Function at 0x40543b
Capabilities:
Copy file
Create mailslot
Enumerate files on windows
Get common file path
Get disk information
Get disk size
Manipulate console buffer
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1108
call fcn.00405b80
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp esi, 0x13e6
jne 0x405461
mov eax, 0x38d6
add dword [0x2b8ea54], eax
cmp dword [0x2b8ea54], 0xbd8
jne 0x40547c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
inc esi
cmp esi, 0x31a652
jl 0x40544e
xor esi, esi
cmp esi, 0x1ef75
jge 0x40549c
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, 0x1ea055ff
jle 0x4054b6
cmp dword [ebp - 4], 0xacef98
je 0x4054b6
cmp dword [ebp - 0x60], 0xad6910c
jne 0x4054bf
inc esi
cmp esi, 0x8deecc68
jb 0x405487
push dword [0x2b8ea54]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x2b8e600], eax
mov esi, 0x962be2
cmp dword [0x2b8ea54], 0x481
jne 0x405502
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x248]
push eax
push 0x40131c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp dword [0x2b8ea54], 0x721
jne 0x4055d8
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [ebp - 0x1108]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x508]
push eax
push 0x40132c
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push ebx
push ebx
push ebx
push 0x401360
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x908]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x401390
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
push 0x4013e8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
dec esi
jne 0x4054d6
cmp dword [0x2b8ea54], ebx
jbe 0x40561a
push esi
call fcn.00404eb5
cmp dword [0x2b8ea54], 0x29
jne 0x405611
push ebx
push ebx
push ebx
push 0x4013f0
push 0x401404
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
inc esi
cmp esi, dword [0x2b8ea54]
jb 0x4055e7
cmp dword [0x2b8ea54], 0x19c
jne 0x405660
push 0x401410
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
lea eax, [ebp - 0x44]
push eax
call esi
push ebx
push ebx
push ebx
push 0x40147c
push 0x401494
push ebx
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
lea eax, [ebp - 0x64]
push eax
call esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor esi, esi
cmp esi, 0xab9d
jne 0x40567a
push 0x42ae88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x2b8ea50], eax
inc esi
cmp esi, 0x2594b
jl 0x405662
mov byte [0x42ae88], bl
xor esi, esi
cmp esi, 0x148
jne 0x405698
call fcn.00404f78
inc esi
cmp esi, 0x427fa7
jl 0x40568b
push 0x419010
push dword [0x2b8ea54]
push dword [0x2b8e600]
call fcn.00404e8d
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
cmp esi, 0x2f7e4
jne 0x4056cd
call fcn.00404f6a
inc esi
cmp esi, 0x48122
jl 0x4056b9
call fcn.0040466c
cmp dword [0x2b8ea54], 0x58c
jne 0x40574e
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
lea eax, [ebp - 0x1108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
lea eax, [ebp - 0x358]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x908]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
lea eax, [ebp - 0x10]
push eax
push 0x4014d0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
call fcn.00404f63
pop esi
xor eax, eax
pop ebx
leave
ret