Function at 0x4096f0
Capabilities:
Copy file
Create mailslot
Enumerate gui resources
Get file size
Manipulate console buffer
Move file
Print debug messages
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x45f844]
sub esp, 0x868
push ebx
push ebp
push esi
push edi
cmp ecx, 0x177
jne 0x409731
push 0
call fcn.0040a880
push 0
push 0
call fcn.0040a630
push 0
push 0
call fcn.0040a5e0
add esp, 0x14
push 0
call fcn.0040a030
mov esi, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
mov ebx, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [esp + 0x14], eax
cmp ecx, 0x47
jne 0x409842
lea eax, [esp + 0x2c]
push eax
push 0
call esi
push 0
lea ecx, [esp + 0x47c]
push ecx
call edi
xor eax, eax
lea edx, [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
push edx
lea eax, [esp + 0x54]
push eax
push 0x4013c4
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
call ebp
xor edx, edx
xor ecx, ecx
lea eax, [esp + 0x28]
push eax
mov word [esp + 0x28], cx
mov word [esp + 0x2a], dx
mov ecx, dword [esp + 0x28]
push ecx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
lea edx, [esp + 0x7c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x18]
push edx
mov word [esp + 0x24], ax
mov word [esp + 0x26], cx
mov eax, dword [esp + 0x24]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
lea ecx, [esp + 0x48]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov eax, dword [esp + 0x14]
cmp eax, 0x6a1
je 0x409bb0
mov ecx, dword [0x45f844]
cmp ecx, 0xf
je 0x409bc1
inc eax
cmp eax, 0x53f9406
mov dword [esp + 0x14], eax
jl 0x40974f
mov ebp, dword [sym.imp.USER32.dll_CharUpperW]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
xor esi, esi
cmp esi, 0x7423
jge 0x409892
push 0
call ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x3f56b
mov dword [0x45eed0], 0
jle 0x4098dd
cmp dword [esp + 0x18], 0xdfe5c2
je 0x4098dd
cmp dword [esp + 0x5c], 0xdf5954
je 0x4098dd
cmp dword [0x45f844], 0x28
jne 0x4098dd
push 0x4013ec
push 0
push 0
call edi
push 0x4013f8
push 0x40141c
push 0x401450
call ebx
inc esi
cmp esi, 0x180bc451
jl 0x409880
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
xor ecx, ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0x40d
jne 0x409916
push 0x45f844
call fcn.004093a0
cmp dword [0x45f844], 0x78
jne 0x4099dd
push 0x40145c
call esi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
push 0x401494
push 0x4014bc
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov ecx, dword [esp + 0x18]
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0x4014cc
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFile]
mov ecx, dword [esp + 0x14]
inc ecx
cmp ecx, 0x40bd22
mov dword [esp + 0x14], ecx
jl 0x409904
call fcn.00409470
mov edi, dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor ebp, ebp
xor esi, esi
lea ecx, [ecx]
cmp dword [0x45f844], 0x15
jne 0x409a0d
push ebp
push ebp
call edi
cmp esi, 0x1550
jne 0x409a1f
mov eax, dword [0x427008]
mov dword [0x45f848], eax
inc esi
cmp esi, 0x56a453
jl 0x409a00
mov esi, dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov edi, dword [sym.imp.KERNEL32.dll_QueryDepthSList]
mov ebx, dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov dword [esp + 0x14], 0x7015e7
cmp dword [0x45f844], 0xfd
jne 0x409a55
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
cmp dword [0x45f844], 0x23
jne 0x409a76
call esi
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call edi
lea edx, [esp + 0x30]
push edx
call ebx
sub dword [esp + 0x14], 1
jne 0x409a42
xor esi, esi
cmp dword [0x45f844], ebp
jbe 0x409a96
push esi
call fcn.00409260
inc esi
cmp esi, dword [0x45f844]
jb 0x409a87
mov esi, dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, 0x1756bb
cmp dword [0x45f844], 0x15a
jne 0x409ac0
push ebp
push ebp
call esi
push 0x4014e4
push ebp
push ebp
call edi
sub ebx, 1
jne 0x409aa7
call fcn.004093b0
call fcn.00409490
cmp dword [0x45f844], 0x1d
jne 0x409b9f
push ebp
lea eax, [esp + 0x1c]
push eax
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x401514
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push ebp
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push ebp
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebp
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp + 0x28]
push ecx
push ebp
lea edx, [esp + 0x38]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxA]
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebp
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
xor edx, edx
xor eax, eax
mov word [esp + 0x14], dx
mov word [esp + 0x16], ax
mov ecx, dword [esp + 0x14]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
call fcn.00409380
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [0x428100]
mov dword [0x45f844], edx
jmp 0x40986c
push 0
lea eax, [esp + 0x7c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]