Function at 0x415cf0
Capabilities:
Move file
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
xor eax, eax
mov word [ebp - 0xac], ax
xor ecx, ecx
mov word [ebp - 0x80], cx
mov dx, word [0x55c92c]
mov word [ebp - 0x7c], dx
mov esi, dword [ebp - 0x10c]
sub esi, 0x40292
mov edi, 0x3d32c
sub edi, dword [ebp - 0x10c]
movzx eax, byte [ebp - 0x81]
add edi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
add edi, eax
sub edi, dword [ebp - 0x10c]
and esi, edi
mov dword [ebp - 0x10c], esi
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x14c], ecx
mov edx, dword [ebp - 0x14c]
sub edx, 0x11
mov dword [ebp - 0x14c], edx
cmp dword [ebp - 0x14c], 0xa0
ja case.0x415d8a.1
mov eax, dword [ebp - 0x14c]
movzx ecx, byte [eax + 0x416250]
jmp dword [ecx*4 + 0x416238]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov esi, eax
add esi, 0x186ab
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
sub esi, eax
sub esi, 0x4b007
mov word [ebp - 0xac], si
jmp 0x415f1b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
or eax, 0x5031c
mov dword [ebp - 0xbc], eax
jmp 0x415f1b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
mov esi, eax
movzx edx, byte [ebp - 0x81]
add esi, edx
movzx edi, byte [ebp - 0x81]
sub edi, 0x7fc35
movzx eax, word [ebp - 0xac]
sub edi, eax
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
add edi, eax
and edi, dword [ebp - 0x10c]
or esi, edi
mov dword [ebp - 0xbc], esi
jmp 0x415f1b
mov ecx, 0x44e3f
sub ecx, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
lea esi, [ecx + edx + 0x331c9]
movzx eax, word [ebp - 0xac]
add esi, eax
and esi, 0x64aa8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
and esi, ecx
mov word [ebp - 0xac], si
jmp 0x415f1b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, dword [ebp - 0x10c]
sub edx, eax
mov eax, dword [ebp - 0x10c]
lea ecx, [edx + eax + 0x793ef]
mov edx, dword [ebp - 0x10c]
lea esi, [ecx + edx - 0x21a88]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
sub eax, 0x3f2af
and esi, eax
xor eax, eax
mov ecx, dword [ebp - 0x70]
add ecx, 0x48db1
mov edx, dword [ebp - 0x6c]
adc edx, 0
and esi, ecx
and eax, edx
mov dword [ebp - 0xbc], esi
jmp 0x415f1b
movzx esi, byte [ebp - 0x81]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
add esi, eax
or esi, 0x48960
mov ecx, dword [ebp - 0x70]
add ecx, 0x11d43
mov edi, dword [ebp - 0x6c]
adc edi, 0
movzx eax, word [ebp - 0xac]
cdq
sub ecx, eax
sbb edi, edx
mov eax, 0x4b598
sar eax, cl
sar eax, 0x5b
or esi, eax
mov dword [ebp - 0x10c], esi
mov ecx, 1
test ecx, ecx
je 0x415f8a
mov edx, dword [ebp - 0x10c]
sub edx, 0xb4d2
mov esi, edx
xor edi, edi
add esi, dword [ebp - 0x70]
adc edi, dword [ebp - 0x6c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
add ecx, dword [ebp - 0x10c]
xor edx, edx
and esi, ecx
and edi, edx
mov ebx, dword [ebp - 0x10c]
add ebx, 0x6f3ea
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
sub ebx, eax
sub ebx, 0x6c7a5
xor eax, eax
and esi, ebx
and edi, eax
mov dword [ebp - 0x10c], esi
jmp 0x415fec
movzx ecx, word [ebp - 0xac]
mov esi, dword [ebp - 0x10c]
sub esi, ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
add esi, dword [ebp - 0x10c]
lea esi, [eax + esi + 0x665d1]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov edi, eax
sub edi, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
add edi, edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
lea eax, [edi + eax - 0x14458]
and esi, eax
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x10c], 0x6e7ef
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, 0xe381f
sub ecx, eax
or ecx, dword [ebp - 0x10c]
mov word [ebp - 0xac], cx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
mov word [ebp - 0xac], ax
mov esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
sub esi, 0x5614c
movzx edx, word [ebp - 0xac]
sub esi, edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
add esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
sub esi, eax
xor eax, eax
sub esi, dword [ebp - 0x70]
sbb eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov ecx, dword [ebp - 0x10c]
lea esi, [eax + ecx + 0x209be]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
add esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
add esi, eax
sub esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
sub esi, 0x6507
and esi, 0x3af67
or esi, dword [ebp - 0x10c]
mov word [ebp - 0xac], si
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x150], edx
cmp dword [ebp - 0x150], 0xd
je 0x41616d
cmp dword [ebp - 0x150], 0x71
je 0x41612c
cmp dword [ebp - 0x150], 0x93
je 0x41610b
jmp 0x4161b5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
sub eax, dword [ebp - 0x10c]
and eax, dword [ebp - 0x10c]
mov dword [ebp - 0xbc], eax
jmp 0x416209
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, 0x6c50c
sub ecx, eax
or ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
sub edx, 0x121f
sub edx, dword [ebp - 0x10c]
add edx, 0xc271
or ecx, edx
mov word [ebp - 0xac], cx
jmp 0x416209
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov esi, eax
and esi, dword [ebp - 0x10c]
movzx edi, word [ebp - 0xac]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
and edi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
mov ecx, 0x5d320
sub ecx, eax
and edi, ecx
or esi, edi
mov dword [ebp - 0xbc], esi
jmp 0x416209
mov esi, dword [ebp - 0x10c]
add esi, 0x677d0
movzx edx, word [ebp - 0xac]
or esi, edx
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov edi, dword [ebp - 0x10c]
sub edi, eax
and edi, 0x59027
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x15583]
and edi, edx
or esi, edi
mov dword [ebp - 0x10c], esi
mov esi, dword [ebp - 0x10c]
sub esi, 0x2e5c6
or esi, 0x5b296
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
or esi, eax
mov dword [ebp - 0x10c], esi
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24