Function at 0x435e90
Capabilities:
Clear file content
Delete file
Enumerate files on windows
Get common file path
Get disk information
Get file attributes
Get hostname
Manipulate console buffer
Move file
Print debug messages
Read .ini file
Read file on windows
Set console window title
Set current directory
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3628
call fcn.00436aa0
cmp dword [0x4e1be4], 0x177
jne 0x435f18
push 0x4e11e0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x204
jne 0x435f18
cmp dword [0x4e1be4], 0xf76
jne 0x435ed7
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
push 0
call fcn.004370c0
push 0
call fcn.00436df0
push 0
push 0
call fcn.004555b0
push 0
push 0
call fcn.00436da0
push 0
call fcn.00436d20
push 0
call fcn.00436b30
push 0
call fcn.00436b00
push 0
push 0
call fcn.00436ad0
add esp, 0x2c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
mov esi, dword [ebp - 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
mov dword [ebp - 8], 0
jmp 0x435f40
cmp dword [0x4e1be4], 0x123f
jne 0x4360b4
lea eax, [ebp - 0x10]
push eax
push 0
call edi
push 0x401bcc
call ebx
lea ecx, [ebp - 0xb4]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
lea edx, [ebp - 0x628]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
push 0
lea eax, [ebp - 0xe28]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x401bf4
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
lea ecx, [ebp - 0x14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
xor edx, edx
lea ecx, [ebp - 0x30]
push ecx
push edx
push edx
push edx
push edx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
push 0
push 0
push 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0
push 0
lea eax, [ebp - 0x1628]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0x401c0c
push 0x401c28
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp dword [ebp - 8], 0x63e
je 0x4360eb
cmp dword [0x4e1be4], 0xf
jne 0x4360d7
push 0
lea ecx, [ebp - 0x628]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x1138855
jl 0x435f40
jmp 0x4360f7
mov edx, dword [0x4644ac]
mov dword [0x4e1be4], edx
mov ebx, dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
xor esi, esi
xor edi, edi
cmp dword [0x4e1be4], 0x6b
jne 0x436131
push 0x30
lea eax, [ebp - 0x64]
push esi
push eax
mov dword [ebp - 0x68], esi
call fcn.00437110
add esp, 0xc
lea ecx, [ebp - 0x68]
push ecx
push esi
push 0x401cb0
call ebx
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x4e11d0], esi
cmp edi, 0x26f46
jle 0x436178
mov eax, 0xdff62a
cmp dword [ebp - 0xc], eax
je 0x436178
cmp dword [ebp - 0x50], eax
je 0x436178
cmp dword [0x4e1be4], 0xfc5
jne 0x436178
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x401d00
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
inc edi
cmp edi, 0x6b4078b9
jl 0x436101
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x3fa
jne 0x4361aa
push 0x4e1be4
call fcn.00435b40
cmp dword [0x4e1be4], 0x65
jne 0x43637f
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push 0x401d28
push 0x401d44
push 0x401d70
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
push 0x401d78
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lopen]
push 0
push 0
push 0
call esi
push 0x30
lea edx, [ebp - 0x98]
push 0
push edx
mov dword [ebp - 0x9c], 0
call fcn.00437110
add esp, 0xc
push 0
lea eax, [ebp - 0x9c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push 0
lea edx, [ebp - 0x2e28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push 0
push 0x401dc0
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x628]
push ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
xor edx, edx
mov ecx, edx
push ecx
push edx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
lea edx, [ebp - 0x18]
push edx
push 0
lea eax, [ebp - 0x1228]
push eax
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0
push 0x401dfc
push 0x401e2c
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push 0
push 0
push 0
push 0
call ebx
push 0x401e68
lea ecx, [ebp - 0xa28]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x485ceb
jl 0x436198
call fcn.00435bf0
mov dword [ebp - 4], 0x199615
jmp 0x4363a0
cmp dword [0x4e1be4], 0x105
jne 0x4363b7
push 0x401e98
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
dec dword [ebp - 4]
jne 0x4363a0
mov dword [ebp - 8], 0
cmp dword [0x4e1be4], 0x9e2
jne 0x4363f0
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea edx, [ebp - 0x228]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp dword [ebp - 8], 0x3c76
jne 0x436403
mov eax, dword [0x4644a0]
mov dword [0x4e1be8], eax
cmp dword [0x4e1be4], 0x23
jne 0x4365b6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push 0
push 0
lea ecx, [ebp - 0xa28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
push 0
lea edx, [ebp - 0x2e28]
push edx
push 0
push 0x401eb0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
lea eax, [ebp - 0x1e28]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
lea edx, [ebp - 0x2c]
push edx
push eax
xor ecx, ecx
push ecx
lea edx, [ebp - 0xc]
push edx
push eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0xb0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
lea edx, [ebp - 0x50]
push edx
push 0x401f08
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea eax, [ebp - 0x18]
push eax
push 0
lea ecx, [ebp - 0x1228]
push ecx
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea edx, [ebp - 0x4f4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebp - 0xc]
push 0
push 0
push ecx
push 0
call ebx
mov edx, dword [ebp - 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0
call esi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2628]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x401f38
push 0
lea edx, [ebp - 0x3628]
push edx
push 0x401f50
push 0x401f60
push 0x401fb8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0xe67cf
jl 0x4363c3
xor esi, esi
cmp dword [0x4e1be4], esi
jbe 0x4365f6
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
call fcn.00435990
cmp dword [0x4e1be4], 0x22
jne 0x4365ed
lea ecx, [ebp - 0xc]
push ecx
call edi
inc esi
cmp esi, dword [0x4e1be4]
jb 0x4365d8
call fcn.00435b50
call fcn.00435c10
cmp dword [0x4e1be4], 0x1d
jne 0x43674e
xor esi, esi
push esi
push 0x402018
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0x402028
push 0x40205c
push 0x402078
push 0x4020bc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x4020e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0x4020f0
push esi
push 0x402158
push 0x402194
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push esi
lea ecx, [ebp - 0x3628]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0x30
lea eax, [ebp - 0xe4]
push esi
push eax
mov dword [ebp - 0xe8], esi
call fcn.00437110
add esp, 0xc
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0xe8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
lea eax, [ebp - 0x2628]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFileGather]
lea ecx, [ebp - 0x228]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0x4021c4
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
lea edx, [ebp - 8]
push edx
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10