Function at 0x41ddb0
Capabilities:
Copy file
Get system information on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1600
call fcn.00410950
push esi
push edi
cmp dword [0x177d4a8], 0x177
jne 0x41de5e
push 0x177cdb0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xe12
jne 0x41de5e
mov ecx, 6
mov esi, str.jikoraboduwu
lea edi, [ebp - 0x808]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7e6
push 0
lea eax, [ebp - 0x7ee]
push eax
call fcn.0040acb0
add esp, 0xc
lea ecx, [ebp - 8]
mov dword [ebp - 4], ecx
push 0
call fcn.004011d0
add esp, 4
push 0
push 0
call fcn.00401710
add esp, 8
push 0x4260c0
push str.0__f
push 0x44baa0
call fcn.00401260
add esp, 0xc
push 0
call fcn.00401230
add esp, 4
push 0
push 0
call fcn.004014b0
add esp, 8
push 0
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x80c], 0
jmp 0x41de79
mov edx, dword [ebp - 0x80c]
add edx, 1
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp - 0x80c]
cdq
mov dword [ebp - 0x1600], eax
mov dword [ebp - 0x15fc], edx
cmp dword [ebp - 0x15fc], 1
jg 0x41df0d
jl 0x41dea3
cmp dword [ebp - 0x1600], 0x1909bea5
jae 0x41df0d
cmp dword [ebp - 0x80c], 0x41ac
jne 0x41debb
mov eax, dword [0x4295e4]
mov dword [0x177d4a8], eax
jmp 0x41df0d
cmp dword [0x177d4a8], 0xf
jne 0x41df08
lea ecx, [ebp - 0x82c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
lea edx, [ebp - 0x1040]
push edx
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x834]
push ecx
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0x830]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
jmp 0x41de6a
mov dword [ebp - 0x1044], 0
jmp 0x41df28
mov ecx, dword [ebp - 0x1044]
add ecx, 1
mov dword [ebp - 0x1044], ecx
cmp dword [ebp - 0x1044], 0x2750d3
jge 0x41dfaf
cmp dword [ebp - 0x1044], 0x197
jge 0x41df4a
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuItemID]
cmp dword [0x177d4a8], 0x449
jne 0x41df64
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
mov dword [0x1774efc], 0
cmp dword [ebp - 0x1044], 0x1bb81
jle 0x41dfaa
cmp dword [ebp - 0x1070], 0x50854379
je 0x41dfaa
cmp dword [ebp - 0x1060], 0xd7ea37
je 0x41dfaa
cmp dword [0x177d4a8], 0x1b5
jne 0x41dfaa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
jmp 0x41df19
mov dword [ebp - 0x1074], 0
jmp 0x41dfca
mov edx, dword [ebp - 0x1074]
add edx, 1
mov dword [ebp - 0x1074], edx
cmp dword [ebp - 0x1074], 0x496e6f
jge 0x41e01c
cmp dword [ebp - 0x1074], 0xff832
jne 0x41dff1
mov eax, dword [0x177d4a8]
add eax, 0x12336
mov dword [0x177d4a8], eax
cmp dword [0x177d4a8], 0x65
jne 0x41e01a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41dfbb
call fcn.0041c320
mov dword [ebp - 0x1098], 0
jmp 0x41e03c
mov ecx, dword [ebp - 0x1098]
add ecx, 1
mov dword [ebp - 0x1098], ecx
cmp dword [ebp - 0x1098], 0x1083a
jge 0x41e071
cmp dword [0x177d4a8], 0x105
jne 0x41e06f
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push str.cohuroragehazur
push str.mapegeguwihaliso
push str.yenayujifirovaxutovidihuhikovekigidosoyohoruhogologeviwesajuso
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
jmp 0x41e02d
mov dword [ebp - 0x109c], 0
jmp 0x41e08c
mov edx, dword [ebp - 0x109c]
add edx, 1
mov dword [ebp - 0x109c], edx
cmp dword [ebp - 0x109c], 0xe5fbc
jge 0x41e103
cmp dword [0x177d4a8], 0x9e2
jne 0x41e0cc
push 0
push 0
push str.rumuyenalu
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x11e0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp dword [ebp - 0x109c], 0x3b22
jne 0x41e0e4
mov ecx, dword [0x428fc8]
mov dword [0x177d4ac], ecx
cmp dword [0x177d4a8], 0xdb5
jne 0x41e0fe
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
jmp 0x41e07d
mov dword [ebp - 0x11e4], 0
jmp 0x41e11e
mov edx, dword [ebp - 0x11e4]
add edx, 1
mov dword [ebp - 0x11e4], edx
mov eax, dword [ebp - 0x11e4]
cmp eax, dword [0x177d4a8]
jae 0x41e18a
cmp dword [0x177d4a8], 0x932
jne 0x41e15c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [ebp - 0x11e4]
push ecx
call fcn.0041d2f0
cmp dword [0x177d4a8], 0x22
jne 0x41e188
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
lea edx, [ebp - 0x11ec]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x41e10f
mov dword [ebp - 0x11f0], 0
jmp 0x41e1a5
mov eax, dword [ebp - 0x11f0]
add eax, 1
mov dword [ebp - 0x11f0], eax
cmp dword [ebp - 0x11f0], 0xe96350
jge 0x41e1ca
cmp dword [0x177d4a8], 0xdda
jne 0x41e1c8
push str.yaweyaxabufoxipohaveyegoyofaxis
call dword [sym.imp.KERNEL32.dll_FindAtomA]
jmp 0x41e196
mov dword [ebp - 0x11f4], 0
jmp 0x41e1e5
mov ecx, dword [ebp - 0x11f4]
add ecx, 1
mov dword [ebp - 0x11f4], ecx
cmp dword [ebp - 0x11f4], 0x3dc4a3
jge 0x41e201
cmp dword [ebp - 0x11f4], 0x26
jne 0x41e1ff
call fcn.0041c340
jmp 0x41e1d6
call fcn.0041db50
cmp dword [0x177d4a8], 0x1d
jne 0x41e256
push 0
push 0
push 0
push 0
push str.ekoxicadovakaroxo
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push 0
push 0
push 0
push 0
push str.Bakegazosizu_vecuzacoluyaz_savilumel
push str.Fovowez_vewumifakip_xizig_soluleyo
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
lea edx, [ebp - 0x15f8]
push edx
push str.nugum
push str.detukecubayohozoseteyoriroge
push str.kiguceraxajuxupudutedatoguwupuke
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10