Function at 0x40a4b0
Capabilities:
Check for debugger via api
Check for unexpected memory writes
Copy file
Create mailslot
Get common file path
Identify system language via api
Manipulate console buffer
Move file
Print debug messages
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1900
call fcn.0040b020
cmp dword [0x5628d4], 0x177
push ebx
push ebp
push esi
push edi
jne 0x40a502
push 0x401478
push 0
call fcn.0040b4e0
push 0
call fcn.0040b490
push 0
push 0
call fcn.0040b240
call fcn.0040b100
push 0
call fcn.0040b0d0
push 0
call fcn.0040b050
add esp, 0x1c
mov ebx, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov edi, dword [sym.imp.KERNEL32.dll_AddAtomW]
xor eax, eax
mov dword [esp + 0x1c], eax
cmp dword [0x5628d4], 0x47
jne 0x40a64c
lea eax, [esp + 0x30]
push eax
push 0
call ebx
push 0
lea ecx, [esp + 0x514]
push ecx
call ebp
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x28]
push edx
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
mov eax, dword [esp + 0x18]
push eax
push ecx
push ecx
push ecx
call esi
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
lea ecx, [esp + 0x114]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor eax, eax
xor edx, edx
lea ecx, [esp + 0x24]
push ecx
mov word [esp + 0x1c], dx
mov word [esp + 0x1e], ax
mov edx, dword [esp + 0x1c]
push edx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
push 0x401484
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0
call dword [sym.imp.KERNEL32.dll_CancelDeviceWakeupRequest]
lea eax, [esp + 0x20]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov eax, dword [esp + 0x1c]
cmp eax, 0x69e
je 0x40a665
inc eax
cmp eax, 0x11374f6
mov dword [esp + 0x1c], eax
jl 0x40a520
jmp 0x40a671
mov edx, dword [0x430100]
mov dword [0x5628d4], edx
xor ebp, ebp
xor ebx, ebx
cmp ebx, 0x4d13
jge 0x40a68c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
push ebp
push ebp
call dword [sym.imp.GDI32.dll_GetBitmapBits]
cmp dword [0x5628d4], 0x6b
jne 0x40a6a0
push ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
inc ebx
cmp ebx, 0x180c14c3
mov dword [0x561f60], ebp
jl 0x40a675
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
xor ecx, ecx
mov dword [esp + 0x18], ecx
cmp ecx, 0x403
jne 0x40a6d3
push 0x5628d4
call fcn.0040a140
cmp dword [0x5628d4], 0x78
jne 0x40a847
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x20]
push edx
mov word [esp + 0x20], ax
mov word [esp + 0x22], cx
mov eax, dword [esp + 0x20]
push eax
push ecx
push 0x4014b8
push ecx
call esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4014f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
lea ecx, [esp + 0x118]
push ecx
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0
call ebp
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
call edi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
lea eax, [esp + 0x514]
push eax
push 0x401548
push 0x40155c
push 0x401564
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
push 0
lea ecx, [esp + 0x914]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0
lea edx, [esp + 0x1118]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x40bd26
mov dword [esp + 0x18], ecx
jl 0x40a6c1
call fcn.0040a210
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov edi, 0x56a5e7
jmp 0x40a870
cmp dword [0x5628d4], 0x15
jne 0x40a87f
push 0
push 0
call esi
sub edi, 1
jne 0x40a870
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
mov dword [esp + 0x14], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [0x5628d4], 0xfd
jne 0x40a8a8
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
cmp dword [esp + 0x14], 0x1550
jne 0x40a8bc
mov eax, dword [0x42f008]
mov dword [0x5628d8], eax
cmp dword [0x5628d4], 0x23
jne 0x40a965
push 0
push 0
push 0
push 0
call esi
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
push 0
push 0
lea ecx, [esp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push 0
push 0
lea edx, [esp + 0x118]
push edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_GlobalWire]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
push 0
lea ecx, [esp + 0x518]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
push 0x401590
push 0
lea edx, [esp + 0x918]
push edx
push 0x4015a8
push 0x4015b8
push 0x4015cc
call ebx
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x80dec7
mov dword [esp + 0x14], eax
jl 0x40a894
xor esi, esi
cmp dword [0x5628d4], esi
jbe 0x40a992
push esi
call fcn.00409ff0
inc esi
cmp esi, dword [0x5628d4]
jb 0x40a983
call fcn.0040a150
call fcn.0040a230
cmp dword [0x5628d4], 0x1d
jne 0x40aa76
push 0
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
lea edx, [esp + 0x91c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x4015e4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
call fcn.0040a120
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10