Function at 0x4232a0
Capabilities:
Create mailslot
Create thread
Enumerate gui resources
Get disk information
Get disk size
Get file attributes
Get hostname
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x423be1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x12d0
call fcn.00422210
cmp dword [0x81b1b8], 0x6c
push ebx
push ebp
push esi
push edi
jne 0x42339f
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x81b1b8], 0x3a
jne 0x4232fb
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 0
call fcn.00409fd8
add esp, 0xc
push 0x404534
push 0
call fcn.00409fd8
push 0
call fcn.00409f9d
add esp, 0xc
push 0
call fcn.00409b8b
add esp, 4
push 0
call fcn.00409f9d
add esp, 4
lea ecx, [esp + 0x88]
push ecx
call fcn.004062f0
lea esi, [esp + 0x18]
mov dword [esp + 0x12ec], 0
call fcn.00406b90
sub esp, 0x1c
mov byte [esp + 0x1308], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0
call fcn.00405ea0
mov ecx, esi
call fcn.00406c30
push 0
lea ecx, [esp + 0x4c]
call fcn.00405ea0
lea ebx, [esp + 0x48]
mov eax, esi
mov byte [esp + 0x12ec], 2
call fcn.00406bb0
mov ecx, ebx
call fcn.00405f30
push 0
call fcn.0040a6df
mov eax, 0x38d6
add dword [0x81b1b8], eax
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
mov ebp, dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
xor esi, esi
cmp esi, 0x1c2a7
jge 0x4233c6
push 0
call ebp
cmp esi, 0x1ea072e7
jle 0x4233de
cmp edi, 0xacd468
je 0x4233de
cmp ebx, 0xad1ade0
jne 0x4233e7
inc esi
cmp esi, 0x8c6fd558
jb 0x4233ba
mov edx, dword [0x81b1b8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
mov edi, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
mov ebp, dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
mov dword [0x817628], eax
mov eax, dword [0x81b1b8]
mov dword [esp + 0x10], 0x962d40
cmp eax, 0x3f5
jne 0x4234f0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call esi
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x6e4]
push ecx
push 0x40454c
call edi
push 0
push 0
push 0
push 0
call ebp
push 0
push 0x404558
call ebx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x2e4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommMask]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 0x404580
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x404594
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
lea eax, [esp + 0xae4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
lea ecx, [esp + 0x34]
push ecx
push 0
push 0x4045d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov eax, dword [0x81b1b8]
dec dword [esp + 0x10]
jne 0x423420
xor ebp, ebp
xor esi, esi
cmp eax, ebp
jbe 0x423559
mov edi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, edi
cmp eax, 0xfe
jne 0x42353e
xor eax, eax
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
lea eax, [esp + 0x4c]
push eax
push 0x4045f0
mov dword [esp + 0x24], ebp
call edi
call fcn.00422f40
mov eax, dword [0x81b1b8]
cmp eax, 0x29
jne 0x423554
call ebx
mov eax, dword [0x81b1b8]
inc esi
cmp esi, eax
jb 0x423510
cmp eax, 0x19c
jne 0x4235d7
push 0x404604
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebp
lea edx, [esp + 0x20]
push edx
push ebp
push ebp
push ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_BackupRead]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x48]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
push ebp
push ebp
lea eax, [esp + 0x2e8]
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x404618
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0x404644
push 0x404658
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edi, dword [sym.imp.USER32.dll_GetMenu]
mov esi, 0x8dc
push ebp
call edi
dec esi
jne 0x4235e2
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, 0x25865
cmp dword [0x81b1b8], 0x15a
jne 0x423616
lea ecx, [esp + 0x88]
push ecx
call esi
push 0x4046c8
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
dec edi
jne 0x4235f3
mov byte [0x47a4c0], 0
call fcn.00422a80
call fcn.00423270
call fcn.00422f20
mov esi, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov ebp, 0xdd7b3
cmp dword [0x81b1b8], 0x21
jne 0x42367d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
lea edx, [esp + 0x2e8]
push edx
push 0
call edi
lea eax, [esp + 0x14]
push eax
push 0x40464c
push 0
call ebx
dec ebp
jne 0x423646
call fcn.00423230
cmp dword [0x81b1b8], 0x58c
mov byte [0x47a4c1], 0x73
jne 0x423736
lea ecx, [esp + 0x1a0]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebp
push ebp
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push ebp
lea eax, [esp + 0x2e4]
push eax
lea ecx, [esp + 0x6e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push ebp
push ebp
push 0x4046d0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
lea edx, [esp + 0x48]
push edx
push 0x404720
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
push ebp
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0x404770
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
push 0x404784
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
call fcn.00422f30
mov ecx, dword [esp + 0x12e4]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret