Function at 0x4084ba
Capabilities:
Accept command line arguments
Create mailslot
Get common file path
Get disk size
Get hostname
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1880
call fcn.00408ec0
push ebx
push esi
push dword [0x2c2ccfc]
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x2c2c6f8], eax
mov esi, 0x519167
cmp dword [0x2c2ccfc], 0x37
jne 0x4085c4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push ebx
push ebx
lea eax, [ebp - 0x1880]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LockFile]
lea eax, [ebp - 0x480]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1080]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xc80]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
push ebx
push ebx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
dec esi
jne 0x4084e2
cmp esi, 0x8964f
jne 0x4085e3
push 0x4013dc
push 0x436928
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, 0x1744
jne 0x4085f5
mov eax, dword [0x426008]
mov dword [0x2c2e880], eax
inc esi
cmp esi, 0x79a863
jl 0x4085cb
mov esi, dword [sym.imp.USER32.dll_GetCursorInfo]
push edi
mov edi, dword [sym.imp.USER32.dll_GetMenuInfo]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0x14fb
jge 0x40862d
push ebx
call esi
push ebx
push ebx
call edi
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
push ebx
call dword [sym.imp.USER32.dll_CharUpperW]
cmp dword [0x2c2ccfc], 0x6b
jne 0x40864f
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProfileSectionA]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1816f663
jl 0x40860e
mov dword [ebp - 4], ebx
cmp dword [0x2c2ccfc], ebx
jbe 0x40867c
push dword [ebp - 4]
call fcn.0040823c
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x2c2ccfc]
jb 0x408666
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0x14fb
jge 0x4086a5
push ebx
call esi
push ebx
push ebx
call edi
push ebx
call dword [sym.imp.USER32.dll_GetListBoxInfo]
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
push ebx
call dword [sym.imp.USER32.dll_CharUpperW]
cmp dword [0x2c2ccfc], 0x6b
jne 0x4086c7
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProfileSectionA]
cmp dword [ebp - 4], 0x144a61
jle 0x4086f1
cmp dword [ebp - 0xc], 0xad5cf7
je 0x4086f1
cmp dword [ebp - 0x38], 0xad4c41c
je 0x4086f1
cmp dword [0x2c2ccfc], 0x28
jne 0x4086f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1816f663
jl 0x40867f
xor esi, esi
cmp dword [0x2c2ccfc], 0x15a
jne 0x408712
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp esi, 0x76055
jne 0x40872a
push 0x436928
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x2c2ccf8], eax
inc esi
cmp esi, 0x1756c5
jl 0x4086ff
push 0x436928
push dword [0x2c2ccf8]
mov byte [0x436928], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x436924], eax
xor esi, esi
cmp esi, 0x1c
jne 0x40875b
call fcn.004083bb
inc esi
cmp esi, 0x3debc7
jl 0x408751
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x2c2ccfc], 0x16
jne 0x408783
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x2c2ccfc], 0x9e
jne 0x4087f3
push ebx
lea eax, [ebp - 0xc80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push 0x4013ec
push ebx
call dword [sym.imp.KERNEL32.dll__hread]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSize]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
cmp esi, 0x187276e
jg 0x408808
inc esi
cmp esi, 0x332beaf6
jl 0x408766
push 0x426010
push dword [0x2c2ccfc]
push dword [0x2c2c6f8]
call fcn.00408194
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor edi, edi
cmp dword [0x2c2ccfc], 0x10
jne 0x40883c
lea eax, [ebp - 0xc]
push eax
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomW]
cmp edi, 0x1e674
jne 0x408849
call fcn.004083ad
inc edi
cmp edi, 0x3e4e2
jl 0x408826
mov edi, 0xdd7b3
cmp dword [0x2c2ccfc], 0x21
jne 0x40886f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
dec edi
jne 0x408857
call fcn.00407fb0
push 0x73
pop eax
push 0x6d
mov word [0x2c2cd02], ax
pop eax
push 0x67
mov word [0x2c2cd06], ax
pop eax
push 0x69
mov word [0x2c2cd08], ax
pop eax
push 0x6c
mov word [0x2c2cd04], ax
pop eax
push 0x32
mov word [0x2c2cd14], ax
pop eax
push 0x6c
mov word [0x2c2cd0c], ax
pop eax
push 0x33
mov word [0x2c2cd12], ax
xor eax, eax
mov word [0x2c2cd16], ax
pop eax
push 0x64
mov word [0x2c2cd0a], ax
pop eax
push 0x6d
mov word [0x2c2cd10], ax
pop eax
push 0x2e
mov word [0x2c2cd00], ax
pop eax
push 0x2c2cd00
mov word [0x2c2cd0e], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [0x2c2ccfc], 0x1144
jne 0x40897f
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push ebx
lea eax, [ebp - 0xc80]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x401410
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call edi
lea eax, [ebp - 0x18]
push eax
call esi
lea eax, [ebp - 0x10]
push eax
call esi
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x114]
push eax
call edi
cmp dword [0x2c2ccfc], 0x1d
pop edi
jne 0x4089e4
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push ebx
lea eax, [ebp - 0x1080]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
pop esi
xor eax, eax
pop ebx
leave
ret