Function at 0x40a440
Capabilities:
Check for debugger via api
Check for unexpected memory writes
Copy file
Create mailslot
Get common file path
Identify system language via api
Manipulate console buffer
Print debug messages
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1900
call fcn.0040afa0
cmp dword [0x562ad4], 0x177
push ebx
push ebp
push esi
push edi
jne 0x40a489
push 0x401460
push 0
call fcn.0040b210
push 0
call fcn.0040b1c0
call fcn.0040b080
push 0
call fcn.0040b050
push 0
call fcn.0040afd0
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
mov ebp, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x40a4b0
cmp dword [0x562ad4], 0x47
jne 0x40a5dc
lea eax, [esp + 0x30]
push eax
push 0
call edi
push 0
lea ecx, [esp + 0x514]
push ecx
call ebx
lea edx, [esp + 0x58]
push edx
call ebp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x28]
push edx
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
mov eax, dword [esp + 0x18]
push eax
push ecx
push ecx
push ecx
call esi
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
lea ecx, [esp + 0x114]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor eax, eax
xor edx, edx
lea ecx, [esp + 0x24]
push ecx
mov word [esp + 0x1c], dx
mov word [esp + 0x1e], ax
mov edx, dword [esp + 0x1c]
push edx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
push 0x40146c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
lea eax, [esp + 0x20]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateActCtxA]
mov eax, dword [esp + 0x1c]
cmp eax, 0x69e
je 0x40a5f5
inc eax
cmp eax, 0x11374f6
mov dword [esp + 0x1c], eax
jl 0x40a4b0
jmp 0x40a601
mov edx, dword [0x430100]
mov dword [0x562ad4], edx
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
xor edi, edi
jmp 0x40a610
cmp edi, 0x4d13
jge 0x40a623
call ebp
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
cmp dword [0x562ad4], 0x6b
jne 0x40a637
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
inc edi
cmp edi, 0x180a8e23
mov dword [0x562160], ebx
jl 0x40a610
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov edi, edi
cmp ecx, 0x403
jne 0x40a672
push 0x562ad4
call fcn.0040a0e0
cmp dword [0x562ad4], 0x78
jne 0x40a7b5
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x20]
push edx
mov word [esp + 0x20], ax
mov word [esp + 0x22], cx
mov eax, dword [esp + 0x20]
push eax
push ecx
push 0x4014a0
push ecx
call esi
push 0
call ebp
push 0x4014e0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
lea ecx, [esp + 0x118]
push ecx
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0x401530
call dword [sym.imp.KERNEL32.dll_FindAtomA]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
lea eax, [esp + 0x514]
push eax
push 0x401540
push 0x401554
push 0x40155c
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
push 0
lea ecx, [esp + 0x914]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0
lea edx, [esp + 0x1118]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x40bd26
mov dword [esp + 0x18], ecx
jl 0x40a660
call fcn.0040a1b0
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov ebp, 0x56a5e7
cmp dword [0x562ad4], 0x15
jne 0x40a7e5
push 0
push 0
call esi
sub ebp, 1
jne 0x40a7d6
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
mov dword [esp + 0x14], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [0x562ad4], 0xfd
jne 0x40a80e
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp dword [esp + 0x14], 0x1550
jne 0x40a822
mov eax, dword [0x42f008]
mov dword [0x562ad8], eax
cmp dword [0x562ad4], 0x23
jne 0x40a8cb
push 0
push 0
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
push 0
push 0
lea ecx, [esp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push 0
push 0
lea edx, [esp + 0x118]
push edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalWire]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
push 0
lea ecx, [esp + 0x518]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
push 0x401588
push 0
lea edx, [esp + 0x918]
push edx
push 0x4015a0
push 0x4015b0
push 0x4015c4
call edi
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x80dec7
mov dword [esp + 0x14], eax
jl 0x40a7fa
xor esi, esi
cmp dword [0x562ad4], esi
jbe 0x40a8ff
lea esp, [esp]
push esi
call fcn.00409f90
inc esi
cmp esi, dword [0x562ad4]
jb 0x40a8f0
call fcn.0040a0f0
call fcn.0040a1d0
cmp dword [0x562ad4], 0x1d
jne 0x40a9e3
push 0
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
lea edx, [esp + 0x91c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x4015dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxA]
push 0
push 0
push 0
push 0
push 0
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
call fcn.0040a0c0
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10