Function at 0x423270
Capabilities:
Create mailslot
Create thread
Enumerate gui resources
Get disk information
Get disk size
Get file attributes
Get hostname
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x423ba1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x16d0
call fcn.004221e0
cmp dword [0x81b558], 0x6c
push ebx
push ebp
push esi
push edi
jne 0x42336f
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x81b558], 0x3a
jne 0x4232cb
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 0
call fcn.0040a08b
add esp, 0xc
push 0x4044bc
push 0
call fcn.0040a08b
push 0
call fcn.0040a050
add esp, 0xc
push 0
call fcn.00409c3e
add esp, 4
push 0
call fcn.0040a050
add esp, 4
lea ecx, [esp + 0x88]
push ecx
call fcn.004062c0
lea esi, [esp + 0x18]
mov dword [esp + 0x16ec], 0
call fcn.00406b60
sub esp, 0x1c
mov byte [esp + 0x1708], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0
call fcn.00405e70
mov ecx, esi
call fcn.00406c00
push 0
lea ecx, [esp + 0x4c]
call fcn.00405e70
lea ebx, [esp + 0x48]
mov eax, esi
mov byte [esp + 0x16ec], 2
call fcn.00406b80
mov ecx, ebx
call fcn.00405f00
push 0
call fcn.0040a792
mov eax, 0x38d6
add dword [0x81b558], eax
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
mov ebp, dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
xor esi, esi
cmp esi, 0x1c2a7
jge 0x423396
push 0
call ebp
cmp esi, 0x1ea072e7
jle 0x4233ae
cmp edi, 0xacd468
je 0x4233ae
cmp ebx, 0xad1ade0
jne 0x4233b7
inc esi
cmp esi, 0x8c6fd558
jb 0x42338a
mov edx, dword [0x81b558]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov edi, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
mov ebp, dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
mov dword [0x8179c8], eax
mov eax, dword [0x81b558]
mov dword [esp + 0x10], 0x962d40
cmp eax, 0x3f5
jne 0x4234b8
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call esi
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x6e4]
push ecx
push 0x4044d4
call edi
push 0
push 0
push 0
push 0
call ebp
push 0
push 0x4044e0
call ebx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1a4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommMask]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 0x4044f4
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x404518
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
lea ecx, [esp + 0xee4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
lea edx, [esp + 0x34]
push edx
push 0
push 0x404550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov eax, dword [0x81b558]
dec dword [esp + 0x10]
jne 0x4233f0
xor ebp, ebp
xor esi, esi
cmp eax, ebp
jbe 0x42351f
mov edi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
cmp eax, 0xfe
jne 0x423504
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x4c]
push ecx
push 0x404570
mov dword [esp + 0x24], ebp
call edi
call fcn.00422f20
mov eax, dword [0x81b558]
cmp eax, 0x29
jne 0x42351a
call ebx
mov eax, dword [0x81b558]
inc esi
cmp esi, eax
jb 0x4234d6
cmp eax, 0x19c
jne 0x423597
push 0x4045b0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
lea edx, [esp + 0x10]
push edx
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_BackupWrite]
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebp
push ebp
lea ecx, [esp + 0x1a8]
push ecx
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x4045cc
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0x404600
push 0x404608
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edi, dword [sym.imp.USER32.dll_GetMenu]
mov esi, 0x8dc
push ebp
call edi
dec esi
jne 0x4235a2
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, 0x25865
lea esp, [esp]
cmp dword [0x81b558], 0x15a
jne 0x4235df
lea edx, [esp + 0x88]
push edx
call esi
push 0x40469c
push ebp
push ebp
call edi
dec ebx
jne 0x4235c0
mov byte [0x47a860], bl
call fcn.00422a60
call fcn.00423240
call fcn.00422f00
mov esi, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
mov ebp, 0xdd7b3
mov edi, edi
cmp dword [0x81b558], 0x21
jne 0x423647
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
lea eax, [esp + 0x1a8]
push eax
push 0
call edi
lea ecx, [esp + 0x14]
push ecx
push 0x4046b0
push 0
call ebx
dec ebp
jne 0x423610
call fcn.00423200
cmp dword [0x81b558], 0x58c
mov byte [0x47a861], 0x73
jne 0x423700
lea edx, [esp + 0x5a0]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebp
lea ecx, [esp + 0x1a4]
push ecx
lea edx, [esp + 0x6e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push ebp
push ebp
push 0x4046c0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
lea eax, [esp + 0x48]
push eax
push 0x404720
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringA]
push ebp
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0x40473c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
push 0x404750
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
call fcn.00422f10
mov ecx, dword [esp + 0x16e4]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret