Function at 0x404840
Capabilities:
Copy file
Create pipe
Get common file path
Get geographical location
Get hostname
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1188
call fcn.00406fe0
push ebx
push esi
xor ebx, ebx
push edi
xor esi, esi
cmp esi, 0x1e3bd
jge 0x40486d
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetMenuBarInfo]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0x1ea07d0f
jle 0x404887
cmp dword [ebp - 4], 0xacef98
je 0x404887
cmp dword [ebp - 0x3c], 0xad6910c
jne 0x404890
inc esi
cmp esi, 0x8df05308
jb 0x404854
xor ecx, ecx
cmp ecx, 0x13b4
jne 0x4048a5
mov eax, 0x38d6
add dword [0x8cbf04], eax
inc ecx
cmp ecx, 0x31aa3a
jl 0x404892
call fcn.0040482c
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov edi, 0x962a66
cmp dword [0x8cbf04], 3
jne 0x4048d5
lea eax, [ebp - 0x188]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp dword [0x8cbf04], 0x71f
jne 0x404918
push ebx
push ebx
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push ebx
push ebx
push ebx
push ebx
call esi
push ebx
lea eax, [ebp - 0x588]
push eax
push 0x401330
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
dec edi
jne 0x4048be
mov eax, dword [0x8cbf04]
xor esi, esi
cmp eax, ebx
jbe 0x40495c
cmp eax, 0xfe
jne 0x40494c
push ebx
lea eax, [ebp - 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ebx
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push esi
call fcn.004042c4
mov eax, dword [0x8cbf04]
inc esi
cmp esi, eax
jb 0x404926
cmp eax, 0x19c
jne 0x404a32
mov esi, dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
push ebx
call esi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push ebx
push 0x401380
push ebx
call dword [sym.imp.KERNEL32.dll__hwrite]
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x588]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1188]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push ebx
lea eax, [ebp - 0x988]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x40124c
push 0x4013cc
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push ebx
lea eax, [ebp - 0xc]
push eax
call fcn.00403a10
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
xor esi, esi
mov edi, 0x79fb48
cmp esi, 0xab9d
jne 0x404a4d
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x8cbf00], eax
inc esi
cmp esi, 0x2594b
jl 0x404a39
mov byte [0x79fb48], bl
xor esi, esi
cmp esi, 0x148
jne 0x404a6b
call fcn.004043e1
inc esi
cmp esi, 0x71761d
jl 0x404a5e
push 0x79e578
push dword [0x8cbf04]
push dword [0x8c8c98]
call fcn.0040429c
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFlags]
cmp esi, 0x2f64
jne 0x404aa0
call fcn.004043d2
inc esi
cmp esi, 0x46d9a
jl 0x404a8c
mov esi, 0xdd7b3
cmp dword [0x8cbf04], 0x21
jne 0x404ae8
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
push ebx
push ebx
lea eax, [ebp - 0x1188]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
push ebx
lea eax, [ebp - 0x988]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProfileSectionA]
dec esi
jne 0x404aae
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x79fb49], 0x676d6973
mov word [0x79fb51], 0x6c6c
mov byte [0x79fb53], bl
mov byte [0x79fb48], 0x6d
mov dword [0x79fb4d], 0x642e3233
call edi
mov esi, 0x1ef75
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec esi
jne 0x404b23
cmp dword [0x8cbf04], 0x58c
jne 0x404b84
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x401400
call edi
push ebx
lea eax, [ebp - 0x1188]
push eax
push 0x401420
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
lea eax, [ebp - 0x988]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
call fcn.004043cb
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret