Function at 0x4096d0
Capabilities:
Copy file
Create mailslot
Enumerate gui resources
Get file size
Manipulate console buffer
Print debug messages
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x45f904]
sub esp, 0xc68
push ebx
push ebp
push esi
push edi
cmp ecx, 0x177
jne 0x409711
push 0
call fcn.0040a850
push 0
push 0
call fcn.0040a600
push 0
push 0
call fcn.0040a5b0
add esp, 0x14
push 0
call fcn.0040a000
mov esi, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
mov ebx, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
xor eax, eax
mov dword [esp + 0x14], eax
cmp ecx, 0x47
jne 0x409828
lea eax, [esp + 0x2c]
push eax
push 0
call esi
push 0
lea ecx, [esp + 0x47c]
push ecx
call edi
xor eax, eax
lea edx, [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
push edx
lea eax, [esp + 0x54]
push eax
push 0x4013ac
call ebx
push 0
lea ecx, [esp + 0x87c]
push ecx
push 0
push 0
push 0
push 0
call ebp
xor eax, eax
xor edx, edx
lea ecx, [esp + 0x28]
push ecx
mov word [esp + 0x28], dx
mov word [esp + 0x2a], ax
mov edx, dword [esp + 0x28]
push edx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
lea eax, [esp + 0x7c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor edx, edx
xor ecx, ecx
lea eax, [esp + 0x18]
push eax
mov word [esp + 0x24], cx
mov word [esp + 0x26], dx
mov ecx, dword [esp + 0x24]
push ecx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
lea edx, [esp + 0x48]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov eax, dword [esp + 0x14]
cmp eax, 0x6a1
je 0x409b89
mov ecx, dword [0x45f904]
cmp ecx, 0xf
je 0x409b98
inc eax
cmp eax, 0x53f9406
mov dword [esp + 0x14], eax
jl 0x40972f
mov ebp, dword [sym.imp.USER32.dll_CharUpperW]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
xor esi, esi
cmp esi, 0x7423
jge 0x409878
push 0
call ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x3f56b
mov dword [0x45ef90], 0
jle 0x4098c3
cmp dword [esp + 0x18], 0xdfe5c2
je 0x4098c3
cmp dword [esp + 0x5c], 0xdf5954
je 0x4098c3
cmp dword [0x45f904], 0x28
jne 0x4098c3
push 0x4013d4
push 0
push 0
call edi
push 0x4013e0
push 0x401404
push 0x401438
call ebx
inc esi
cmp esi, 0x180bc451
jl 0x409866
mov esi, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCommState]
xor ecx, ecx
mov dword [esp + 0x14], ecx
lea ebx, [ebx]
cmp ecx, 0x40d
jne 0x409902
push 0x45f904
call fcn.00409370
cmp dword [0x45f904], 0x78
jne 0x4099b0
push 0
push 0
call esi
push 0
push 0
push 0
call edi
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
push 0x401448
push 0x401494
call ebx
push 0
push 0
call ebp
mov edx, dword [esp + 0x18]
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0x4014b4
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFile]
mov ecx, dword [esp + 0x14]
inc ecx
cmp ecx, 0x40bd22
mov dword [esp + 0x14], ecx
jl 0x4098f0
call fcn.00409440
mov edi, dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor ebp, ebp
xor esi, esi
cmp dword [0x45f904], 0x15
jne 0x4099dd
push ebp
push ebp
call edi
cmp esi, 0x1550
jne 0x4099f1
mov ecx, dword [0x427008]
mov dword [0x45f908], ecx
inc esi
cmp esi, 0x56a453
jl 0x4099d0
mov esi, dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov edi, dword [sym.imp.KERNEL32.dll_QueryDepthSList]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [esp + 0x14], 0x7015e7
cmp dword [0x45f904], 0xfd
jne 0x409a27
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
cmp dword [0x45f904], 0x23
jne 0x409a48
call esi
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call edi
lea eax, [esp + 0x30]
push eax
call ebx
sub dword [esp + 0x14], 1
jne 0x409a14
xor esi, esi
cmp dword [0x45f904], ebp
jbe 0x409a6f
lea esp, [esp]
push esi
call fcn.00409240
inc esi
cmp esi, dword [0x45f904]
jb 0x409a60
mov esi, dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, 0x1756bb
cmp dword [0x45f904], 0x15a
jne 0x409a99
push ebp
push ebp
call esi
push 0x4014cc
push ebp
push ebp
call edi
sub ebx, 1
jne 0x409a80
call fcn.00409380
call fcn.00409460
cmp dword [0x45f904], 0x1d
jne 0x409b78
push ebp
lea ecx, [esp + 0x1c]
push ecx
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x4014fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push ebp
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push ebp
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebp
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea edx, [esp + 0x28]
push edx
push ebp
lea eax, [esp + 0x38]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateActCtxA]
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebp
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
xor eax, eax
xor ecx, ecx
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov edx, dword [esp + 0x14]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
call fcn.00409350
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x428100]
mov dword [0x45f904], eax
jmp 0x409852
push 0
lea ecx, [esp + 0x7c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]