Function at 0x4284a0
Capabilities:
Create mailslot
Enumerate gui resources
Get disk information
Get disk size
Get file attributes
Get hostname
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x428de1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x16d0
call fcn.00425080
cmp dword [0x7ed968], 0x6c
push ebx
push ebp
push esi
push edi
jne 0x42859f
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x7ed968], 0x3a
jne 0x4284fb
mov eax, dword [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0
call fcn.0040a1f3
add esp, 0xc
push 0x404504
push 0
call fcn.0040a1f3
push 0
call fcn.0040a1b8
add esp, 0xc
push 0
call fcn.00409e3e
add esp, 4
push 0
call fcn.0040a1b8
add esp, 4
lea ecx, [esp + 0x88]
push ecx
call fcn.00406300
lea esi, [esp + 0x18]
mov dword [esp + 0x16ec], 0
call fcn.00406ba0
sub esp, 0x1c
mov byte [esp + 0x1708], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0
call fcn.00405ea0
mov ecx, esi
call fcn.00406c40
push 0
lea ecx, [esp + 0x4c]
call fcn.00405ea0
lea ebx, [esp + 0x48]
mov eax, esi
mov byte [esp + 0x16ec], 2
call fcn.00406bc0
mov ecx, ebx
call fcn.00405f30
push 0
call fcn.0040a8fa
mov eax, 0x38d6
add dword [0x7ed968], eax
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
mov ebp, dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
xor esi, esi
cmp esi, 0x1c2bb
jge 0x4285c6
push 0
call ebp
cmp esi, 0x1ea072d3
jle 0x4285de
cmp edi, 0xacd462
je 0x4285de
cmp ebx, 0xad1b1c8
jne 0x4285e7
inc esi
cmp esi, 0x8c6fd562
jb 0x4285ba
mov edx, dword [0x7ed968]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov edi, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
mov ebp, dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
mov dword [0x7e9dd8], eax
mov eax, dword [0x7ed968]
mov dword [esp + 0x10], 0x962d40
cmp eax, 0x3f5
jne 0x4286fb
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call esi
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x6e4]
push ecx
push 0x40451c
call edi
push 0
push 0
push 0
push 0
call ebp
push 0
push 0x404528
call ebx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1a4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommMask]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 0x40453c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x404560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
lea ecx, [esp + 0xee4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
lea edx, [esp + 0x3c]
push edx
push 0
push 0x404598
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
mov eax, dword [0x7ed968]
dec dword [esp + 0x10]
jne 0x428620
xor ebp, ebp
xor esi, esi
cmp eax, ebp
jbe 0x428769
mov edi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
lea esp, [esp]
cmp eax, 0xfe
jne 0x42874e
lea ecx, [esp + 0x18]
push ecx
xor eax, eax
lea edx, [esp + 0x4c]
push edx
push 0x4045b8
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call edi
call fcn.00428150
mov eax, dword [0x7ed968]
cmp eax, 0x29
jne 0x428764
call ebx
mov eax, dword [0x7ed968]
inc esi
cmp esi, eax
jb 0x428720
cmp eax, 0x19c
jne 0x4287e1
push 0x4045f8
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
lea eax, [esp + 0x10]
push eax
push ebp
push ebp
lea ecx, [esp + 0x20]
push ecx
push ebp
push ebp
push ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_BackupWrite]
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebp
push ebp
lea edx, [esp + 0x1a8]
push edx
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x404614
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0x404648
push 0x404650
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edi, dword [sym.imp.USER32.dll_GetMenu]
mov esi, 0x8dc
lea esp, [esp]
push ebp
call edi
dec esi
jne 0x4287f0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, 0x25865
jmp 0x428810
cmp dword [0x7ed968], 0x15a
jne 0x42882f
lea eax, [esp + 0x88]
push eax
call esi
push 0x4046e4
push ebp
push ebp
call edi
dec ebx
jne 0x428810
mov byte [0x44cc70], bl
call fcn.00427c90
call fcn.00428470
call fcn.00428130
mov edi, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, 0xdd7b3
mov edi, edi
cmp dword [0x7ed968], 0x21
jne 0x42888d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call edi
push 0
push 0
lea ecx, [esp + 0x1a8]
push ecx
push 0
call ebx
push 0
call esi
dec ebp
jne 0x428860
call fcn.00428430
cmp dword [0x7ed968], 0x58c
mov byte [0x44cc71], 0x73
jne 0x428942
lea edx, [esp + 0x5a0]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebp
lea ecx, [esp + 0x1a4]
push ecx
lea edx, [esp + 0x6e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push ebp
push ebp
push 0x4046f8
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
lea eax, [esp + 0x48]
push eax
push 0x404758
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringA]
push ebp
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0x404774
call esi
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
push 0x404788
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
call fcn.00428140
mov ecx, dword [esp + 0x16e4]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret