Function at 0x405071
Capabilities:
Copy file
Create mailslot
Enumerate files on windows
Get common file path
Manipulate console buffer
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8ec
push ebx
xor ebx, ebx
xor ecx, ecx
cmp ecx, 0x13e6
jne 0x405092
mov eax, 0x38d6
add dword [0x2b8c814], eax
inc ecx
cmp ecx, 0x31a652
jl 0x40507f
push esi
xor esi, esi
cmp esi, 0x1ef75
jge 0x4050b3
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, 0x1ea055ff
jle 0x4050cd
cmp dword [ebp - 4], 0xacef98
je 0x4050cd
cmp dword [ebp - 0x24], 0xad6910c
jne 0x4050d6
inc esi
cmp esi, 0x8deecc68
jb 0x40509e
push dword [0x2b8c814]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x2b8c3c0], eax
mov esi, 0x962be2
cmp dword [0x2b8c814], 0x481
jne 0x405112
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x33c]
push eax
push 0x401290
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp dword [0x2b8c814], 0x721
jne 0x405164
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea eax, [ebp - 0x4ec]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push ebx
push ebx
push ebx
push 0x4012bc
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
dec esi
jne 0x4050ed
cmp dword [0x2b8c814], ebx
jbe 0x405192
push esi
call fcn.00404a67
cmp dword [0x2b8c814], 0x29
jne 0x405189
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
inc esi
cmp esi, dword [0x2b8c814]
jb 0x40516f
cmp dword [0x2b8c814], 0x19c
jne 0x4051d7
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateActCtxA]
lea eax, [ebp - 0x50]
push eax
call esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push 0x4012dc
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x28]
push eax
call esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor esi, esi
cmp esi, 0xab9d
jne 0x4051f1
push 0x428c48
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x2b8c810], eax
inc esi
cmp esi, 0x2594b
jl 0x4051d9
mov byte [0x428c48], bl
xor esi, esi
cmp esi, 0x148
jne 0x40520f
call fcn.00404bae
inc esi
cmp esi, 0x427fa7
jl 0x405202
push 0x417010
push dword [0x2b8c814]
push dword [0x2b8c3c0]
call fcn.00404a3f
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
cmp esi, 0x2f7e4
jne 0x405244
call fcn.00404ba0
inc esi
cmp esi, 0x48122
jl 0x405230
push 0x73
pop eax
push 0x6d
mov word [0x2b8c81a], ax
pop eax
push 0x67
mov word [0x2b8c81e], ax
pop eax
push 0x69
mov word [0x2b8c820], ax
pop eax
push 0x6c
mov word [0x2b8c81c], ax
pop eax
push 0x32
mov word [0x2b8c82c], ax
pop eax
push 0x6c
mov word [0x2b8c824], ax
pop eax
push 0x33
mov word [0x2b8c82a], ax
xor eax, eax
mov word [0x2b8c82e], ax
pop eax
push 0x64
mov word [0x2b8c822], ax
pop eax
push 0x6d
mov word [0x2b8c828], ax
pop eax
push 0x2e
mov word [0x2b8c818], ax
pop eax
push 0x2b8c818
mov word [0x2b8c826], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [0x2b8c814], 0x58c
pop esi
jne 0x405321
push ebx
lea eax, [ebp - 0x8ec]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea eax, [ebp - 0x22c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
push ebx
push ebx
push ebx
lea eax, [ebp - 0xec]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
call fcn.00404b99
xor eax, eax
pop ebx
leave
ret