Function at 0x41ddb0
Capabilities:
Copy file
Get system information on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a00
call fcn.004108c0
push esi
push edi
cmp dword [0x176b050], 0x177
jne 0x41de60
push 0x176a958
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xe12
jne 0x41de60
mov ecx, 9
mov esi, str.riwucesomaverocanu
lea edi, [ebp - 0x808]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7da
push 0
lea eax, [ebp - 0x7e2]
push eax
call fcn.0040ac20
add esp, 0xc
lea ecx, [ebp - 8]
mov dword [ebp - 4], ecx
push 0
call fcn.004011d0
add esp, 4
push 0
push 0
call fcn.004016e0
add esp, 8
push 0x426238
push str.0__f
push 0x439648
call fcn.00401230
add esp, 0xc
push 0
push 0
call fcn.004016e0
add esp, 8
push 0
push 0
call fcn.00401480
add esp, 8
push 0
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x80c], 0
jmp 0x41de7b
mov edx, dword [ebp - 0x80c]
add edx, 1
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp - 0x80c]
cdq
mov dword [ebp - 0x1a00], eax
mov dword [ebp - 0x19fc], edx
cmp dword [ebp - 0x19fc], 1
jg 0x41df0f
jl 0x41dea5
cmp dword [ebp - 0x1a00], 0x1909bea5
jae 0x41df0f
cmp dword [ebp - 0x80c], 0x41ac
jne 0x41debd
mov eax, dword [0x4295e4]
mov dword [0x176b050], eax
jmp 0x41df0f
cmp dword [0x176b050], 0xf
jne 0x41df0a
lea ecx, [ebp - 0x82c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
lea edx, [ebp - 0x1040]
push edx
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x834]
push ecx
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0x830]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
jmp 0x41de6c
mov dword [ebp - 0x1044], 0
jmp 0x41df2a
mov ecx, dword [ebp - 0x1044]
add ecx, 1
mov dword [ebp - 0x1044], ecx
cmp dword [ebp - 0x1044], 0x2750d3
jge 0x41dfb1
cmp dword [ebp - 0x1044], 0x197
jge 0x41df4c
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuItemID]
cmp dword [0x176b050], 0x449
jne 0x41df66
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
mov dword [0x1762aa4], 0
cmp dword [ebp - 0x1044], 0x1b799
jle 0x41dfac
cmp dword [ebp - 0x1070], 0x50854379
je 0x41dfac
cmp dword [ebp - 0x1060], 0xd7ea37
je 0x41dfac
cmp dword [0x176b050], 0x1b5
jne 0x41dfac
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
jmp 0x41df1b
mov dword [ebp - 0x1074], 0
jmp 0x41dfcc
mov edx, dword [ebp - 0x1074]
add edx, 1
mov dword [ebp - 0x1074], edx
cmp dword [ebp - 0x1074], 0x496e6f
jge 0x41e01e
cmp dword [ebp - 0x1074], 0xff832
jne 0x41dff3
mov eax, dword [0x176b050]
add eax, 0x12336
mov dword [0x176b050], eax
cmp dword [0x176b050], 0x65
jne 0x41e01c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41dfbd
call fcn.0041c320
mov dword [ebp - 0x1098], 0
jmp 0x41e03e
mov ecx, dword [ebp - 0x1098]
add ecx, 1
mov dword [ebp - 0x1098], ecx
cmp dword [ebp - 0x1098], 0x1083a
jge 0x41e073
cmp dword [0x176b050], 0x105
jne 0x41e071
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push str.totuzuticiyabajovolivomepaha
push str.pipeyawiyowutuvasufiwirujudo
push str.behiv
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
jmp 0x41e02f
mov dword [ebp - 0x109c], 0
jmp 0x41e08e
mov edx, dword [ebp - 0x109c]
add edx, 1
mov dword [ebp - 0x109c], edx
cmp dword [ebp - 0x109c], 0xe5fbc
jge 0x41e105
cmp dword [0x176b050], 0x9e2
jne 0x41e0ce
push 0
push 0
push str.minucoxowif
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x11e0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp dword [ebp - 0x109c], 0x3b22
jne 0x41e0e6
mov ecx, dword [0x428fc8]
mov dword [0x176b054], ecx
cmp dword [0x176b050], 0xdb5
jne 0x41e100
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
jmp 0x41e07f
mov dword [ebp - 0x11e4], 0
jmp 0x41e120
mov edx, dword [ebp - 0x11e4]
add edx, 1
mov dword [ebp - 0x11e4], edx
mov eax, dword [ebp - 0x11e4]
cmp eax, dword [0x176b050]
jae 0x41e19b
cmp dword [0x176b050], 0x932
jne 0x41e168
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [ebp - 0x11e8]
push ecx
push 0
push str.podukixunubesagobibecikexinepe_xadawusafurepojisogavakayuhur_rucatupisubohehupuladula
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edx, dword [ebp - 0x11e4]
push edx
call fcn.0041d2f0
cmp dword [0x176b050], 0x22
jne 0x41e196
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
push 0
lea eax, [ebp - 0x11ec]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x41e111
mov dword [ebp - 0x11f0], 0
jmp 0x41e1b6
mov ecx, dword [ebp - 0x11f0]
add ecx, 1
mov dword [ebp - 0x11f0], ecx
cmp dword [ebp - 0x11f0], 0xe96350
jge 0x41e1db
cmp dword [0x176b050], 0xdda
jne 0x41e1d9
push str.xebumowaxoyewapamedut
call dword [sym.imp.KERNEL32.dll_FindAtomW]
jmp 0x41e1a7
mov dword [ebp - 0x11f4], 0
jmp 0x41e1f6
mov edx, dword [ebp - 0x11f4]
add edx, 1
mov dword [ebp - 0x11f4], edx
cmp dword [ebp - 0x11f4], 0x3dc4a3
jge 0x41e212
cmp dword [ebp - 0x11f4], 0x26
jne 0x41e210
call fcn.0041c340
jmp 0x41e1e7
call fcn.0041db60
cmp dword [0x176b050], 0x1d
jne 0x41e267
push 0
push 0
push 0
push 0
push str.govosuharu
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push 0
push 0
push 0
push 0
push str.lusalututowagex
push str.bekaheh
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
lea eax, [ebp - 0x19f8]
push eax
push str.yugab
push str.buvexosugesaregaju
push str.lufuwacimajocegufoharesexer
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10