Function at 0x401400
Capabilities:
Copy file
Create mailslot
Create pipe
Extract resource via kernel32 functions
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
mov al, byte [0x55c92c]
mov byte [ebp - 0x81], al
mov dword [ebp - 0x10c], 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x401455
xor ecx, ecx
jne 0x401455
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
cmp dword [ebp - 0x10c], eax
jne 0x40149d
mov esi, dword [ebp - 0x10c]
and esi, 0x2c456
and esi, dword [ebp - 0x10c]
or esi, 0x931b
mov edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x10c]
and edx, dword [ebp - 0x10c]
or esi, edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
or esi, ecx
mov dword [ebp - 0x10c], esi
jmp 0x4014dc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edx, dword [ebp - 0x10c]
lea esi, [edx + eax - 0xf501]
sub esi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeStatus]
add esi, eax
sub esi, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], esi
cmp dword [ebp - 0x10c], 0xab1b
je 0x4014f4
cmp dword [ebp - 0x10c], 0x53daa
jne 0x401500
mov dword [ebp - 0x10c], 0x266eb
jmp 0x401539
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov esi, 0x6e1b6
sub esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
add esi, eax
sub esi, dword [ebp - 0x10c]
xor eax, eax
add esi, dword [ebp - 0x70]
adc eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
movzx ecx, byte [ebp - 0x81]
add ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea eax, [edx + ecx + 0x639c]
mov ecx, 0x549ee
or eax, ecx
mov dword [ebp - 0x10c], eax
movzx edx, byte [ebp - 0x81]
mov dword [ebp - 0x10c], edx
mov ax, word [ebp - 0x10c]
mov word [ebp - 0xac], ax
mov ecx, 1
test ecx, ecx
je 0x4015dd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
mov esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
sub eax, dword [ebp - 0x10c]
and esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov edi, eax
movzx edx, word [ebp - 0xac]
sub edi, edx
add edi, 0x55515
push 0
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
and edi, eax
and edi, dword [ebp - 0x10c]
or esi, edi
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
jmp 0x4015f2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
and eax, 0xbb4dd
mov dword [ebp - 0x10c], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
movzx ecx, byte [ebp - 0x81]
sub ecx, 0x32a96
movzx edx, byte [ebp - 0x81]
sub ecx, edx
movzx edx, byte [ebp - 0x81]
sub ecx, edx
movzx edx, word [ebp - 0xac]
sub ecx, edx
movzx edx, word [ebp - 0xac]
lea ecx, [ecx + edx - 0x133d4]
or eax, ecx
or eax, 0x29470
xor edx, edx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 0x40bce
sub ecx, eax
and ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
sub eax, 0xd354
movzx edx, word [ebp - 0xac]
sub eax, edx
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x53beb]
sub edx, dword [ebp - 0x10c]
mov esi, edx
xor edi, edi
mov ebx, dword [ebp - 0x70]
add ebx, 0x7c4fc
mov eax, dword [ebp - 0x6c]
adc eax, 0
push 0
push 0
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x14c]
sbb eax, ecx
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
add ebx, edx
adc eax, ecx
or esi, ebx
or edi, eax
or esi, 0x25212
movzx edx, word [ebp - 0xac]
add edx, dword [ebp - 0x10c]
xor eax, eax
or esi, edx
or edi, eax
mov dword [ebp - 0x10c], esi
movzx ecx, word [ebp - 0xac]
mov edx, 0x2599f
sub edx, ecx
sub edx, 0xe810
movzx eax, byte [ebp - 0x81]
sub edx, eax
movzx ecx, word [ebp - 0xac]
add edx, ecx
sub edx, dword [ebp - 0x10c]
sub edx, 0x7cfd2
sub edx, dword [ebp - 0x10c]
sub edx, 0xfc51
xor eax, eax
and edx, dword [ebp - 0x70]
and eax, dword [ebp - 0x6c]
mov dword [ebp - 0x10c], edx
movzx ecx, byte [ebp - 0x81]
cmp dword [ebp - 0x10c], ecx
je 0x40178d
movzx edx, word [ebp - 0xac]
cmp edx, 0x66d68
je 0x40178d
movzx eax, word [ebp - 0xac]
cmp eax, 0x79ab8
je 0x40178d
cmp dword [ebp - 0x10c], 0x5151a
jne 0x401809
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
cmp eax, dword [ebp - 0x10c]
jne 0x401809
movzx esi, word [ebp - 0xac]
movzx edi, byte [ebp - 0x81]
add edi, 0x5b8e1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
sub edi, eax
add edi, 0x3ff76
sub edi, dword [ebp - 0x10c]
sub edi, dword [ebp - 0x10c]
and esi, edi
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
and esi, eax
xor ecx, ecx
mov edx, dword [ebp - 0x10c]
xor eax, eax
add edx, dword [ebp - 0x70]
adc eax, dword [ebp - 0x6c]
and edx, 0x1e18c
and eax, 0
xor esi, edx
xor ecx, eax
xor esi, 0x721ff
xor ecx, 0
mov dword [ebp - 0x10c], esi
jmp 0x401822
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x7fa1d
and ecx, 0xfffab477
mov word [ebp - 0xac], cx
movzx esi, word [ebp - 0xac]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
sub esi, eax
sub esi, 0xd875
mov edi, dword [ebp - 0x10c]
sub edi, 0x15903
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
sub edi, eax
sub edi, dword [ebp - 0x10c]
mov ecx, edi
shl esi, cl
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
mov edi, dword [ebp - 0x10c]
sub edi, eax
movzx edx, word [ebp - 0xac]
sub edi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea eax, [edi + eax + 0x39140]
and esi, eax
mov dword [ebp - 0x10c], esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
cmp eax, 0x343f1
je 0x4018c8
movzx ecx, byte [ebp - 0x81]
cmp ecx, 0x39894
je 0x4018c8
movzx edx, byte [ebp - 0x81]
cmp edx, 0x41289
jne 0x4018e1
mov eax, dword [ebp - 0x10c]
add eax, 0x7ba4
or eax, 0x1c6e7
mov word [ebp - 0xac], ax
jmp 0x40193c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
sub eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea esi, [eax + ecx + 0x6bd2d]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
sub edi, 0x51896
mov edx, dword [ebp - 0x10c]
and edi, edx
and edi, 0x54552
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
sub eax, 0x5332d
xor edi, eax
or esi, edi
mov word [ebp - 0xac], si
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret