Function at 0x409790
Capabilities:
Copy file
Create mailslot
Enumerate gui resources
Get hostname
Manipulate console buffer
Move file
Print debug messages
Read .ini file
Terminate process

Disassembly:
mov eax, 0x1454
call fcn.0040aa30
cmp dword [0x4e1504], 0x177
jne 0x4097c9
push 0
call fcn.0040a9e0
push 0
push 0
call fcn.0040a790
push 0
push 0
call fcn.0040a740
add esp, 0x14
push 0
call fcn.0040a190
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentActCtx]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
mov dword [esp + 0x10], eax
jmp 0x4097f0
cmp dword [0x4e1504], 0x47
jne 0x4098e6
lea eax, [esp + 0x1c]
push eax
push 0
call esi
push 0
lea ecx, [esp + 0xc68]
push ecx
call edi
xor eax, eax
lea edx, [esp + 0x24]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
push edx
lea eax, [esp + 0x40]
push eax
push 0x4014a4
call ebx
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0
call ebp
push 0
lea edx, [esp + 0x468]
push edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x14]
push edx
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], cx
mov eax, dword [esp + 0x1c]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
lea ecx, [esp + 0x68]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push 0x4014b8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0x4014d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0
call dword [sym.imp.KERNEL32.dll_CancelDeviceWakeupRequest]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov eax, dword [esp + 0x10]
cmp eax, 0x6a1
je 0x4098ff
inc eax
cmp eax, 0x1137686
mov dword [esp + 0x10], eax
jl 0x4097f0
jmp 0x40990b
mov edx, dword [0x428100]
mov dword [0x4e1504], edx
mov edi, dword [sym.imp.USER32.dll_CharToOemBuffA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.GDI32.dll_GetCharWidth32A]
xor esi, esi
nop
cmp esi, 0x7423
jge 0x40993c
push 0
push 0
push 0
call edi
call ebx
push 0
push 0
push 0
push 0
call ebp
cmp dword [0x4e1504], 0x6b
jne 0x40994d
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
cmp esi, 0x3f56b
mov dword [0x4e0b90], 0
jle 0x40998c
cmp dword [esp + 0x14], 0xdfe5c2
je 0x40998c
cmp dword [esp + 0x48], 0xdf5954
je 0x40998c
cmp dword [0x4e1504], 0x28
jne 0x40998c
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
inc esi
cmp esi, 0x180c1271
jl 0x409920
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteAtom]
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
xor eax, eax
mov dword [esp + 0x18], eax
cmp eax, 0x40d
jne 0x4099c4
add dword [0x4e1504], 0x38d6
cmp dword [0x4e1504], 0x78
jne 0x409b3a
push 0
lea edx, [esp + 0x68]
push edx
call esi
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x14]
push edx
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov eax, dword [esp + 0x14]
push eax
push ecx
push 0x4014e0
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0x401520
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call ebx
push 0x401540
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lopen]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__hread]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
push 0x401578
push 0x4015c4
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0
push 0
call edi
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push 0x4015e4
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
push 0
lea eax, [esp + 0x468]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
push 0
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFile]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 0x40bd22
mov dword [esp + 0x18], eax
jl 0x4099b3
call fcn.00409570
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
xor esi, esi
cmp dword [0x4e1504], 0x15
jne 0x409b66
push 0
push 0
call edi
cmp esi, 0x1550
jne 0x409b7a
mov ecx, dword [0x427008]
mov dword [0x4e1508], ecx
inc esi
cmp esi, 0x56a5e3
jl 0x409b57
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov ebp, dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [esp + 0x10], 0x719c87
cmp dword [0x4e1504], 0xfd
jne 0x409bb7
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp dword [0x4e1504], 0x23
jne 0x409c12
push 0
push 0
push 0
push 0
call esi
push 0x4015fc
lea edx, [esp + 0x68]
push edx
call edi
call ebx
push 0
push 0
lea eax, [esp + 0x46c]
push eax
push 0
push 0
push 0
push 0
call ebp
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalWire]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
sub dword [esp + 0x10], 1
jne 0x409ba3
xor esi, esi
cmp dword [0x4e1504], esi
jbe 0x409c32
push esi
call fcn.00409340
inc esi
cmp esi, dword [0x4e1504]
jb 0x409c23
call fcn.00409490
call fcn.00409590
cmp dword [0x4e1504], 0x1d
pop edi
pop esi
pop ebp
pop ebx
jne 0x409d35
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x460]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x40160c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0
lea eax, [esp + 0x5c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateActCtxA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
lea edx, [esp + 0xc58]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
xor edx, edx
xor ecx, ecx
mov word [esp], cx
mov word [esp + 2], dx
mov eax, dword [esp]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
call fcn.00409460
xor eax, eax
add esp, 0x1454
ret 0x10