Function at 0x415500
Capabilities:
Create mailslot
Create thread
Enumerate gui resources
Get disk information
Get disk size
Get file attributes
Get hostname
Query environment variable
Read .ini file

Disassembly:
mov eax, 0x15bc
call fcn.00413c40
cmp dword [0x7ea034], 0x6c
push ebx
push ebp
push esi
push edi
jne 0x41557a
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x7ea034], 0x3a
jne 0x41553b
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 0
call fcn.00403f8e
add esp, 0xc
push 0x40349c
push 0
call fcn.00403f8e
push 0
call fcn.00403f53
add esp, 0xc
push 0
call fcn.00403b41
add esp, 4
push 0
call fcn.00403f53
add esp, 4
push 0
call fcn.004045a3
mov eax, 0x38d6
add dword [0x7ea034], eax
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
mov ebp, dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
xor esi, esi
cmp esi, 0x1c2a7
jge 0x4155a1
push 0
call ebp
cmp esi, 0x1ea072e7
jle 0x4155b9
cmp edi, 0xacd468
je 0x4155b9
cmp ebx, 0xad1ade0
jne 0x4155c2
inc esi
cmp esi, 0x8c6fd558
jb 0x415595
mov ecx, dword [0x7ea034]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
mov edi, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
mov ebp, dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [0x7e9b18], eax
mov eax, dword [0x7ea034]
mov dword [esp + 0x10], 0x962d40
jmp 0x415600
cmp eax, 0x3f5
jne 0x4156d0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call esi
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x1cc]
push eax
push 0x4034b4
call edi
push 0
push 0
push 0
push 0
call ebp
push 0
push 0x4034c4
call ebx
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x5cc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommMask]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 0x4034d8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x4034f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
lea edx, [esp + 0xdcc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
lea eax, [esp + 0x18]
push eax
push 0
push 0x403528
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov eax, dword [0x7ea034]
dec dword [esp + 0x10]
jne 0x415600
xor ebp, ebp
xor esi, esi
cmp eax, ebp
jbe 0x415739
mov edi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, edi
cmp eax, 0xfe
jne 0x41571e
lea ecx, [esp + 0x1c]
push ecx
xor eax, eax
lea edx, [esp + 0x4c]
push edx
push 0x403538
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call edi
call fcn.004151c0
mov eax, dword [0x7ea034]
cmp eax, 0x29
jne 0x415734
call ebx
mov eax, dword [0x7ea034]
inc esi
cmp esi, eax
jb 0x4156f0
cmp eax, 0x19c
jne 0x4157b7
push 0x40354c
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea eax, [esp + 0x10]
push eax
push ebp
push ebp
lea ecx, [esp + 0x20]
push ecx
push ebp
push ebp
push ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_BackupRead]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x48]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
push ebp
push ebp
lea edx, [esp + 0x1d0]
push edx
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x403588
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0x40359c
push 0x4035a4
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edi, dword [sym.imp.USER32.dll_GetMenu]
mov esi, 0x8dc
push ebp
call edi
dec esi
jne 0x4157c2
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, 0x25865
cmp dword [0x7ea034], 0x15a
jne 0x4157f6
lea eax, [esp + 0x88]
push eax
call esi
push 0x4035d8
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
dec edi
jne 0x4157d3
mov byte [0x44f0c0], 0
call fcn.00414d00
call fcn.004154d0
call fcn.004151a0
mov esi, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov ebp, 0xdd7b3
cmp dword [0x7ea034], 0x21
jne 0x41585d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
lea ecx, [esp + 0x1d0]
push ecx
push 0
call edi
lea edx, [esp + 0x14]
push edx
push 0x4035e0
push 0
call ebx
dec ebp
jne 0x415826
call fcn.00415490
cmp dword [0x7ea034], 0x58c
mov byte [0x44f0c1], 0x73
jne 0x41590f
lea eax, [esp + 0x88]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebp
push ebp
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push ebp
lea edx, [esp + 0x1cc]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push ebp
push ebp
push 0x403604
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
lea eax, [esp + 0x48]
push eax
push 0x403638
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
push ebp
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0x40366c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
push 0x403680
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
call fcn.004151b0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x15bc
ret