
push 0x479484
call fcn.004094d0
cmp dword [0x479484], 0x78
jne 0x409abc
push 0x401450
call esi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
push 0x4014bc
push 0x4014e4
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov eax, dword [ebp - 8]
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0x4014f4
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFile]
mov ecx, dword [ebp - 4]
inc ecx
cmp ecx, 0x40bd22
mov dword [ebp - 4], ecx
jl 0x4099e2
call fcn.004095a0
mov edi, dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor esi, esi
lea esp, [esp]
cmp dword [0x479484], 0x15
jne 0x409aef
push 0
push 0
call edi
cmp esi, 0x1550
jne 0x409b03
mov edx, dword [0x427008]
mov dword [0x479488], edx
inc esi
cmp esi, 0x56a453
jl 0x409ae0
mov esi, dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov edi, dword [sym.imp.KERNEL32.dll_QueryDepthSList]
mov ebx, dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov dword [ebp - 4], 0x7015e7
jmp 0x409b30
cmp dword [0x479484], 0xfd
jne 0x409b44
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
cmp dword [0x479484], 0x23
jne 0x409b63
call esi
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
call edi
lea ecx, [ebp - 0x34]
push ecx
call ebx
sub dword [ebp - 4], 1
jne 0x409b30
xor esi, esi
cmp dword [0x479484], esi
jbe 0x409b82
push esi
call fcn.004093a0
inc esi
cmp esi, dword [0x479484]
jb 0x409b73
mov esi, dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edi, 0x1756bb
lea ecx, [ecx]
cmp dword [0x479484], 0x15a
jne 0x409bb1
push 0
push 0
call esi
push 0x401514
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
sub edi, 1
jne 0x409b90
call fcn.004094e0
call fcn.004095c0
cmp dword [0x479484], 0x1d
pop edi
pop esi
pop ebx
jne 0x409caa
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x401524
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
push 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x18]
push eax
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
xor edx, edx
xor ecx, ecx
mov word [ebp - 4], cx
mov word [ebp - 2], dx
mov eax, dword [ebp - 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
call fcn.004094b0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x428100]
mov dword [0x479484], ecx
jmp 0x409955
push 0
lea edx, [ebp - 0x45c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]